CALIFORNIA ‘SHINE THE LIGHT’ LAW
Residents of the State of California may ask us to provide them with a list of the types of personal information that we have disclosed during the preceding year to third parties for their direct marketing purposes, and the identity of those third parties. If you are a California resident and would like such a list, please contact us.
For all requests, you must put the statement “CA shine the light” in the subject field of your request and include the name of the data controller (listed in the ‘About Us’ section) to which you are requesting the information. You must also include your name, contact details, address and other identifiers that will help us locate your information.
NOTICE TO CALIFORNIA RESIDENTS
The California Consumer Privacy Act of 2018 (“CCPA”) and California Privacy Rights Act of 2020 (“CPRA”) provide certain rights to residents of California. This section of our Policy applies if you are a natural person who is a resident of California (“California Consumer”) and you use our products or services. Certain terms used below have the meanings given to them in the CCPA and CPRA. The CCPA and CPRA shall be collectively referred to herein as the “CPRA”.
Categories of personal Information we collect about you, why and how
Summarised in the table below are the categories of personal information we may collect about you over the past twelve (12) months, depending on how you interact with us. The following table also describes how we collect and use such categories of information.
You can find further information about the categories of personal information we may have collected about you, as well as the sources and method of collection, in the ‘Collection of Your Information’ section of this Policy. The precise categories collected and purposes used will depend on which of our products and services you interact with.
Categories of information collected
Purposes of collection
Sources of personal information
Identifiers
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Commercial Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Financial Data
Performing Services, Auditing, Data Security & Fraud Prevention, Repairs, Quality and Safety
Directly from you, Affiliates & Partners
Internet Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Geolocation Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Sensory Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Service Use
Inference Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Protected Data
Performing Services, Auditing, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Profile Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Service Use
Associated Data
Performing Services, Auditing, Short-term Use, Data Security & Fraud Prevention, Repairs, Research and Development, Quality and Safety, Commercial Interests
Directly from you and your devices, Affiliates & Partners, Service Use
Categories of Personal Information Collected:
- Identifiers (such as your contact information (name, email address, postal address, phone number)), unique personal identifiers (such as device ID, cookies, IP address) (“Identifiers”)
- Commercial information (such as transaction data, viewing history or purchase history) (“Commercial Data”);
- Financial information (such as credit card information) (“Financial Data”);
- Internet or other network or device activity (such as browsing history or app usage) (“Internet Data”);
- Geo-location information (such as city, state and zip code associated with your IP address) (“Geolocation Data”);
- Sensory information (such as audio or visual information) (“Sensory Data”);
- Inference information about you (such as preferences) (“Inference Data”);
- Legally protected classifications (such as gender, marital status) (“Protected Data”);
- Profile data about you and any inferences drawn from the profile data (such as characteristics, behaviors, attitudes) (“Profile Data”);
- Information that identifies or can be reasonably associated with you (“Associated Data”).
We do not knowingly collect or use the personal information of consumers under the age of 18.
We do not process sensitive personal data as defined in the CPRA.
RETENTION OF PERSONAL DATA
We will retain the categories of information identified for as long as is reasonably necessary for the purposes for which they were originally collected, as laid out in this policy, or while there is a legitimate reason for doing so.
BUSINESS OR COMMERCIAL PURPOSE FOR WHICH WE COLLECTED OR DISCLOSED PERSONAL INFORMATION
- performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, responding to complaints and data subject rights requests, defence of legal claims, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services (“Performing Services”);
- auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance (“Auditing”);
- Short-term, transient use, including, but not limited to, the contextual customisation of ads shown as part of the same interaction (“Short-term Use”);
- detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity (“Data Security & Fraud Prevention”);
- debugging to identify and repair errors that impair existing intended functionality (“Repairs”);
- undertaking internal research for technological development and demonstration (“Research and Development”);
- undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us (“Quality and Safety”); and
- to advance our commercial or economic interests, such as by inducing another to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction (“Commercial Interests”).
CATEGORIES OF SOURCES FROM WHICH WE MAY COLLECT PERSONAL INFORMATION
The sources from which we may have collected personal information about you or your use of the Services are set out in the ‘Collection of Your Information’ section of this Policy. These include information collected:
- Directly from you and your devices;
- From other sources (such as our affiliates and/or business partners like Experian or Credit Reference Agencies, Commercial Partners, White Label Products you engage with, Analytics providers, social media networks);
- Through your use of the Services
HOW WE SELL/ SHARE AND DISCLOSE YOUR INFORMATION
We will share the personal information collected from and about you over the past twelve (12) months as discussed above for various business purposes. The chart below explains the categories of information that we may share with third parties and the categories of those parties.
Third Parties we share information with
Purposes of sharing
Categories of information shared
Our subsidiaries and Affiliated Businesses
We may share information we collect within our family of companies to deliver products and services to you, and enhance our products, services, and your customer experience, consistent with this Policy (newsprivacy.co.uk). Those businesses may also use your information for their own purposes, including marketing purposes where they have the correct marketing permissions or a legitimate interest exists.
- Identifiers
- Commercial Data
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Profile Data
- Associated Data
Third Party Partners for Marketing Purposes
We may share your information with partners if you participate in competitions and provide your permission for their marketing purposes. You will be asked to opt in to this.
- Identifiers
- Commercial Data
- Inference Data
- Profile Data
- Associated Data
Third Party Partners to Provide Co-Branded Products and Services
In some cases, we may share information with third-party partners to provide co-branded products or services.
- Identifiers
- Commercial Data
- Financial Data
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Protected Data
- Profile Data
- Associated Data
Third Parties for Legal Requirements and Proceedings
We may disclose information to law enforcement authorities or other government officials if we are required to do so to comply with subpoenas, court orders, legal process or other law enforcement or government measures, and to comply with other legal obligations. We may disclose information if we believe disclosure is necessary or appropriate in connection with an investigation of suspected or actual fraudulent or illegal activity.
- Identifiers
- Commercial Data
- Financial Data
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Protected Data
- Profile Data
- Associated Data
Third Parties for the Protection of our Services and Users
We may disclose information to protect and defend the rights, interests, and safety of the Services, our subsidiaries and affiliates, and their employees, contractors and agents; to protect the security and safety of our users of the Services, including when we believe disclosure is necessary to prevent physical harm or financial loss.
- Identifiers
- Commercial Data
- Financial Data
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Protected Data
- Profile Data
- Associated Data
Third Parties in Business Transfers
We may disclose information in connection with a proposed or completed corporate transaction, including for example a merger, investment, acquisition, reorganisation, consolidation, bankruptcy, liquidation, or sale of some or all of our assets.
- Identifiers
- Commercial Data
- Financial Data
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Protected Data
- Profile Data
- Associated Data
Third-Party Online Advertisers and Ad Networks
As discussed in the Cookies and Similar Technologies section of this Policy, our products and services may rely on third-party advertising technologies that allow for the delivery of relevant content and advertising on our sites and other websites you visit, and other applications you use. These technologies will collect certain information to assist in delivering such ads.
- Identifiers
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Profile Data
- Associated Data
Internet Service Providers
In connection with the provision of the Services, we may share information with companies that provide internet services.
- Identifiers
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Profile Data
- Associated Data
Data Analytics Providers
We may share information with companies that provide data analytics services in order to operate, evaluate and improve our business.
- Identifiers
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Profile Data
- Associated Data
Social Networks
We may share information about you with social networks where you have provided your permission.
- Identifiers
- Commercial Data
- Internet Data
- Profile Data
- Associated Data
Operating systems and platforms
We may share information with software companies that power your devices and companies that provide common tools/ information for software or apps about software or app consumers.
- Identifiers
- Internet Data
- Geolocation Data
- Sensory Data
- Inference Data
- Profile Data
- Associated Data
CALIFORNIA CONSUMER RIGHTS & CHOICES
California Consumers may have certain rights in connection with the personal information we collect about you, many of which are subject to exceptions under applicable law:
The right to access and disclosure – You may have the right to request, twice during a twelve month period, the following information about the personal information we have collected about you during the past 12 months:
- the categories and specific pieces of personal information we have collected about you;
- the categories of sources from which we collected the personal information;
- the business or commercial purpose for which we collected or sold the personal information;
- the categories of third parties with whom we shared the personal information;
- the categories of personal information that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose; and
- the specific pieces of personal information we obtained from you in a format that is easily understandable, and to the extent technically feasible, in a commonly used, machine-readable format.
The right to deletion – under certain circumstances, you may have the right to request that we delete your data. If you wish to delete the personal data we hold about you, please let us know and we will take reasonable steps to respond to your request in accordance with applicable legal requirements. If the personal data is no longer needed for any purposes that justify its retention and we are no required by law to retain it, we will do what we can to delete, destroy or permanently de-identify it. Certain information may be exempt from such requests under applicable law. We need certain types of information so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.
The right to correction – you may have the right to have your personal information corrected if it is incorrect.
The right to portability – you may have, subject to certain exceptions, the right to (i) receive a copy of your personal data in a structured, commonly used and machine-readable format, (ii) transmit the data to another business or data controller, and (iii) depending on the circumstances, have us perform that transmission.
The right to non-discrimination – we will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
The right to opt out of the sale and sharing of your personal information – you have the right to opt out of the “sale” or sharing of your personal information. California law broadly defines sale such that it may include allowing third parties to receive certain information, such as cookies, IP address and/or browsing behaviour, to deliver targeted advertising.
If you would like to opt out, you may do so by visiting the Do Not Sell or Share My Personal Information link on the website that you wish to opt out of.
HOW TO EXERCISE YOUR ACCESS, CORRECTION, PORTABILITY AND DELETION RIGHTS
California residents may exercise their California privacy rights by submitting a request via our online portal or by sending an email to dataprotection@news.co.uk with ‘CCPA’ or ‘CPRA’ in the subject line. For security purposes, we will verify your identity – in part by asking you to verify your email address and requesting certain information from you, when you request to exercise your California privacy rights, such as address and photographic ID.
To request that we provide you with the specific pieces of personal information we have from you or to delete personal information we have collected from you, we may also need to ask you for additional information to verify your identity.
Once we have verified your identity (and your agent, as applicable), we will comply with your request, unless an exemption applies.
Where you have requested the categories of information that we have collected about you, or specific pieces of personal information, we will provide the information you have requested, except where not permitted under applicable law or otherwise exempted by the CPRA. For instance, we may not disclose financial account numbers as such disclosure may create an unreasonable risk to your personal information, your account with us, or our business systems.
Where you have requested that we delete personal information that we have collected from you, we will inform you whether or not we were able to comply with your request. Certain information may be exempt from such requests under applicable law.
If we are unable to complete your requests fully for any of the reasons above, we will provide you with additional information about the reasons that we could not comply with your request.
AUTHORISED AGENTS
You may designate an agent to make requests to exercise your rights under CPRA as described above. We will take steps to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorised to make a request on your behalf through providing us with a signed written authorisation or a copy of a power of attorney.
CPRA REQUIRED DISCLOSURES FOR LARGE SCALE PERSONAL INFORMATION PROCESSING
Please see details of requests we received under the CPRA for the previous calendar year, ending December 31st 2024, below:
Requests to know
Received: 0
Complied with: 0
Denied: 0
Requests to delete
Received: 2
Complied with: 2
Denied: 0
Requests to opt out
Received: 0
Complied with: 0
Denied: 0
Requests to correct
Received: 0
Complied with: 0
Denied: 0
Requests to limit
Received: 0
Complied: 0
Denied: 0
The mean number of days it took us to substantively respond to these requests was as follows:
Requests to know – N/A
Requests to delete – 2
Requests to opt out – N/A
Requests to correct – N/A
Requests to limit - N/A
HOW TO CONTACT US
If you are a California Consumer, to submit a request please contact us at dataprotection@news.co.uk. To protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal information or complying with your request. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
The Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CDPA”), Virginia Consumer Data Protection Act (“VCDPA”) and Utah Consumer Privacy Act (“UCPA”) each provide certain rights to residents of Colorado, Connecticut, Virginia and Utah, respectively. This Section of this Policy applies if you are a natural person who is a resident of the States of Colorado, Connecticut, Utah or Commonwealth of Virginia and use our Services (each and all of whom shall be referred to collectively, as “Consumer”). This section supplements the information in the rest of this Policy but for the section aimed specifically at California residents. Certain terms used below have the meanings given to them in the respective laws.
SPECIFIC PROCESSING ACTIVITIES
De-identified or pseudonymous data – In addition to the collection of personal data as described in this Policy, we process de-identified data. With regard to our processing of de-identified data, we take reasonable measures to ensure the de-identified data cannot be associated with a natural person and commit to maintain and use such de-identified data without attempting to re-identify the data, and we require all of our service providers and partners in receipt of such de-identified data from us treat the data in the same manner.
CONSUMER PRIVACY RIGHTS AND CHOICES
In addition to your rights of access, correction, deletion and data portability, as described in the rest of this Policy, Consumers may have certain additional rights in connection with the personal data we collect about you, many of which are subject to exceptions under applicable law:
The right to non-discrimination- We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise your rights.
The right to opt out of the sale and/or processing of your personal data – You have the right to opt out of the sale of your personal data to a third party and/or the processing of your personal data for the following purposes: (1) targeted advertising and (2) profiling.
If you would like to opt out, you may do so by visiting the Do Not Sell or Share My Personal Information link on the website that you wish to opt out of.
HOW TO CONTACT US
To submit a request, please contact us using our portal or contact us at dataprotection@news.co.uk. To protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal information or complying with your request. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
Video Services Notice
Your video content viewing and associated media consumption activities (collectively “Viewing Activities”) may be collected when you use the Services. By watching video content on or through the Services, you are consenting to share your personal information, together with your Viewing Activities, with third parties acting on our behalf and with our advertising and analytic partners described in our Privacy Notice.
Such sharing allows you to take advantage of the full features of the Services, which may include serving you ads on the Services that are of interest to you. Your consent to sharing is valid until you withdraw your consent by contacting us. Please find our opt out mechanism on the contact us section of our privacy notice.
If you do not consent or withdraw your consent in the future, then your Viewing Activities will only be used within News UK and its group companies, including the controllers listed in this privacy notice. and its affiliates,, as set forth in our Privacy Notice, and shared with third parties only in the ordinary course of business.
Additionally, we use session replay tools to help us understand how users interact with our website, diagnose technical issues, and improve the functionality and performance of our services. These technologies may collect information such as pages viewed, clicks, scroll activity, navigation patterns, device and browser information, and similar interaction data.
To comply with U.S. state privacy laws that impose heightened requirements for sensitive data, we configure these tools to mask, suppress or otherwise prevent the capture of any fields that could contain sensitive personal information, such as financial details, government identifiers, health information, or free-text fields where sensitive data may be entered. As a result, we do not use session replay technologies to collect or process sensitive data.
The session replay providers we use act as our service providers/processors and are contractually restricted from using the data for their own purposes. You can control your preferences for analytics and similar technologies through our cookie settings at any time.
Return to Privacy Notice