This Privacy Notice Supplement applies if you are a data subject in a GDPR Country or the GDPR applies to your personal data that we may be processing. Lotame is the data controller for processing personal data provided to us through our Sites. We take every reasonable step to ensure that the personal data we process is limited to the personal data that is reasonably required in connection with the purposes set out in our Corporate Privacy Notice.
Our use of data relating to your use of the Sites and our Services is necessary for our legitimate interests so that you may use our Sites, in understanding how the Sites and the Services are being used by you, to improve your experience when using our Sites or Services, and to detect and prevent potential security issues on our Sites. When we process your personal data for our legitimate interests, we make sure to consider and balance any potential impact on you, and your rights under the GDPR. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or those activities are otherwise required or permitted by law.
In certain cases, such as using the Contact Us form or subscribing to our newsletters, the collection of personal data is based on your consent. Your consent is stored and documented in our systems. You may withdraw any consent to personal data processing at any time.
Lotame participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Data Bridge), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (collectively referred to as the “DPF”). The DPF was developed in furtherance of transatlantic commerce by the U.S. Department of Commerce and the European Commission, the UK Government, and the Swiss Federal Administration to provide U.S. companies with reliable mechanisms for personal data transfers to the United States from the EU/EEA, the UK (and Gibraltar), and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law. You can learn more about the DPF on the U.S. Department of Commerce site. You can view Lotame’s certification by visiting the DPF participant page.
Lotame commits to operate and process personal data in compliance with the DPF and the DPF Principles, and to refer unresolved complaints concerning our handling of personal data received in reliance on the DPF to ANA DPF Dispute Resolution, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit ANA DPF Dispute Resolution for more information or to file a complaint. The services of ANA DPF Dispute Resolution are provided at no cost to you.
ANA DPF Dispute Resolution
2020 K Street NW, Suite 660
Washington, DC 20006
https://ana.net/dpf-consumers
Lotame is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission, the U.S. Department of Transportation, and other U.S. authorized statutory bodies that are authorized to ensure compliance with the DPF Principles. Under certain conditions, more fully described on the DPF website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
Lomate may transfer your personal data to processors acting on behalf of and under the instruction of Lotame. When Lotame transfers your personal data to one of its processors, Lotame takes reasonable and appropriate steps to ensure that its processors process your personal data in accordance with the GDPR and in a manner consistent with Lotame’s obligations under the DPF Principles and Lotame remains generally liable for the acts of its processors that are in violation of the DPF Principles. Lotame requires that its processors either:
Lotame is committed to protecting the privacy of your personal data in accordance with the GDPR. However, national security and law enforcement needs should not come at the expense of individual privacy. Lotame requires government and private entities to follow applicable laws and statutes when requesting access to the personal data that we process. We contractually require our processors to adhere to the same or similar standards we apply to government information requests for personal data. Our legal team reviews requests to ensure that the requests have a valid legal basis. If they do, we comply by providing data responsive to the request. If a request does not have a valid legal basis, or if we consider it to be unclear, inappropriate, or overly broad, we challenge or reject the request.
Pursuant to Article 27 of the GDPR, we have appointed European Data Protection Office (EDPO) as our GDPR Representative in the EU/EEA. You can contact EDPO regarding matters relating to the GDPR, you can contact EDPO using one of the following methods.
In the UK, our representative is our UK subsidiary: Lotame Solutions International Limited, Suite 2 First Floor, 10 Temple Back, Bristol, United Kingdom, BS1 6FL.
As a resident of a GDPR Country, you have the right to request certain information from Lotame or the right to request Lotame to take certain actions related to the processing of your personal data (“Privacy Rights”). If you wish to exercise any of the below-mentioned rights, we may ask you for additional information to confirm your identity and for security purposes, in particular before disclosing personal data to you. You can exercise your rights by using our privacy request form or by contacting us at privacy@lotame.com.
The right to access or know the information we have on you.
You have the right to correct any inaccuracies in the personal data we process about you.
You have the right to object to our processing of your personal data.
You have the right to request that we restrict the processing of your personal data.
You have the right to be provided with a copy of the information we have on you in a structured, machine-readable, and commonly used format.
You also have the right to withdraw your consent at any time where Lotame relied on your consent to process your personal data.
“the GDPR” includes (1) the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”) and (2) the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), and Switzerland’s Federal Act of 25 September 2020 on Data Protection (“FADP”).
“GDPR Countries” includes all countries in the European Union/European Economic Area that have implemented the GDPR, Switzerland, and the United Kingdom of Great Britain and Northern Ireland.