Data Protection Policy

Havas Media Network is committed to protect your personal data and your privacy. We encourage you to carefully read this Data Protection Policy, which informs you of our data protection and privacy practices and the way your personal data are processed by Havas Media Network when acting as a data controller regarding our products and services considering the General Data Protection Regulation (GDPR) and any applicable local data protection and privacy laws and regulations to which the relevant Havas entity is subject. This Policy is available at all times at: https://havasmedianetwork.com/data-protection-policy/.

Havas Media Network strongly supports the fundamental rights to privacy and data protection as well as compliance with national and international privacy laws. Havas commits to maintain confidential any personal data and to strictly limit any disclosure in accordance with applicable local laws and regulations.

Havas Media Network is a member of the Interactive Advertising Bureau (IAB Europe). We are also a registered vendor under IAB’s Transparency and Consent Framework (TCF), a framework built to provide additional transparency and choice for the data subjects with regards to their personal data processed online, with ID 1031.

This Policy is only applicable to the processing activities carried out by Havas Media Network entities indicated in Schedule I as independent data controllers for the collection, processing, use, transmission, transfer and storage of personal data unless a national legislation imposes to some of them specific data protection rules. The Havas Media Network entity processing your personal data will depend on the country you are located in – please consult Schedule I to understand which Havas Media Network Entity is the data controller of your personal data, and what are the means of contacting and exercising your rights recognised by applicable data protection laws.

This Policy shall apply following the General Data Protection Regulation territorial scope principle. For data subjects located in the United Kingdom, this Policy also applies in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy shall apply specifically to the processing activities performed by Havas Media Network subsidiaries. For anything not encompassed herein, general Havas Group policy shall apply, available at www.havas.com/data-protection-policy. In case of inconsistencies or conflicts, this policy shall prevail.

Havas Media Network respects the rights of each individual to have his or her privacy and personal data protected, following at all times the principles below when processing your personal data:

1. Processing your personal data fairly, lawfully and in a transparent manner;
2. Collecting your personal data for specified, legitimate purposes and not processing further in ways incompatible with those purposes;
3. Collecting your personal data which is relevant to and not excessive for the purposes for which it is collected and used. We may render personal data anonymous when feasible and appropriate, depending on the nature of the data and the risks associated with the intended uses;
4. Maintaining your personal data accurate, and where necessary, kept up-to-date. We will take reasonable steps to rectify or delete data that is inaccurate or incomplete;
5. Keeping your personal data only as long as it is necessary for the purposes for which it was collected and processed;
6. Processing your personal data in accordance with the individual’s privacy rights;
7. Taking appropriate technical and organizational security measures to keep your data safe and prevent unauthorized access, unlawful processing, and unauthorized or accidental loss, destruction, or damage to personal data;
8. Processing your personal data only if it is lawful in accordance with a legal basis, including if you have unambiguously given your consent to such process;
9. Applying the principle of ‘privacy by design’ to the processing of personal data.

Havas Media Network will collect or may have access to your personal data to complete following operations. These purposes include the processing of personal data and the processing activities related to aggregated or anonymized information (such as analytical information, campaign impacts, aggregated audiences…):

• Generation of insights and aggregated reports. On the basis of your personal data, we may extract some aggregated patterns. For example, that the age group between 25 and 35 years old is more likely to be interested in technology and travel.
• Matching and combination of personal data. For the generation of insights, we may match the data collected from you on a website with data that a particular brand or make (our advertising client) holds about you as their customer.
• Creation of user profile on the basis of its preferences and behaviour. We can create your profile on the basis of the data received and our insights as we understand it, taking into account your online behaviour: websites visited, articles of interest or products acquired.
• Elaboration of audiences and segments including user profile. We can build an audience with similar interests to be able to impact it with products and services of our advertising clients.
• Targeted advertising on the basis of user segments. We can show you specific, tailored ads of products and services we think you may be interested in, bearing in mind your user profile, segment assignment and preferences.
• Measurement of ad performance. We can access statistical information concerning ad performance, such as number of clicks or approximate location (for example, the country or city you are in).
• Addressing of data subject rights. Lastly, we shall use your personal data to honour your data subject rights requests, such as access, rectification or erasure rights, recognized by applicable data protection regulation.

Havas Media Network will only collect and process your personal data pursuant to prior appropriate notice and your validly-given consent, when it is required. Your consent -and, therefore, choice regarding the collection and usage of your personal data by Havas Media Network – shall always be freely given, specific, and informed by a positive act; you will be able to withdraw it at any time by means established in section 9 of this Policy.
In a general way, Personal data means any information relating to an identified or identifiable natural person (‘Data subject’). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The types of personal data we collect from you may include:

• Personal characteristics data and demographic information: marital status, gender, age range, nationality, income-range, language etc.
• Behaviour data: data about user interests (app usage etc.); purchase data; lifestyle, memberships, licenses, authorisations.
• Navigation behaviour: browsing history, user journey on the site; search queries; session time; site behaviour (contextual and thematic preferences to certain topics and pages, interactions such as downloads, transitions to other pages through clicking on advertisements and links); events (scrolling, clicking, highlights, media views).
• Online and advertising identifiers like IP address; cookie ID, pixel, and all types of online identifiers enabling the use of Data Subjects’ data, internet browser, device type for the purpose of targeting advertising, audience segmentation, analytics or and similar purposes.
• Technical information like user-agent string identifying the browser and device type; user’s location; user’s time zone; detected language of the user’s system; device type (desktop/mobile, brand, model, operating system).

Sources of personal data
Where Havas Media Network does not collect personal data directly from you, your personal data may be obtained from the following sources: (i) cookies, pixels, tags and similar tracking technologies deployed on websites and applications operated by our advertising clients or their partners; (ii) our advertising clients, who may share data they hold about you as their customer for the purposes of data matching and audience insights as described in Section 3; (iii) third-party data partners and data management platforms; (iv) publicly available sources; and (v) advertising technology platforms and sell-/demand-side platforms used in the delivery of digital advertising campaigns.

Regarding the platform and connected systems used by Havas Media Network as data controller, we will:

• not sell, share or rent it to a third party without your permission;
• implement appropriate technical and organisational measures to protect your personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction;
• not process the personal data except:
  • on the basis of your consent;
  • in an aggregated or otherwise anonymised format;
  • as required by law, for example, in response to a subpoena or search warrant;
  • to outside auditors who have agreed to strictly keep the data confidential;
  • as necessary to protect the rights, safety or property of Havas Media Network, its users, or others. This may include (for example) exchanging information with outside auditors who are subject to duty of confidentiality, other organizations or public authorities for official investigation, identification, fraud protection and/or risk reduction.

  Havas Media Network makes reasonable commercial efforts to process only personal data belonging to individuals following the minimum age principles in the GDPR and specific local regulations.

For the purposes and the data indicated under sections 3 and 4 respectively, Havas Media Network primarily relies on your informed consent for the processing of your personal data, which can be withdrawn at any time by means established in section 9 of this Policy. Therefore, the data shall be processed as long as you keep consenting to the processing activity.
If you provide us with personal data about another person, you confirm that they have appointed you to act for them, to consent to the processing of their personal data and that you have informed them of our identity and the purposes (as set out in this Policy) for which their personal data will be processed.
Provision of personal data and consequences of non-provision
The provision of your personal data to Havas Media Network is not a statutory or contractual requirement. Your personal data is processed on the basis of your freely given consent. Should you choose not to provide your consent, or should you withdraw your consent at any time, Havas Media Network will not process your personal data for the purposes described in this Policy. The consequence of not providing or withdrawing your consent is that you may receive non-personalised advertising content, and Havas Media Network will be unable to tailor advertisements, products or services to your preferences and interests. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Data retention
Havas Media Network shall retain your personal data only for as long as is strictly necessary to fulfil the purposes for which it was collected, as described in Section 3 of this Policy, and in accordance with the following criteria:
Cookie and online identifier data: retained for a maximum period of thirteen (13) months from the date of collection, in accordance with applicable regulatory guidance, including the recommendations of the local Data Protection Authorities. At the expiry of this period, fresh consent shall be required for continued processing.
User profile and audience segmentation data: retained for the duration of the relevant advertising campaign or programme, plus a maximum period of twelve (12) months thereafter, according to applicable local regulatory guidance and unless your consent is withdrawn earlier.
Aggregated and anonymised data: as such data does not constitute personal data, it may be retained indefinitely for analytical and reporting purposes.

Havas Media Network uses external providers which could access the information included in this policy. These third parties provide services such as hosting, technical connections in our applications or help us to process your personal data regarding the purposes declared in this policy. Havas Media Network has signed agreements with such providers in accordance with GDPR requirements (for example, article 28 requirements) and verify their security measures. The categories of recipients to whom your personal data may be disclosed include: (i) technology and hosting service providers; (ii) advertising technology platforms, including sell-/ demand-side platforms and data management platforms; (iii) analytics and measurement providers; (iv) our advertising clients, solely in aggregated or anonymised form unless otherwise specified; (v) external auditors and professional advisors who are subject to duties of confidentiality; (vi) other entities within the Havas Group, where necessary for the purposes described in this Policy; and (vii) public authorities, courts or regulatory bodies, where required by applicable law.

As a general rule, Havas Media Network does not transfer data outside of the European Economic Area and the UK. In this sense, Havas Media Network, contractually and making reasonable commercial efforts, verifies that the processing is performed inside of the European Economic Area and the UK.
In the scenario where an international data transfer is required to be made to a third party located in a country which does not offer the same guarantees that are required in the GDPR or the UK GDPR, this transfer will be covered under proper legal mechanisms such as Standard Contractual Clauses, the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, Binding Corporate Rules, or an adequacy decision by the European Commission or the UK Secretary of State, as applicable. In this scenario, Havas Media Network will require such provider the implementation of additional technical and organisational measures, including a transfer impact assessment where appropriate, to protect the processing activities performed.
Automated decision-making and profiling
As described in Section 3 of this Policy, Havas Media Network carries out profiling activities, including the creation of user profiles based on your online behaviour and preferences, the elaboration of audience segments, and the delivery of targeted advertising. These profiling activities involve the automated processing of your personal data to evaluate certain personal aspects, in particular to analyse or predict your preferences, interests and behaviour for advertising purposes. However, Havas Media Network does not carry out any solely automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR. The profiling activities described in this Policy are used exclusively for the purpose of delivering relevant advertising content and do not result in decisions that have a legal or equivalent impact on your rights. You have the right to object to profiling at any time, as set out in Section 9 of this Policy.

• Right of access
  As data subject, you may inquire as to the nature of the personal data Havas Media Network owns about you. You will be provided access to your personal data regardless of the location of the data processing and storage.
• Right to rectification
  If your personal data is inaccurate or incomplete, you may request that the data be amended.
• Right to object
  You have the right to object at any time to the processing of your personal data by Havas Media Network, including where we process your data on the basis of legitimate interests as described in Section 6 of this Policy. You also have the right to object to the processing of your personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
• Right to erasure
  You can ask for the deletion of your personal data when it is allowed by applicable data protection laws and regulations.
• Right to restriction of processing
  You have the right to require a restriction of the processing of your personal data when it is authorized by applicable data protection laws and regulations.
• Right to data portability
  If you meet the conditions settled by the applicable data protection laws and regulation, you have the right to receive a subset of your personal data and to transmit them from Havas to another data controller. You can also require the direct transmission from Havas Media Network to another controller when it is technically feasible.
• Right not to be subject to automated individual decision-making
  You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As set out in this Policy, Havas Media Network does not currently carry out such solely automated decision-making.
• Right to lodge a complaint
  You have the right to lodge a complaint with the supervisory authority in the EU or EEA Member State of your habitual residence, place of work, or place of the alleged infringement. For data subjects located in the United Kingdom, the competent supervisory authority is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom (www.ico.org.uk). Data subjects located in the United Kingdom may also submit a complaint to local Havas data controller here.
• Right to define post-mortem instructions ( For France territory)
  In accordance with the French local privacy regulation (Data Protection Act of 6 January 1978, as amended), you have the right to define instructions relating to the retention, erasure and disclosure of your personal data after your death in accordance with the procedures set out below.

All requests for the exercise of the aforementioned rights, and any questions regarding this Data Protection Policy or the processing of your personal data, may be directed to :

• UK: [email protected]
• Spain: [email protected]
• Germany: [email protected]
• Italy: [email protected]
• Poland: [email protected]

For France and other Havas Media Network controllers listed in Schedule I:
to the Havas Group Data Protection Officer at the following address:
Data Protection Officer – Havas Media Network,
29/30 Quai de Dion Bouton, Puteaux Cedex 92800, France.
Email: [email protected]
You can withdraw the consent granted through the cookie configurator or CMP at any moment accessing the vendor or partner list and changing the status of your consent given to Havas Media Network. Also, where applicable, you can access https://www.youronlinechoices.eu/ to modify your preferences.

In order to delete existing cookies, you can use the links below:
For desktop
Chrome
Safari
Firefox
Opera

For mobile device
iOS (Safari)
Android (Chrome)

Havas Media Network reserves the right to modify this privacy policy as needed, for example, to comply with changes in laws, regulations, Havas Media Network practices and procedures, or requirements imposed by data protection authorities. In this case, Havas Media Network will inform data subjects of any material changes in this policy. Havas Media Network will post all changes on relevant Havas Media Network websites.

Last update: July 2026

SCHEDULE I

Company details of Havas local entities