Privacy Policy for JCDecaux Digital Advertising Services

(View archived version, view changes)

This Privacy Policy describes the principles and practices that apply when JCDecaux North America, Inc. and subsidiaries controlled by or under common control with JCDecaux (“JCDecaux,” “we,” or “us”) broadcasts, collects or processes data in the course of providing its services, such as when analyzing the data generated when an individual (“you” or “your”) interacts with a JCDecaux advertising display.

For the Privacy Policy that covers the practices that apply to the data generated when an individual visits JCDecaux’s website, located at www.jcdecauxna.com, please see the Privacy Notice for JCDecaux North America.

For the Privacy Policy that covers services provided outside of North America by JCDecaux entities, please see the Group Privacy Policy located at www.jcdecaux.com/jcdecauxs-privacy-and-personal-data-protection-policy.

In summary:

JCDecaux does not collect information that directly identifies individuals (such as name, email address or telephone number) whose mobile devices interact with JCDecaux assets or who otherwise interact with JCDecaux assets without their consent.
JCDecaux shares aggregated or statistical information with business partners, such as media buyers who use it to make decisions regarding their advertising campaigns and better adapt their campaign to the assumed interests of their target audience.
JCDecaux’s third party partners process and analyze data generated when Technologies attached to JCDecaux Assets collect data or interact with mobile devices to create information that is used to plan and manage advertising campaigns.

Definitions
For ease of use of this document, certain terms have been associated with the specific meaning provided below.

“Ad Impression” means a single instance of the display of an advertisement to an individual.

“Aggregated Data” means the consolidation of information relating to multiple individuals or information that has been combined with other data and therefore cannot be traced back to a specific individual.

“Data” means data about a person’s whereabouts, activities, or location relative to a JCDecaux Asset, or that is generated by, or results from, the interaction of a person with an Asset, such as for example, interaction with a QR Code affixed on a bus shelter owned or operated by JCDecaux. It can also be provided by our third party partners (“Third Party Providers”) who have access to their own data sources and are able to correlate their information to JCD Assets.

“De-Identified Data” means data that has been rendered anonymous by removing any information that would allow someone to determine an individual’s identity.

“Device Advertising ID” means an identifier that is associated with a particular device, but will not be used to determine the identity of the owner or user of that device. The most common types of Device Advertising ID are IDFA (for iOS devices) and GAID/AAID (for Android devices).

“JCDecaux Asset” or “Asset” means an advertising display owned or operated by JCDecaux and affixed on structures such as, but not limited to, buildings, walls, bus shelters, benches, newsstands, kiosks signage displays or other type of panel.

“JCDecaux Services” or “Services” means the services, proprietary platforms, tools, methodology and equipment developed by or for JCDecaux to collect or receive data about its Assets and to enable Media Buyers to plan for, measure, manage, and optimize their digital advertising campaigns.

“JCDecaux Technology” or “Technology” means any of the identifying technologies that are affixed on JCDecaux Assets and that are used or intended to be used to transmit or convey certain information. JCDecaux Technologies include, for example, beacons, NFC tags, cameras, sensors and QR Code tags (defined below in this document).

“MAC Address” (or Media Access Control Address) means the unique identifier assigned to network interfaces of a computer or device for communications with a network (ISP, cellular, etc.).

“Media Buyer” or “Customer” means a company that advertises its products or services, or those of its clients, on advertising signage displays, bus shelters, mobile phones or tablets or similar platforms. For example, a department store that advertises its shoes, or a university that advertises its courses could be a Media Buyer.

“Personal Information” (or PI) means information that directly or indirectly identifies a specific person, for example, name, address, telephone number, email address, or payment card number or government-issued identifier, and does not include publicly available information or De-identified or Aggregated Data.

OVERVIEW
Information about data collected by third parties that was licensed or used by JCDecaux during the prior 12 months is described below.
You may be able to access, delete and control certain uses of your information as set forth in the “What Rights Do I Have?” section below.

Categories of Personal Information	Sources of such Personal Information	Business Purpose for such Personal Information	Categories of Third Parties with whom information is shared
Online identifiers such as mobile device IDs, advertising IDs, IP address and other technical information about your mobile device.	Collected by third parties through sensors, beacons and NFC and QR Code Interactive Touchpoints on our Assets when you are in the vicinity of, or interact with, one of our Assets; and from our Third Party Providers.	Third parties may use such information to create statistical data about our Assets, to deliver advertising that we believe may be of interest to you and improve and enhance our Services and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.	We share such information with our service providers, business partners, advertising partners, our Customers and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.
Location data.	Collected by us through sensors, beacons and NFC and QR Code Interactive Touchpoints on our Assets only when you are in the vicinity of, or interact with, one of our Assets.	We use such information to create statistical data about our Assets, to deliver advertising that we believe may be of interest to you, and improve and enhance our Services, and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.	We share such information with our service providers, business partners, advertising partners, our Customers and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.
Sensory data including visual images obtained from Asset cameras, if installed.	Collected by us only when you are in the vicinity of one of our Assets that uses camera Technology.	We use such information to create statistical data about our Assets (including advertising engagement measurements and number of viewers) and to improve and enhance our Services and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.	We share such information with our service providers, business partners, advertising partners, our Customers and as otherwise described in “How Does JCDecaux Use and Share this Information?” below.

What Services does JCDecaux Offer?
JCDecaux provides Media Buyers with the ability to advertise their products or services on the JCDecaux Assets. JCDecaux uses Technologies to identify each of its Assets. The Technologies are intended to provide JCDecaux and its service providers and business partners with information about the location of its Assets, and the ability to collect data about people who are in the vicinity of a JCDecaux Asset, or who interact with an Asset. We cannot associate such data with a particular individual without having access to confidential information held by telecommunications or internet service providers.

JCDecaux does not have any direct or indirect means to determine a person’s actual identity (such as name), through our Assets unless the person provides it to JCDecaux.

JCDecaux or its service providers or business partners compile this data to create just-in-time statistical information based on an environment, for example, a plaza, a train station corridor, or a bus shelter. This information is used by Media Buyers to manage and optimize their digital marketing campaigns.

For example, JCDecaux may provide a Media Buyer with information about the number of people standing in the vicinity of a particular JCDecaux Asset during particular time periods based on historical data, such as a bus shelter in New York. This is provided to help the Media Buyer understand the potential number of people or Ad Impressions to which their advertisement would be exposed. The Media Buyer may decide to display an advertisement for its product on that bus shelter based on that information.

What Data does JCDecaux Collect?
JCDecaux or its Third Party Providers may collect, use and share data it collects through your proximity to our Assets or through your interaction with Technologies associated with our Assets including:

Information generated through an NFC or QR Code tag from a JCDecaux Asset, such as audience measurement, which may be received from our service providers or business partners; and
De-identified data from or through the JCDecaux Assets, such as Device Advertising IDs, which we do not re-identify at any time.

JCDecaux does not collect any PI that directly identifies specific individuals from or through the JCDecaux Assets without consent. In some cases, JCDecaux Assets may include an advertisement that collects PI when an individual enters their name, email address, or other PI. In these cases, PI may be collected by a third party (such as an advertiser on a JCDecaux Asset) and not by JCDecaux, and will be subject to that third party’s privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, this third party’s use or your disclosure of your PI.

What Technologies does JCDecaux Use?
JCDecaux may affix Technologies on its Assets as allowed by its advertising agreements with various city authorities or agencies. JCDecaux has entered into contracts with service providers and business partners who are able to read data provided by the Technologies.

Beacons. We may collect your location information through apps on your Devices that interact with beacons. Beacons emit their identification number and information about their location over Bluetooth connections. Only Devices that are equipped with Bluetooth technology and have this feature turned on by you may be able to recognize a signal emitted by a beacon installed on a JCDecaux Asset. Only those Devices that are equipped with app(s) that are able to recognize these beacons may capture the signal emitted by such beacons.
- For Android users, an app is able to detect a beacon signal only if it is in use and only if you have allowed the app to share your location.
- For iOS users, an app is able to detect a beacon signal only if the person has allowed the app to share his/her location.
Cameras. Camera technology may be used when a device is attached to a JCDecaux Asset to capture images in order to count people or measure engagement with a JCDecaux Asset. Neither JCDecaux nor its Third-Party Providers will use facial recognition technology.
NFC and QR Code Interactive Touchpoints. NFC (or Near Field Communication) is initiated by tapping a device on an intelligent NFC interactive touchpoint. The tapping triggers the device’s capabilities to interpret the embedded URL being transmitted by the NFC tag, and opens the corresponding website or application provided by a Third Party within the device environment.
A QR Code is similar to a barcode. When a person scans a QR code using an app located on his/her device, the app interprets the QR Code and accesses the related website or application of the Third Party whose URL address is written into the QR Code.
Sensors. A Sensor is a device, embedded in a JCDecaux Asset, that is used to count nearby devices that are broadcasting a Wi-Fi signal. All data is encrypted using the Advanced Encryption Standard (AES). Only devices within a particular proximity (approximately 80 meters/260 feet) to a Sensor can be detected by said sensor.

How Does the Data Collection Technology Work?
When a person passes or stands by a JCDecaux Asset, the person’s device may interact with a beacon and/or sensor located on or near the JCDecaux Asset. The receipt of the information by a device triggers the transmittal of the information that can be measured and analyzed to develop statistics concerning the environment in which the particular Asset is located. When a person taps on an NFC reader or scans a QR Code touchpoint, affixed on a JCDecaux Asset, the action triggers the transmittal of the information contained in the NFC or QR touchpoint to a third party, an entity that can measure and analyze the data to develop statistics concerning the environment in which the particular Asset is located. If a JCDecaux Asset leverages Camera technology for pedestrian/vehicle counting, then the camera technology will register a count if you are within the range of this specific technology. Importantly, no images or videos are stored or recorded.

This data may be combined with other data collected by the measurement and analysis entity or a third party through other tools. JCDecaux does not have any control over the nature, type, or detail of the data that the person’s Device transmits to third parties. These settings are solely in the control of the publisher of the application that performs such transmittal or that of the person as explained in the section “What Rights do I have?” (located below).

What Information Does JCDecaux Receive from Third Parties?
JCDecaux receives information that does not directly identify you including aggregated data or Device Advertising IDs. This information is derived from data that has been collected by (i) sensors and/or cameras installed by JCDecaux, and/or (ii) measurement and analytics service providers and media buyers (with whom it has previously contracted) whose apps are able to recognize the signals sent by JCDecaux beacons or to interpret the signals generated by interaction with an NFC reader or QR codes affixed on the JCDecaux Assets when they interact with peoples’ devices. JCDecaux’s service providers or business partners may use this information to help the Media Buyer infer that a particular JCDecaux Asset is located in an area where at a certain time of the day or the week, a certain percentage of people walking in that area meet a certain profile, such as certain demographics, interest, lifestyle, median age, interest or socio professional background. For example, the aggregate information might indicate the number of adults, who are walking in a particular area, who appear to be interested in classical music but does not directly identify a particular individual.

What is Required from Business Partners, Service Providers, Third Party Data Suppliers, and Media Buyers
JCDecaux requires its business partners, service providers, third party data suppliers, and Media Buyers that deal with Interest Based Advertising (IBA) to comply with the requirements of the DAA. For information about the DAA you should visit the following site: DAA: http://www.aboutads.info/.

How Does JCDecaux Use and Share this Information?
JCDecaux does not use any PI that directly identifies individuals when providing the JCDecaux Services will not use any PI without consent. We use information only in aggregated form (i.e. combined with that of hundreds or thousands of other individuals) to create statistics and analytics regarding the people that walk by or near our JCDecaux Assets.

Service Providers and Business Partners. We allow our service providers and business partners to use in raw form the data that they receive and that is emitted when a sensor and/or beacon communicates with an individual’s device, or when a person activates an NFC or QR Code communication from one of our Assets.

These service providers and business partners may include, for example, Advertisers, Advertising Networks, Ad Exchanges, Ad Servers, Agency Trading Desks and Demand Side Platforms (DSP’s), who may use this information for analytics purposes (e.g. to create statistics about the pedestrian traffic near a JCDecaux Asset) or for retargeting purposes (e.g. to deliver an ad to a person who is assumed to have seen an advertisement on a JCDecaux Asset). The information collected as indicated above, after it has been combined with third parties’ information, may be used to make decisions regarding where and when to display advertisements. For example, an advertiser or advertising agency may elect to purchase advertising space on that particular JCDecaux Asset after the advertiser or advertising agency has identified that a particular JCDecaux Asset meets their needs and requirements for advertising purposes.

Third Party Mobile Advertising Suppliers. JCDecaux may also partner with third party suppliers who provide mobile advertising programs. These third parties are able to deliver an advertisement to a person’s mobile device when they are in the vicinity of any JCDecaux Asset, or have interacted with an Asset in the past, through the use of anonymous mobile identifiers (IDFA, AAID, WindowsID).
To Defend or Enforce our Rights. We may use or share data, if any, in our custody or control: (i) to protect ourselves, (ii) to protect the JCDecaux website, (iii) to establish or exercise our legal rights, (iv) to identify a breach of contract, (v) when we believe it is appropriate to protect the property and rights of JCDecaux or a third party, the safety of our company, our Media Buyers or others, or (vi) to investigate, prevent, take action against, or stop any fraudulent, illegal, unethical, or legally actionable activity.
Business Transfers. JCDecaux may share data with its affiliates and subsidiaries. Additionally, JCDecaux may engage in corporate restructuring, acquisitions or divestitures, and we may disclose, share or transfer some or all of the data associated with our Assets, as part of the due diligence, or after the transaction has been consummated, to allow for continuation of Services or in connection with a bankruptcy proceeding.
Compliance with Laws and Third-Party Requests. JCDecaux cooperates with government and law enforcement officials or private parties to enforce and comply with the law, as required by applicable law. We may disclose data associated with JCDecaux Assets to government or law enforcement officials or private parties as we, in our reasonable discretion, believe necessary or appropriate to respond to legal process (including a facially valid subpoena, warrant, court order or other legal process), respond to and defend against legal claims, or otherwise as required by applicable law.
Aggregated Data. JCDecaux may aggregate data about different Assets in order to obtain statistical information. We may create, publish, share or sell industry reports, analyses and similar materials that are used for industry analysis, demographic profiling, sales, marketing, and other business purposes. These reports provide data in aggregate form. No individual, company, or customer will be identified from these reports.

Sales of Personal Information
We do not sell your Personal Information but may transfer it to third parties, subject to your right to opt-out of those transfers/sales (See the “Rights to Your Information” section below).

In the preceding twelve (12) months, we have transferred/sold the categories of Personal Information in the chart set forth above.

Security
JCDecaux employs administrative, physical, network and electronic measures designed to protect data associated with our Assets from unauthorized access, loss, misuse, disclosure, alteration, and destruction, in accordance with the sensitivity of such data. While we do our best to implement security measures, we do not guarantee that our safeguards will always work. JCDecaux is not liable for unauthorized disclosure of data that occurs through no fault of JCDecaux.

Data Retention
JCDecaux retains data only as long as we have a business need for such data.

What Rights do I Have?
We respect the privacy of individuals. To this end, we identify below the privacy choices that people may have:

Collection by Third Parties. PI may be collected about a person’s presence near a JCDecaux Asset by or through third party apps that the person has installed on his/her device, in addition to collection via Bluetooth and Wi-Fi. JCDecaux does not interact directly with people, and therefore, we are not able to offer people the ability or any technology that would provide the ability to block the collection of data associated with JCDecaux Assets. However, you may learn more about your choices by visiting our website at https://www.jcdecauxna.com/.

Beacons. To prevent the collection of information by third parties, in response to a signal from a beacon, people can do any of the following:
- Power off their phone
- Disable Bluetooth (which will prevent interaction with a beacon)
- Disable Wi-Fi (which will prevent interaction with a sensor)
- Prohibit the use of geolocation
- Remove or not use those applications that are able to interact with the JCDecaux Technologies.
NFC or QR Code Signals. To prevent the collection of information by third parties, in response to an NFC or QR Code signal, people should not use or interact with NFC or QR code touch points.

Interest Based Advertising. The advertising industry offers means for individuals who want to limit the collection of data about them for Interest Based Advertising (IBA). If you wish to prevent certain forms of tracking, you may wish to consider the use of the AppChoices App, offered by the Digital Advertising Alliance, which provides the ability to limit the collection of data for interest based advertising from all or a number of the companies that participate in the DAA program on a mobile device. We comply with the principles set forth by the Digital Advertising Alliance. For more information, please visit: http://www.aboutads.info/appchoices.
Mobile. You may also wish to adjust the setting on your mobile device. On these settings, you will be able to reset your device’s Advertising ID and/or limit ad tracking. Please note that by limiting ad tracking through the settings on your device, you will disable all ad tracking, not just those of a specific entity.

iOS Users
For iOS 6 users: Go to Settings / General / About / Advertising.
For iOS 7 and more recent users: Go to Settings/ Privacy / Advertising.
Android Users
Go to Google Setting / Ads / Opt-out of Interest-Based ads.

Jurisdiction-Specific Rights. If you reside in a jurisdiction that provides similar rights, under CCPA or applicable law, you have specific rights regarding your Personal Information. This section describes the rights that you have under CCPA, or other state laws as applicable, and explains how to exercise those rights.

Right to Know About Personal Information Collected, Disclosed or Sold. You have the right to request that we disclose certain information to you about our collection, use, disclosure or sale of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see “Exercising Access, and Deletion Rights” below), and subject to certain limitations that we describe below, we will disclose such information to you. You have the right to request any or all of the following:

The categories of Personal Information we collected about you.
The categories of sources from which the Personal Information is collected.
Our business or commercial purpose for collecting or selling that Personal Information.
The categories of third parties with whom we share that Personal Information.
The specific pieces of Personal Information we collected about you

Right to Request Deletion. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see “Exercising Access, and Deletion Rights” below), we will delete (and direct our service providers to delete) your Personal Information from our records. However, we may retain Personal Information that has been de-identified or aggregated. Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) in order to perform certain actions set forth under CCPA, such as detecting security incidents and protecting against fraudulent or illegal activity.
Exercising Access and Deletion Rights. To exercise the access and deletion rights described above, please submit a request to us by either:
- Visiting http://www.jcdecauxna.com/privacy-notice and selecting “Contact us”.
- Contact us at privacy-usa@jcdecaux.com or by mail addressed to JCDecaux North America, Inc., 350 Fifth Avenue, 73^rd floor, New York, New York 10118, attn: General Counsel.

Only you, or a person or business entity registered with the California Secretary of State that you authorize to act on your behalf (an “authorized agent”), may make the requests set forth above. You may also make a request on behalf of your minor child.

The request should include your contact information and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. In addition, you should provide sufficient information (including name, email address and phone number ) that allows us to reasonably verify that you are the person about whom we collected the personal information or an authorized representative.

We will respond to consumer requests in a reasonably timely manner. If we require extra time to respond, we will inform you of the reason and extension period in writing.

In order to protect the security of your Personal Information, we will not honor a request if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. The method used to verify your identity will vary depending on the nature of the request. Generally speaking, verification will be performed by matching the identifying information provided by you to the Personal Information that we already have.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. We are not obligated to provide the information set forth above under “Right to Know About Personal Information Collected, Disclosed or Sold” more than twice in a 12-month period.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights, including, but not limited to, by:

Denying you goods or services.
Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Providing you a different level or quality of goods or services.
Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Our Policy Towards Children
We do not knowingly collect PI from devices associated with users under age 13. If we become aware that we are inadvertently in possession of PI about a child under age 13, we will remove such data from our files.

Changes
This Privacy Policy may be updated from time to time for any reason. We will notify you of any material changes to this Privacy Policy by posting the new Privacy Policy for Digital Advertising Services on the JCDecaux Site, and as required by applicable law. Except as stated above, all changes will apply to the data that are already collected, and to data that are collected after the effective date of the revised Policy. You are advised to consult this Privacy Policy regularly for any changes.

How to Contact Us
If you have any questions about this Privacy Policy, please contact us via our website or by mail addressed to JCDecaux North America, Inc., 350 Fifth Avenue, 73rd Floor, New York, NY 10118, attn: General Counsel.