7. HOW WE COLLECT PERSONAL DATA

1. Personal data you provide to us:
   • You may directly provide us with your personal data when you obtain services via our Site, contact us with inquiries, fill out forms on our Site, subscribe to receive our marketing communications, or provide feedback.
2. Personal data received automatically from your use of our Site:
   • When you access and use our Site, we automatically collect certain Behavioral Data and Technical Data, including through the use of cookies and similar technologies (refer to the 'Website insight and analysis' section).
3. Personal data received from third parties:
   • We may receive personal data about you from third parties, such as analytics providers, data brokers, third-party directories, and technical service providers who assist us in delivering our Site and Services.
4. Publicly available personal data:
   • Occasionally, we collect personal data about you (including Identity Data, Contact Data, or Publicly Available Data) from publicly accessible sources, such as open-source datasets, media reports, or information publicly disclosed by you or a third party (e.g., speeches, published articles, news stories, social media posts).

‍

8. WHO WE COLLECT PERSONAL DATA ABOUT

We collect and process personal data from the following individuals:

• Site visitors: We collect and process your personal data related to your interactions with us and our Site.
• People who contact us with enquiries: If you contact us with an enquiry, submit a complaint, or provide feedback through our Site or surveys, we collect and process your personal data.
• Client personnel: We may collect and process personal data in connection with providing services to you and/or your organization.
• Talent: If you provide services or content to us, or collaborate with us to serve our clients (including participation in content creation), we may collect and process personal data such as Identity Data, Contact Data, Financial Data, and CVs.
• Partner/supplier personnel: If you or your organization supplies products or services to us, or partners with us, we may collect and process your personal data related to these transactions.
• Visitors to our offices, studios, production sites: Personal data you voluntarily provide during visits to our physical locations, including when signing in or accessing our guest Wi-Fi network, may be processed. CCTV footage may also be collected for security purposes.
• Event attendees: Personal data about you may be processed when you attend our events, such as through registration forms or feedback documents.
• Job applicants: If you apply for a job with us, whether through our Site or other means, we collect and process your personal data in connection with your application.
• Members of the public: We may process your data in connection with the provision of services to our clients.

9. HOW WE USE PERSONAL DATA

A. OPERATION OF SITE, PROVISION OF SERVICES, AND MARKETINGI. Operation of the Site

• Browsing our Site: When you browse our Site, we may process Technical Data, including through essential cookies and similar technologies, to ensure the proper functioning and security of our Site.
• Legal basis for processing: It is necessary for us to use your data to fulfill our obligations under any contract we may have with you for the Services, or it is in our legitimate interest to use data in such a manner to provide secure and effective access to our Site.
• Interacting with social media: If you click on social media links on our Site or interact with our social media pages (such as Facebook or Instagram), including 'like' or similar features embedded on our Site, we and the relevant social media platform may receive information regarding your interaction.
• Data collected: Data collected through these interactions may include Behavioral Data and Technical Data. For more details on how we use this personal data, please refer to the 'Website insight and analysis' section.
• Social media platform as controller: The relevant social media platform may also act as a data controller for the personal data collected through your use of our social media pages and may use this data for additional purposes. For information on how the social media platform processes your personal data, please consult the privacy notice of the relevant platform.

Our legal basis for processing
It is in our legitimate interest to utilize personal data as described above to ensure effective provision of the Site and to promote our Site via social media.

Website insight and analysis
‍
We and our third-party partners may employ cookies, web beacons, pixel tags, and similar technologies (collectively referred to as "Cookies") to gather data from the devices you use to access our Site. This data includes Behavioral Data, Technical Data, and certain Profile Data. Please see our Cookie Notice for further information, including details of our third-party partners.

We and our third-party partners use this data for the following purposes:

• Analyzing how you use and the effectiveness of our Site and Services.
• Improving our Site and Services.
• Tracking visitor numbers and gathering insights into browsing habits to enhance our offerings.
• Assessing the performance of our content.
• Identifying which parts of our Site are most engaging and preferred by users, as well as understanding visitor preferences for features and functionalities.
• Understanding the types of marketing content likely to resonate with visitors and customers.

‍
In certain circumstances, we may rely on another lawful basis for using your personal data collected via the use of Cookies. For instance, when we analyze how you use our Site using data collected through analytics cookies, it is in our legitimate interest to use this data to enhance our Site and Services.

II. Provision of our Services
‍
Content creation and talent management:
As part of our content creation services for clients, we maintain talent databases containing Identity Data, Contact Data, Applicant Data, Publicly Available Data, biographies, and personal preferences of individuals considered for specific campaigns. This information is used to select and collaborate with talent.

We gather this information directly from individuals, third-party recruiters or agents, and publicly available sources. In creating content featuring talent, we process their Image Data alongside Identity and Applicant Data.

Our legal basis for processing
It is in our legitimate interests (or those of our clients) to process talent personal data in this manner to facilitate the provision of our services. When processing special category data collected directly from you for this purpose, we will do so only with your explicit consent. If we obtain such special category data from publicly available sources, we rely on the fact that you made this information manifestly public. When acting as a data processor on behalf of our clients, no additional legal basis is required for such processing.

Client data insight and analysis.
We may collect data about you, both independently and on behalf of our clients, in connection with providing our services to conduct insight and analysis in an anonymized and/or aggregate form. This helps us enhance our services and assists our clients in better understanding their customers' interests to improve their products/services. The data collected includes Behavioral Data, Technical Data, and certain Profile Data.

Our legal basis for processing
Where personal data is involved in the activities described above, it is in our legitimate interests (or those of our clients) to process personal data in this manner to facilitate the provision of our services. When acting as a data processor on behalf of our clients, no additional legal basis is required for such processing.

Please note that these services often involve anonymous data sets (such as aggregated or statistical data sets) used for high-level market analytics or understanding macro consumer habits, among other purposes. In such cases, neither we nor our clients are processing personal data.

III. Marketing and Media Enquires
‍
Marketing.
We may use your Identity Data, Contact Data, and Marketing and Communications Data to send you (or the organization you represent) marketing communications via email or phone. Our marketing efforts may include press releases and information about our services.

Our legal basis for processing
It is in our legitimate interest to use your personal data in this manner to ensure our marketing efforts are targeted and appealing to you and/or the organization you represent. Please note that we will only send you marketing communications with your consent.

Media and informational inquiries.
We may gather personal data (including Identity Data, Contact Data, and Publicly Available Data) about journalists, client contacts, or industry contacts for interview requests, media inquiries, or requests for information about BLAK. Additionally, we may offer individuals the option to subscribe to newsletters or receive copies of blogs and other available information. For each subscription, Contact Data may be required along with other pertinent personal details necessary for these inquiries. This information enables us to effectively respond to individual or media requests.

Our legal basis for processing
It is in our legitimate interests (as well as those of our clients) to process personal data in this manner to ensure efficient delivery of services requested by our clients and to provide accurate information to those seeking it.

B: BUSINESS ADMINISTRATION, FINANCIAL AND LEGAL

Receipt of services

If we engage an organization to provide services to us or our clients (such as IT support or financial advice), we collect and process your personal data (including Contact and Identity Data) if you are a contact within that organization. This facilitates managing our relationship with the organization, receiving services from them, and potentially delivering services to others, including our clients.

Our legal basis for processing
It is necessary for us to use personal data in this way to fulfill our contractual obligations with the organization, or it is in our legitimate interest to maintain effective working relationships and deliver services efficiently. When acting as a data processor on behalf of our clients, no additional legal basis is required for such processing.

Recruitment

If individuals apply for a job with us or express interest in working for us, we will collect their contact details and CV or resume information. We use this personal data for the following purposes:

a) Assessing the individual’s suitability for current or future positions, including employment, freelance roles, summer placements, internships, or business support/services roles, whether the application is submitted online, via email, hard copy, or in person.

b) Taking necessary steps to potentially enter into a contract of employment or other agreements with the individual.

c) Compliance with regulatory or legal obligations related to the application process.

d) Reviewing our equal opportunity profile as required by applicable legislation. We do not discriminate based on gender, race, ethnic origin, age, religion, sexual orientation, disability, or any other protected status under local laws.

What is our legal basis?
When using personal data for recruitment and talent management purposes, our legal basis is either:

• Entering into or performing a contract with the individual.
• Our legitimate interests in making informed recruitment and talent management decisions for BLAK.
• Compliance with legal obligations imposed on us.

We do not process any special categories of data unless permitted under applicable legislation or with the explicit consent of the individual.

Visiting our premises, studios or production sites
If an individual visits any of our premises, studios, or production sites, we may collect their Identity or Contact Data as part of our sign-in process. Additionally, their image may be captured on our surveillance cameras or CCTV systems. We may also collect data related to COVID-19 vaccination or testing in accordance with government regulations or guidance.

If an individual registers as a guest user for free Wi-Fi access at any of our premises, we may collect their personal data, including Identity and Contact Data, during the registration process. Additionally, we may process Behavioural and Technical Data related to their use of the free Wi-Fi service. This includes monitoring and record-keeping to identify service requests, optimize Wi-Fi performance, and investigate and prevent system abuse. For detailed information on how we process your personal data in this context, please refer to our Portal Privacy Notice available at the respective location.

Our legal basis for processing

• It is in our legitimate interests to process personal data for security purposes related to Wi-Fi access.
• We collect data related to COVID-19 to comply with legal obligations concerning health and safety during the pandemic.
• When providing access to our free Wi-Fi service, it is in our legitimate interests to process personal data to ensure service delivery.
• Monitoring the use of our free Wi-Fi service for proper system use is based on the consent of guest users.

Business administration, finance, and legal compliance.

We may use an individual’s personal data (including Identity Data, Contact Data, Financial Data, Transaction Data, and Publicly Available Data) for the following business administration and legal compliance purposes:

‍
We will not process any special categories of personal data or personal data relating to criminal convictions or offences unless permitted under applicable legislation or with the explicit consent of the individual. Such processing may be undertaken for the following reasons:

• Facilitating the operation or effective management of our group of businesses.
• Financial, accounting, and tax purposes.
• Compliance with legal obligations.
• Enforcing or protecting our legal rights.
• Handling complaints.
• Protecting the rights of third parties, including cases where an individual's health or security is at risk (e.g., during a fire).
• In connection with a business transition or sale, such as a merger, reorganization, acquisition by another company, or sale of assets.

Our legal basis for processing:

• When using personal data for business transitions or to enforce legal rights or protect third-party rights, it is in our legitimate interest to do so.
• For all other purposes mentioned in this section, we will rely on our legal obligation to comply with applicable laws, including court orders, to process such personal data.

‍12. OBTAINING YOUR CONSENT
If our use of your personal data requires your consent, you can provide consent:

1. At the time we collect your personal data following the provided instructions.
2. By informing us via email, post, or phone using the contact details provided in this Privacy Notice.

Please note, if you consent to additional uses of your personal data, we may use it accordingly, consistent with your consent.

• To confirm whether we process personal data about you, and to access and obtain copies of that information, along with details of the processing we conduct.
• To request correction of your personal data where it is inaccurate or incomplete. It is your responsibility to provide accurate personal data and notify us of any changes (e.g., change of address or name).
• To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, unless we are required to retain it by law or other legitimate reasons. If we have shared your personal data with others, we will inform them about the deletion where possible. Upon request and where feasible and lawful, we will also inform you about the recipients of your personal data so you can contact them directly.

• To request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the personal data while we investigate your concern. Please note, this will not prevent us from storing your personal information. We will notify you before lifting any restriction. If we have shared your personal information with others, we will inform them about the restriction where feasible.
• Upon request and where feasible and lawful, we will also inform you about the recipients of your personal data so that you can contact them directly.
• If processing is based on your consent, you have the right to receive your personal data in a commonly used electronic format or request that we transmit your personal data in that format to another provider, where technically feasible and the data was provided directly by you.
• You have the right to object to the processing of your personal data where we rely on our legitimate interest or that of a third party, or for direct marketing purposes.
• You can withdraw your consent at any time when processing is based on your consent.

‍

Data Subject Rights
Data subjects can exercise these rights verbally or in writing using the contact information provided in the ‘How to contact us’ section. We will make every effort to promptly respond to your requests. If you request a copy of your personal data, we are legally obliged to respond within one month of receiving such a request. If your request is denied, we will provide you with the reasons for denial.

Please note, to exercise these rights, we may need to verify your identity to confirm your entitlement to access your personal data. This is a security measure to ensure that personal data is not disclosed to unauthorized individuals. To verify your identity, we may require additional personal data from you beyond what we currently possess.

Lodging complaints
Additionally, you may have the right to lodge complaints regarding our processing of your personal data with regulators in your jurisdiction. If you have concerns about any aspect of our privacy practices, including how we have handled your personal data, we encourage you to contact us first using the information provided in the ‘How to contact us’ section. If the GDPR applies, you can also report your concerns to the following organizations:

European Economic Area
You can find a list of supervisory authorities and their contact details for the EEA at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

‍United Kingdom
The Information Commissioner’s Office (“ICO”) is the supervisory authority in the United Kingdom. Contact details for the ICO can be found at https://ico.org.uk.

Switzerland
The Federal Data Protection and Information Commissioner (“FDPIC”) is the supervisory authority in Switzerland. Contact details for the FDPIC can be found at https://www.edoeb.admin.ch/.

United States of America
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, BLAK Inc. commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States.  

If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint.  The services of JAMS are provided at no cost to you.

Following the dispute resolution process, JAMS or you may refer the matter to the U.S. Federal Trade Commission, which has investigatory and enforcement powers over us. Under certain circumstances, you also may be able to invoke binding arbitration to address complaints about our compliance with DPF Principles.

19. Notice of Collection and Use of Personal Information
‍
We may collect the following categories of personal information about you:

• Identifiers: These include real names, aliases, postal addresses, unique personal identifiers (such as device identifiers, cookies, beacons, pixel tags, mobile ad identifiers, and similar technologies), customer numbers, unique pseudonyms or user aliases, telephone numbers, internet protocol addresses, email addresses, account names, Social Security numbers, driver’s license numbers, passport numbers, and other comparable identifiers.
  ‍
• ‍Additional Data Subject to Cal. Civ. Code §
  1798.80: This category encompasses signatures, physical characteristics or descriptions, state identification card numbers, insurance policy numbers, educational background, bank account numbers, credit card numbers, debit card numbers, financial information, medical information, and health insurance information.ation, medical information, and health insurance information

• Protected Classifications: These include characteristics protected under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, genetic information, disability, citizenship status, military and veteran status.

• Commercial Information: This category encompasses records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.

• Online Activity: Information related to your internet and other electronic network activities, which includes browsing history, search history, and details about your interactions with websites, applications, or advertisements.

• Sensory Information: Includes audio, electronic, visual, and similar data.

• Employment Information: Information related to professional or employment-related matters.

• Education Information: Non-public education information as defined under the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).‍
• Inferences: Conclusions drawn from the data identified above to create a profile about your preferences, characteristics, psychological trends, behavior, attitudes, abilities, and aptitudes.

• Additional Data Subject to Cal. Civ. Code § 1798.80: This category includes signature, physical characteristics or description, state identification card number, insurance policy number, education details, bank account number, credit card number, debit card number, financial information, medical information, and health insurance information.

‍

We may utilize the categories of personal information mentioned above for purposes outlined in our Privacy Policy. Additionally, these categories may be used for specific business purposes detailed in accordance with the California Consumer Privacy Act (CCPA), as specified in the following table:

‍
Purposes \ Categories of Personal Information
Performing services, including maintaining or servicing accounts, providing customer service, processing orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, offering analytics services, or providing similar services: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Auditing related to a current interaction with you and concurrent transactions, including counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Short-term, transient use, including contextual customization of ads shown as part of the same interaction: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Debugging to identify and repair errors that impair existing intended functionality: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Undertaking internal research for technological development and demonstration: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us: Categories of personal information potentially involved include Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

In addition, we may also use the following categories of personal information for purposes of managing our career opportunities: Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences.

‍20. Our Prior Collection, Use and Disclosure of Personal Information
‍

During the 12-month period prior to the effective date of this California Consumer Privacy Statement, we may have collected and utilized your personal information as outlined in section 1 above. For the personal information collected during that period, we provide the following details:

(a) The categories of sources from which we may have obtained the personal information; (b) The categories of third parties with whom we may have shared the information; and (c) The categories of personal information we may have disclosed for a business purpose.

a. Sources of Personal Information

We may have obtained personal information about you from various sources, as detailed below:

Categories of Sources of Data Collection / Categories of Personal Information:

• Directly from you, such as when you contact us with a question or comment
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences
• From your devices, such as when you visit the Site
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences
• Vendors who provide services on our behalf
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences
• Social networks
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences
• Government entities
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences
• Consumer data resellers
  • Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

b. Sharing of Personal Information

We may have shared your personal information with certain categories of third parties, as described below.

Categories of Third Parties \ Categories of Personal Information

Our affiliates and subsidiaries
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Vendors who provide services on our behalf
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Professional services organizations, such as auditors and law firms
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Our business partners
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Advertising networks
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Internet service providers
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Data analytics providers
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Government entities
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Operating systems and platforms
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

Social networks
Identifiers; Additional Data Subject to Cal. Civ. Code § 1798.80; Protected Classifications; Employment Information; Education Information and Inferences

c. Sale of Personal Information

We do not and will not sell your personal information.‍‍

‍‍

d. Disclosure of Personal Information for a Business Purpose

We may have disclosed the following categories of personal information to third parties for business purposes:

• Identifiers such as a real name, alias, postal address, unique personal identifier (e.g., device identifier, cookies, beacons, pixel tags, mobile ad identifiers), customer number, unique pseudonym, or user alias, telephone number, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers.
• Signature, physical characteristics or description, state identification card number, insurance policy number, education information, bank account number, credit card number, debit card number, and other financial information, medical information, and health insurance information.
• Characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, genetic information, disability, citizenship status, and military and veteran status.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
• Internet and other electronic network activity information, including browsing history, search history, and information regarding interaction with websites, applications, or advertisements.
• Professional or employment-related information.

‍

• Education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).

• Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.