Question 1

1. Who we are (data controller)

Accepted Answer

The data controller is MPG Media Holding B.V., Oscar Romerolaan 14, 1216 TK Hilversum, the Netherlands (Chamber of Commerce no. 94382875), together with – depending on the relevant service – its group company, including MPG Media Services B.V. (Chamber of Commerce no. 34155118).

For specific services, a particular group company may act as the controller. Where relevant this is shown in your account, in-app or via the relevant platform.

In some cases, a platform (e.g. an operator or TV manufacturer) acts as an independent controller for viewer data it collects itself. In such case, please also consult the privacy notice of that platform.

Question 2

2. Scope

Accepted Answer

This notice applies to all services provided by MPG Media Holding B.V. and MPG Media Services B.V., including content management, media processing, (OTT and broadcast) channel playout, localization, content distribution, monetization, web and app development, customer support, consultancy, and other related services.

This includes (but is not limited to):

• our websites, apps and customer support;
 • media distribution and playout services (both broadcast and OTT);
 • content localization, processing and storage;
 • front-end development such as websites and applications;
 • commercial and advertising services;
 • creative and design services for media platforms.

Question 3

3. What data we process, for which purposes and on what legal basis

Accepted Answer

We only process what is necessary for the purposes below. For each purpose we state the legal basis under the GDPR (Article 6).
A. Account and contact data (name, email, place of residence, language preferences)
 • Purposes: create account, provide services, support
 • Legal basis: performance of a contract / pre‑contractual steps (Art. 6(1)(b))
B. Usage and viewing data (content viewed, searches and clicks, timestamps, device and app settings)
 • Purposes: personalization (recommendations), analytics, service improvement, abuse prevention
 • Legal basis: legitimate interests (Art. 6(1)(f))
C. Device data (operating system, device type, technical identifiers)
 • Purposes: technical delivery, troubleshooting, security
 • Legal basis: performance of a contract / legitimate interests (Art. 6(1)(b)/(f))
D. Transaction and payment data (bank/card details via payment provider, invoicing data)
 • Purposes: payment processing, financial administration
 • Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (tax retention) (Art.      6(1)(c))
E. Marketing & communications (preference lists, open/click data)
 • Purposes: newsletters, channel promotions, campaigns (including from partners)
 • Legal basis: consent (Art. 6(1)(a)) or – for B2B contacts – legitimate interests with an easy opt‑out (Art. 6(1)(f))
 • NL‑specific (Telecommunications Act/Telecommunicatiewet): consumer email generally requires prior consent unless the “existing customer” exception applies (with opt‑out).      B2B emails are sent on an opt‑out basis.

We do not sell personal data.

Question 4

4. Sources of personal data

Accepted Answer

In addition to data you provide directly, we may receive data – depending on the service – from distribution/platform partners (e.g. smart‑TV platforms, operators), adtech and measurement partners, payment providers and fraud/security service providers. This may include viewing and interaction data, technical identifiers and campaign/conversion metrics. Where such parties are located outside the EEA, we apply the safeguards described in §7 International transfers.

Question 5

5. Cookies & similar technologies

Accepted Answer

We use functional cookies (necessary), analytics cookies (implemented with privacy‑friendly settings) and – only with your consent – advertising and personalization technologies (e.g. advertising IDs such as IDFA/GAID, SDKs and pixels). You can manage your choices through our cookie banner (CMP). Our cookie policy lists, per vendor, the purpose, retention period and whether data is transferred outside the EEA.

Question 6

6. Who we share data with

Accepted Answer

We share data where necessary with:
 • Service providers/processors (hosting, security, analytics, playout, payment services, customer support, identity/consent management). We conclude data processing agreements and appropriate security terms with these parties.
 • Adtech and sales partners (DSP/SSP/ad exchanges, measurement and anti‑fraud services,      data clean rooms, CMPs, sales partners such as programmatic via Talpa) strictly within your consent choices.
 • Distribution      partners (e.g. FAST platforms, operators) for distribution and reporting.
 • Legal obligations (e.g. regulators, tax authorities) or to protect our rights.
 • Corporate transactions (merger/acquisition/reorganization): the acquirer must respect this notice.

Question 7

7. International transfers

Accepted Answer

Where data is transferred outside the EEA, we use an appropriate mechanism, such as an EU adequacy decision (including the EU‑US Data Privacy Framework for certified organizations) or EU Standard Contractual Clauses (SCCs) with supplementary measures where required.

Question 8

8. Retention periods

Accepted Answer

• Account and service data: as long as your account is active plus up to 24 months after closure.
 • Logs/usage: 6–24 months (shortened where possible; anonymized for statistics).
 • Marketing data: until you withdraw consent or 24 months after last interaction.
 • Payment/financial data: 7 years (statutory retention). Periods may deviate where legally      required or for the establishment, exercise or defense of legal claims.

Question 9

9. Security and data breaches

Accepted Answer

We implement appropriate technical and organizational measures (including access controls, encryption where appropriate, logging, pseudonymization where possible and periodic reviews) to protect your data.

In case of a personal data breach, we assess the risks and – where required – notify the Dutch Data Protection Authority within 72 hours and, where necessary, the affected individuals. We will inform you via email, our service or other appropriate channels.

Question 10

10. Children

Accepted Answer

Our services are intended for users aged 16 and over. Where legally required, we obtain (parental) consent for younger users – this may be facilitated via the relevant platform. We do not target personalized advertising to minors where this is not permitted. Access to age‑rated content follows the rules of, among others, Kijkwijzer/NICAM (for platform distribution).

Question 11

11. Profiling and automated decision making

Accepted Answer

For recommendations and – where permitted – personalized advertising, we may combine, among others, viewing history, interactions, device/app information and (where provided) marketing preferences.

• You can object to marketing‑related profiling and change your consent in the settings; for recommendations you can reset preferences or disable      profiles where available.
 • We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Question 12

12. Your privacy rights

Accepted Answer

You have the right to access, rectification, erasure, restriction, data portability and objection (including to direct marketing/profiling). Where processing is based on consent, you can withdraw it at any time.

We may ask you to verify your identity (e.g. via account login or a verified email address). Requests are free of charge, except where they are manifestly unfounded or excessive.

Send your request to legal@mpgmedia.eu or by post to the address in §14. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Question 13

13. Role of platforms and joint controllership

Accepted Answer

When distributing via third parties (e.g. smart‑TV platforms or operators), those parties often process viewer data for their own purposes. In such cases they act as independent or – where we jointly determine purposes and means – joint controllers (Art. 26 GDPR).

Essence of the joint‑controller arrangements (Art. 26 GDPR):
 • the platform is the primary contact for data it collects in its own environment (account,      device ID, app‑store data);
 • MPG Media Holding B.V. is the primary contact for data collected within our own services;
 • the parties inform each other in time about data subject requests and respond within legal time limits;
 • for questions you can contact us via §14; where appropriate we will refer you to the relevant platform.

Question 14

14. Contact

Accepted Answer

MPG Media Holding B.V.
 Oscar Romerolaan 14
1216 TK Hilversum
The Netherlands
 Email: legal@mpgmedia.eu – Tel: +31 (0)35 20 33 500

Question 15

15. Changes to this notice

Accepted Answer

We may update this notice to reflect legal or operational changes. We will publish the new version with an updated date and, where appropriate, actively inform you.

MPG Media Group & Premium-partners