ShareThis Privacy Notice

DATED 2023-08-24 · VERSION 20231101_rev01 · COMPARED WITH 20230701_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20230701_rev01 to 20231101_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 ShareThis is committed to processing information in accordance with applicable laws (including where applicable the European Union's General Data Protection Regulation ("**GDPR**") and the California Consumer Privacy Act ("CCPA") and as described in this Privacy Notice. For specific information about how ShareThis adheres to European, UK and Brazil data protection law and your rights as an EEA, UK, Swiss or Brazil data subject please click **[here.]()** For information about how ShareThis adheres to applicable U.S. Privacy laws in States such as California, Colorado, Connecticut, Nevada, Virginia, and Utah, please click **[here]().**
 To access information for Publishers, please visit the Publisher Information page [**here**](https://www.sharethis.com/publisher/)**.**
 To access Publisher Terms of Use, please click [**here**](https://sharethis.com/publisher-terms-of-use/).
+Last Updated on: June 9, 2023
+Last Updated on: August 24, 2023
 - * *
 ShareThis provides website operators ("Publishers") with customizable social sharing tools, which makes sharing online content simple. Any user of a website can easily share anything on the web with their friends on social sites, such as Facebook, Twitter, Email, Digg, Reddit and more through using one of our tools on that website ("**ShareThis Icon**").
 ShareThis also collects pseudonymous data about internet users and how they interact with content, websites, and advertisements while online. Some of the data is collected via our tools such as the **ShareThis Icon**, and some is collected through third-party data providers. We compile this data and provide it to our Publishers and license it to advertisers, agencies, and other businesses (our "Customers") to facilitate the delivery of relevant, targeted advertising and for a number of other reasons which are listed below.
 Targeted advertising has the aim of displaying advertising which is more likely to be of interest to internet users, based on analyses of their recent browsing and sharing activities and interactions with the website and adverts. It is also sometimes referred to as interest-based advertising or online behavioral advertising. For more information on this type of advertising, [click here](http://www.networkadvertising.org/understanding-online-advertising).
 ## Contents
 [I. Data Collection and Use]()
+[II. The GDPR and Your Rights as an EU or UK Data Subject]()
+[II. The GDPR and Your Rights as a Swiss, EU, or UK Data Subject]()
 [III. The LGPD and Your Rights as a Brazil Data Subject]()
 [IV. The U.S. State Privacy Laws and Your Rights as a Data Subject]()
 [V. Data Sharing or Disclosure, Recipients of Your Data]()
 - To conduct market research and analytics in order to find meaningful patterns in the data that enables ShareThis to draw insights into how web Users generally behave. This may have specific application to companies seeking to better understand the characteristics of their target customer. It also may help hedge funds attempting understanding macro investment trends.
 - For data modeling in order to draw inferences. For example, to create lookalike audiences models.
 - To create modeled segments based off of demographic attributes.
 - To enhance security features or reduce fraud, including ad fraud,
 - To enhance addressability features that enable a company to recognize the same browser, device and/or user over time.
+Our Customers who we share your data with may use this information to generate their own Profile Information. They may independently gain other demographical information about you through their own cookies or web beacons and combine it with the data we provide to them. While we require our customers to avoid merging data received from ShareThis with identifiable personal data such as a clear email address (i.e., in violation of the [NAI Code of Conduct](https://thenai.org/accountability/code-enforcement/)), the use of cookies and pixel tags by these third-party advertisers, publishers, and ad networks are subject to their own privacy policies. Please refer to the 'Recipients of Your Data' section of this Privacy Notice for more information about who we disclose your data to.
+Our Customers who we share your data with may use this information to generate their own Profile Information. They may independently gain other demographical information about you through their own cookies or web beacons and combine it with the data we provide to them. While we ask our customers to avoid merging data received from ShareThis with identifiable personal data such as a clear email address (i.e., in violation of the [NAI Code of Conduct](https://thenai.org/accountability/code-enforcement/)), the use of cookies and pixel tags by these third-party advertisers, publishers, and ad networks are subject to their own privacy policies. Please refer to the 'Recipients of Your Data' section of this Privacy Notice for more information about who we disclose your data to.
 . **Children**
+ShareThis does not intentionally collect data from children and does not tailor any Profile Information or otherwise license data to enable targeting of children under 16 years of age. If you are a parent or guardian and believe we may be processing data of children you are responsible for, please see the section on User Choices and Rights, or contact us directly.
+ShareThis does not intentionally collect data from children and does not tailor any Profile Information or otherwise license data to enable targeting of children under 18 years of age. If you are a parent or guardian and believe we may be processing data of children you are responsible for, please see the section on User Choices and Rights, or contact us directly.
 . **Emails from Users with ShareThis Icon**
 When you share to email with the ShareThis Icon, you choose how to connect to email from your device. We will only know what content you shared, and that you did so by means of email. We do not receive any information about the email itself, for example, your email address, the email address of the recipient or the content of your email. We are not responsible for the information shared by users via the ShareThis Publisher Applications.
 . **Account Information**
 "**Account Information**" means the information which _Publishers_ and _representatives of Publishers_ provide when they register for an account with us and when they use their account.
 Many of our services can be used without registering with us. However if you are a Publisher, or represent a Publisher, and want to use some of our enhanced features, you will need to register with us.
+If you choose to register with us, you must be and you affirm that you are 16 years of age or older. **We do not sell or share registration information with third parties for direct marketing purposes.**
+If you choose to register with us, you must be and you affirm that you are 18 years of age or older. **We do not sell or share registration information with third parties for direct marketing purposes.**
 . **Business contacts data**
 We may process your personal data if you are or your employer has a business relationship with us. For example, if you're a Customer, a prospective Customer, a vendor/supplier of ours, or a business partner, we may process your data. The personal data we hold about you refers to your professional life (name, email address, billing address, office address, phone numbers, title, company you work for). We would have collected that information from exchanging emails or business cards, meeting at industry meetings or client sessions etc. We may process that data for a number of legitimate business purposes, including: a) to communicate with you within the context of our business relationship; b) to provide our products or services; c) for billing and invoicing purposes; and d) for sales, marketing and product promotional purposes ((e.g., uploading emails into LinkedIn and similar platforms to advertise new services to current and prospective Customers).
 This data may also be processed for the purposes set out in the section '[General purposes which apply to all data.'](https://sharethis.com/privacy/)
 If you are located in Brazil, then the Brazilian General Law for the Protection of Personal Data (LGPD) applies to our processing of personal data. The LGPD grants those located Brazil a set of clear privacy rights and imposes responsibilities on ShareThis as we process the personal data of data subjects located in Brazil. The ShareThis privacy policy outlines how and why ShareThis processes personal data. This section is designed to provide more information on how ShareThis adheres to the LGPD and your rights as a data subject located in Brazil.
 - * *
 **Definition of Personal Data**
+The LGPD defines personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EEA and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees, as applicable.
+The LGPD defines personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EEA, Swiss, and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees, as applicable.
 **Special Categories of Personal Data**
 ShareThis does not collect nor process any special categories of personal data with respect to data subjects in Brazil.
 **Legal Basis for Processing**
 The LGPD entities seeking to process personal data to have a valid legal basis for doing so. The legal basis utilized by ShareThis include: a) consent; b) legitimate interest (i.e., where we believe that our need to process the data and/or the value we deliver by processing such data is not outweighed by the rights of the data subject); c) where necessary for the performance of a contract; and d) where processing is necessary to comply with our legal obligations.
 - the right to see what data we have about you, your computer or device (i.e., the right to know),
 - the right to correct the data we have about you, your computer or device,
 - the right to delete the data we have about you, your computer or device (i.e., the right to delete), and
 - the right to opt-out of the sale or sharing of data about you, your computer or device to certain third parties (i.e., the right to opt-out from sales or sharing of your information) and the right to opt-out of profiling and/or targeted ads.
+These U.S. state laws define personal information broadly. And as such, almost all of the information we collect is considered personal information under these laws. U.S. data subjects may send an email to [privacy@sharethis.com](mailto:privacy@sharethis.com) to exercise those rights of visit data subject access page. California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765.
+These U.S. state laws define personal information broadly. And as such, almost all of the information we collect is considered personal information under these laws. U.S. data subjects may send an email to [privacy@sharethis.com](mailto:privacy@sharethis.com) to exercise those rights of visit data subject access page. California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765. Data subjects in Colorado and Virginia have the additional right to appeal in the event that they are unsatisfied with the way that ShareThis has honored one or more of the above rights - and have the further right to appeal to the Attorney General of their state.
 We do not treat users that exercise any of the above rights differently. However, we may not be able to honor a right if doing so would violate applicable law. ShareThis does not sell data collected via our Website or the data we use to operate our business. However, we transfer personal information collected via the ShareThis Publisher Applications to third parties and as such are considered to have sold data over the past twelve months under California law, including any of the Usage Data, Profile Information and/or audience segments.
 We generally ask only for the minimum information necessary to help us process a subject access or deletion request and will keep information pertaining to your request for up to two years. If you are a customer of ShareThis with a login and password to the ShareThis platform, we ask that you first direct your request to the person or persons at your organization that administers the relationship with ShareThis. California data subjects may also call us on our toll free CCPA privacy hotline at 1-800-272-1765.
 **CCPA Metrics for 2021**
 - Professional Services Companies - Companies that provide high level strategy and analytic services.
 - Security or Fraud Prevention Vendors - Companies that help ensure the security and reliability of their customer's data or infrastructure.
 - Investment Firms - Financial services companies and investment firms seeking to better understand how consumers use the Internet.
 We share this information for the purposes listed in the section ['Data Collection and Use](https://sharethis.com/privacy/).'
+Where the GDPR applies to Usage Data and Profile Information and we share this data with our Customers, our Customers are independent controllers in relation to their processing of such data and they process it in accordance with their own privacy policies.
+Where the GDPR or similar privacy or data protection laws applies to Usage Data and Profile Information and we share this data with our Customers, our Customers are independent controllers in relation to their processing of such data and they process it in accordance with their own privacy policies.
 Customers may share the data which they process with other third parties who are not mentioned in this Privacy Notice, in accordance with their own privacy policies. As an example, they may use third party service providers to display advertising or other content on their behalf.
 Please review some of our Customer's privacy policies for more information:
 LiveRamp: [https://liveramp.com/privacy/](https://liveramp.com/privacy/)
 The security of your information is a high priority to ShareThis. We have implemented industry-standard security measures.
 While no transmission of data over the Internet is guaranteed to be completely secure, we strive to protect your data. It may be possible for third parties not under the control of ShareThis to unlawfully intercept or access transmissions of private communications. ShareThis cannot ensure or warrant the security of information you transmit to us.
 VI. **Commitments to Privacy Standards**
+ShareThis promotes transparency and control for users as members of various self-regulatory programs. ShareThis also participates in and has certified its compliance with the EU-US and Swiss U.S. Privacy Shield Frameworks.
+ShareThis promotes transparency and control for users as members of various self-regulatory programs. ShareThis also participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss U.S. DPF.
 - * *
 ShareThis is a member of the following self-regulatory programs:
+**Network Advertising Initiative (NAI):**
+ShareThis is a member in good standing with the NAI. The NAI offers an online [web opt-out platform](http://www.networkadvertising.org/choices/) to allow consumers to express their choices and provides general information related to privacy and [Interest Based Advertising](http://www.networkadvertising.org/understanding-online-advertising).
 **The Digital Advertising Alliance (DAA):**
 ShareThis adheres to the Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising. The [DAA opt-out platform](http://www.aboutads.info/choices/) offers the consumer a choice page to opt out from advertising services, and general information related to privacy.
 **GDPR and Swiss Privacy Shield:**
 Please note that this is a device setting and will disable interest-based ads from all providers, and not just for ShareThis.
 **Do Not Track:**
 You may also stop the collection of your Usage Data by using the do-not-track function or similar privacy controls of your browser. ShareThis recognizes these do-not-track signals from your browser. As required by law, or where we are able to ascertain that such signals are enacted by you and not set by default by your browser, we will consider them to be an indication that you have opted out.
+**Onward Transfer/Privacy Shield:**
+**Onward Transfer/Data Privacy Framework:**
+ShareThis complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and the United Kingdom and/or Switzerland to the United States in reliance on Privacy Shield. The Privacy Shield is administered by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries as well as Switzerland and the United Kingdom. ShareThis has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this privacy notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit [https://www.privacyshield.gov](https://www.privacyshield.gov/).
+ShareThis has certified that it adheres to the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF program principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies of this privacy policy and the above listed DPF program principles, the DPF program principles shall govern. To learn more about the DPF programs, and to view our certification page, please visit [https://www.privacyshield.gov](https://www.privacyshield.gov/).
+In the context of an onward transfer, ShareThis is responsible for the processing of personal data it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. ShareThis shall remain liable under the Privacy Shield principles if its agent processes such personal data in a manner inconsistent with the Privacy Shield principles, unless the ShareThis proves that it is not responsible for the event giving rise to the damage.
+In the context of an onward transfer, ShareThis is responsible for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. ShareThis shall remain liable under the DPF principles if its agent processes such personal data in a manner inconsistent with the DPF principles, unless the ShareThis proves that it is not responsible for the event giving rise to the damage.
+In compliance with the EU-US and Swiss-US Privacy Shield Principles, ShareThis commits to resolve complaints about your privacy and our collecting or use of your personal information. European Union, UK, or Swiss individuals with inquiries or complaints regarding this privacy notice should first contact ShareThis directly at [privacy@sharethis.com](mailto:privacy@sharethis.com). We will respond to your complaint within 30 days of receipt.
+In compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ShareThis commits to resolve complaints about your privacy and our collecting or use of your personal information. European Union, UK, or Swiss individuals with inquiries or complaints regarding this privacy notice should first contact ShareThis directly at [privacy@sharethis.com](mailto:privacy@sharethis.com). We will respond to your complaint within 30 days of receipt.
+We have further committed to refer unresolved privacy complaints under the EU-US and Swiss-US Privacy Shield Principles to BBB EU PRIVACY SHIELD, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgement of your complaint, or if your complaint is not satisfactorily addressed, please visit [www.bbb.org/EU-privacy-shield/for-eu-consumers/](https://www.bbb.org/EU-privacy-shield/for-eu-consumers/) for more information and to file a complaint.
+For complaints that cannot be resolved between ShareThis and the individual concerned, ShareThis has further committed to refer unresolved privacy complaints under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to the BBB Data Privacy Framework Program, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you are an EU, UK, or Swiss individual and you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint.
+For residual disputes that cannot be resolved by the methods above, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel. To find out more about the Privacy Shield's binding arbitration scheme, please see: [https://www.privacyshield.gov/article?id=ANNEX-I-introduction](https://www.privacyshield.gov/article).
+If your complaint is not satisfactorily addressed, you may have your complaint considered by an independent recourse mechanism: for EU/EEA Data Subjects, a panel established by the EU data protection authorities ("DPA Panel"). To do so, you should contact the state or national data protection or labor authority in the jurisdiction where you work. Other jurisdictions such as Switzerland and the UK may have similar panels and data protection regulators that may receive your complaint ShareThis agrees to cooperate with the relevant national DPAs and to comply with the decisions of the DPA Panel.
+The Federal Trade Commission has investigation and enforcement authority over our compliance with the Privacy Shield.
+Should your complaint remain fully or partially unresolved after a review by ShareThis, BBB Data Privacy Framework Program and the relevant DPA, you may be able to, under certain conditions, seek binding arbitration before the Data Privacy Framework Panel. For more information, please visit https://www.dataprivacyframework.gov/s/european-individuals.
+The Federal Trade Commission has investigation and enforcement authority over our compliance with the Data Privacy Framework.
 If you believe we have not respected your rights or otherwise not handled data correctly, then we encourage you to contact us directly and we will do everything possible to help.
 However, where you still have a complaint, then you have the right to raise the matter with the Supervisory Authority (or data protection agency) in your country for resolution.
 ## **Contact Information**