Commercial Privacy Notice

Scope of this Privacy Notice

Bauer Media Outdoor provide out of home (OOH) advertising services, including poster and digital advertising on street furniture, such as bus shelters and phone kiosks, digital billboards and free-standing digital panels located in retail centres, entertainment venues and transport hubs.

Individuals whose personal data is processed have a right to be informed about the collection and use of their personal data. This is a key transparency requirement under data protection legislation.

This Privacy Notice applies to the processing of personal data in Bauer Media Outdoor Out of Home advertising services.

In supporting advertising customers Bauer Media Outdoor help business advertise more effectively by using data to help them improve their advertising and offering interactive digital advertising products.

Much of the data Bauer Media Outdoor process doesn’t relate to individuals, but rather to geographic areas, data about patterns of movement, etc. However, some data processed as part of the Bauer Media Outdoor services may include elements or functionality that can identify individuals to allow Bauer Media Outdoor to create products and services that help our customers improve their advertising. This data is known as “personal data”. Individuals whose personal data is processed have a right to be informed about the collection and use of their personal data. This is a key transparency requirement under data protection legislation.

Bauer Media Outdoor process Personal Data for other purposes where different Privacy Notices will apply. If Bauer Media Outdoor use personal data for any purposes not set out in this Privacy Notice, individuals will be informed when personal data is collected.

Who are Bauer Media Outdoor and how can you contact us?

When we refer to Bauer Media Outdoor in this Privacy Notice, we mean the various affiliated and subsidiary companies of Bauer Media Outdoor International Limited (trading as Bauer Media Outdoor) whose registered office is 33 Golden Square, London W1F 9JT, United Kingdom. Bauer Media Outdoor is a group of affiliated companies and part of the Bauer Media Group.

Each of the Bauer Media Outdoor companies that are part of Bauer Media Outdoor International Limited is an independent data controller for personal data processed to carry out its business or operational activities, including sales, marketing and business relationship management.

For any questions about how companies in the Bauer Media Outdoor group process personal data or any queries about information in this Privacy Notice you can contact our Data Protection Officer (DPO) at dpo@bauermediaoutdoor.com

What data do Bauer Media Outdoor process and where do we get it from?

Bauer Media Outdoor process data including in some circumstances personal data, that is data that canidentify individuals, to create products and services serving our advertising customers' needs for creativity, flexibility and accountability. The types of data that Bauer Media Outdoor process in OOH campaigns falls into 4 categories, described in more detail below.

AdAstra – Data used to support contextualised advertising in OOH services.
Creative campaigns – data collected and used in interactive campaigns.
Video Surveillance including CCTV – data may be collected using cameras for security and crime prevention purposes or for the legitimate interests of Bauer Media Outdoor or third parties.
Customer data – ourcustomers may supply data and instruct Bauer Media Outdoor to process it on their behalf. In these circumstances Bauer Media Outdoor act as a data processor on the customers behalf.

Where Bauer Media Outdoor process data for AdAstra, in creative campaigns, and for video surveillance, including the use of CCTV, a data protection by design and default approach is followed and a Data Protection Impact Assessment (DPIA) is carried out.

The DPIA is part of a process to embed data protection by design and by default and as part of the assessment, the DPIA is used to understand the potential privacy risks, record the considerations and mitigations in place to minimise the risks. It is carried out and reviewed with the Bauer Media Outdoor Privacy team under the responsibility of the DPO. Default settings limit the processing of personal data to that necessary to provide the advertising services and data is not retained longer than is necessary. All processing is subject to security controls to ensure that Personal Data is adequately protected.

AdAstra

What data do we process?

Bauer Media Outdoor in providing DOOH services are a mass market medium and as such do not target specific individual people. Data is used to understand the audience our panels reach so that this mass market audience can be shown content they find relevant. The aim is to create engaging content with the millions of people who walk past Bauer Media Outdoor panels daily. It is about using data to ensure audiences see contextually relevant messages that resonate with what they are doing at specific moments in specific places.

DOOH campaigns combine external data sources to provide relevant content to their audiences. Data is used throughout the advertising campaign journey.

‍Pre-campaign: to accurately plan campaigns to reach target audiences.
‍Mid-campaign: to track audience delivery, optimise campaigns, customise creative.
‍Post-campaign: to measure results and the attribution value of OOH.

Examples of the type of data used are:

date, e.g., times of year, day of the week;
time of day, e.g., morning, rush hour;
different format of digital screens;
data triggers such as local weather, pollen count, social trends, traffic flow;
site location of the digital screen, e.g. city or postcode, site environment, e.g.,airport, roadside, pedestrian area, and audience data, e.g.,data collected through audience behavioural measurement tools. Bauer Media Outdoor receive audience data in aggregated form, so that individuals cannot be identified, the data is used to provide demographic information and similar information about audiences.

For audience data collected through audience behavioural measurement tools we rely primarily on aggregated, anonymised data that comes from data partners. This data helps us understand the audience of our OOH adverts. It may include information about demographics and interests of the types of people who will see the advertisements. Bauer Media Outdoor do not seek to profile or track individuals.

The following are methods used in the advertising eco system by our data partners and others to allow advertisers to understand their audience.

SDK and Mobile data

From time to time, we engage with data partners who provide insights with anonymised and aggregated data, the data source to create the aggregated data is from SDKs in apps, GPS data or other data obtained from a mobile device’s IP address. “SDK” stands for “software development kit”. It is a piece of code that is built into an app, and that facilitates the app to collect geolocation and other statistical data. When an individual user installs those apps on their device,the individual user has the option of giving their consent to enable the collection of limited elements of their data including Personal Data to enhance their app usage and to share with the app provider’s commercial partners. Individuals can revoke consent to share data at any time in the apps’ settings. Data partners then aggregate this data before it is supplied to Bauer Media Outdoor.

SDK and Cellular signal data

Mobile phone networks may supply anonymized, aggregated data insights collected from triangulated cellular signals from phones using their network. These insights give us insights into group level audience behaviours within the vicinity of our ad locations.

Bauer Media Outdoor receives anonymised, aggregated data sets from carefully chosen data partners. This data provided helps us provide insight into large scale audience behaviour to our advertisers to understand the efficacy of our advertisements.

Wi-Fisensors ("sniffers")

Devices installed on some Bauer Media Outdoor structures to detect the presence of devices searching for a Wi-Fi signal such as phones. These devices do not detect any personally identifiable information (including MAC ID or MAID (Mobile Advertising IDs)) but simply give a "count" of the number of devices at any given time which can be used to assist with campaign targeting.

Mobile retargeting - the individual user has the option of giving their consent to enable the collection of limited elements of their data including Personal Data and location data which can be shared with the app provider’s commercial partners. Individual users can then receive targeted advertising on their mobile device. Individuals can revoke consent to share data at any time in the apps’ settings. Bauer Media Outdoor do not directly send mobile retargeting adverts in Europe. Third parties instructed by advertising customers send targeted adverts and may do so as part of a wider advertising campaign based on the location of a particular OOH display.

Geofencing

Geofencing is a location-based service in which an app or other software uses GPS, RFID, Wi-Fi or cellular data to trigger a pre-programmed action when a mobile device or RFID tag enters or exits a virtual boundary set up around a geographical location, known as a geofence.

Bluetooth beacons

Beacons are installed on Bauer Media Outdoor panels in a few of our sites. These beacons passively transmit a location signal inside its “geofence” which can be detected by mobile devices. If an individual has given permission for your mobile device to connect to beacons, via an app or through the device settings, the individual's mobile device may try to connect to the beacon installed in those billboards and share its geographical information with those beacons when you come within the beacon’s geofence.

This information about the location of the individual's mobile device is not used by Bauer Media Outdoor. Bauer Media Outdoor use information in aggregated and anonymised form. However, the information about the location of an individual’s mobile device may be used by others in the advertising ecosystem such as Bauer Media Outdoor advertising customers or others acting on their behalf to send targeted messages to individuals if the individual user of the mobile device has permitted this though app and device settings. Bauer Media Outdoor do not send targeted messages to individuals; however, these messages may be sent by other parties in the digital ecosystem. Users can revoke consent to share geolocation data with beacons at any time in the settings on their phones.

As an example, Bauer Media Outdoor may have a digital panel which contains a beacon with a beacon geofence. The digital panel displays at a certain time an advert for a retail customer. The retail customer may use the details of when their advert is being displayed on the DOOH panel as part of the wider advertising campaign. The retail customer may send targeted messages to individuals who have consented through their device settings and who may come within the geofence. Bauer Media Outdoor do not send these messages to the individual. Bauer Media Outdoor provide the retail customer with information about when the specific advert was displayed to enable the retail customer to use this information as part of a widercoordinated advertising campaign.

Where do we obtain the data from?

We obtain data from several sources.

Third party data partners – we enter into agreements with third party data partners to provide us with various data sets. Due diligence is carried out on all third-party data partners with a DPIA carried out where Bauer Media Outdoor obtain audience data that may be aggregated data originally collected from individuals.
Public information – we may obtain data form publicly available sources which can often be freely used, reused and redistributed by anyone.
Wi-Fi sniffers and similar technology embedded in some screens under the responsibility of Bauer Media Outdoor, these are used to detect enabled devices within a certain area. Any data collected through technology on Bauer Media Outdoor screens is subject to a DPIA and data collected is in anonymised aggregated form.

Bauer Media Outdoor obtain audience data from various data partners. Data partners collect data from different sources. We undertake due diligence on our data partners to understand how data is collected by the providers even though data received by Bauer Media Outdoor is in aggregated form and the detailed due diligence we carry out is not a legal requirement to comply with applicable data protection laws. We use providers who are committed to providing individuals with relevant notice and consent options and offer controls to ensure individuals cannot be identified.

INTERACTIVE CAMPAIGNS

What data do we process?

Interactive campaigns using computer vision software, audio software and similar technologies that allow interaction with digital screens are in standard use across the Out of Home Advertising industry to allow individuals to interact with creative and flexible campaigns. This technology can use cameras installed within the screen which when the camera is enabled can be set to recognise defined items, or audio functionality that can detect certain sounds. What the technology recognises, whether it is an image, sound or other input will be dependent on the software settings. Computer vision software could be programmed to identify an image of an inanimate object such as a piece of fruit, or it can be set to recognise basic characteristics of individuals (for example it may detect motion in front of the screen, height, or hair colour etc.). Using the software in this way would allow an individual looking at the screen to personalise interactions with the advertisement they see. An interactive advertisement might show a character move around in accordance with the motion of the person in front of it, or software settings may be set to capture apparent engagement with the advertisements such as the length of time someone looked at the advertisement, or expressions of individuals looking at the adverts.

When interactive campaigns are developed, including those where technology is used that can capture images, software deployed that can record or recognise sound, or otherinteractive campaigns such as touch screens are developed that may process personal data, the campaign is subject to a DPIA, Data Protection Impact Assessment. Bauer Media Outdoor use this process to embed data protection by design and by default. The DPIA is carried out and reviewed with the Bauer Media Outdoor Privacy team under the responsibility of the Bauer Media Outdoor DPO to understand the potential privacy risks and put in the necessary mitigations to provide adequate protections. The default settings of the software are designed to only permit the processing of Personal Data necessary to provide the advertising services, data is not retained longerthan is necessary, for example most data is processed for the time of theinteraction with the advert and then securely deleted. All processing is subject to security controls to ensure that Personal Data is adequately protected.

‍Where do we obtain the data from?

Personal data collected and processed through the interactive campaign is collected from individuals who interact with the digital screens.

CCTV

What data do we process?

CCTV and other video surveillance operates on some panels for security and safety purposes. Cameras can also be used to provide evidence of proof of play. Where CCTV or any other cameras are used before they are deployed, a DPIA, Data Protection Impact Assessment is carried out. Bauer Media Outdoor use this process to embed data protection by design and by default. The DPIA is carried out and reviewed with the Bauer Media Outdoor team under the responsibility of the Bauer Media Outdoor DPO to understand the potential privacy risks and put in the necessary mitigations to provide adequate protections. The default settings are designed to only capture data that is necessary for the purposes the camera has been installed, the images are not retained longer than is necessary and then securely deleted when the images are no longer required. All processing is subject to security controls to ensure that Personal Data is adequately protected.

Where do we obtain the data from?

Personal data collected and processed by CCTV and other cameras used will be collected from individuals who may come in the range of the camera.

CUSTOMER DATA

What data do we process?

Advertising Customers may ask Bauer Media Outdoor to process personal data on their behalf, an example would be the display of an advert of an image of an identifiable individual. In these situations, BauerMedia Outdoor act as a data processer on the customers behalf and do not use any of this information for any purposes other than to provide the services asinstructed to by the Advertising customer, e.g., to display the advert.

Where do we obtain the data from?

Advertising Customers provide Bauer Media Outdoor with the personal data, and it is processed on behalf of the relevant Bauer Media Outdoor customer.

Why do Bauer Media Outdoor process personal data?

Bauer Media Outdoor provide out of home (OOH) advertising services, including digital OOH advertising. Bauer Media Outdoor customers can advertise through different OOH media provided by Bauer Media Outdoor,including street furniture such as bus shelters and phone kiosks; billboards including digital towers and through digital panels predominately located in malls, entertainment venues and transport hubs.

We obtain and processdata including in some circumstances personal data to create products andservices serving our advertising customers' needs for creativity, flexibility and accountability. The types of data that Bauer Media Outdoor process in OOH campaigns falls into 4 categories, described in more detail in the section above:

AdAstra – Data used to support contextualised advertising in OOH services
Creative campaigns – data collected and used in interactive campaigns
Video Surveillance including CCTV – data may be collected using cameras for security and crime prevention purposes or for the legitimate interests of Bauer Media Outdoor or third parties
Customer data – our customers may supply data and instruct Bauer Media Outdoor to process it on their behalf

Other purposes

From time to time, we may use the personal data that we obtain for other purposes. These include:

To analyse, developand improve the use function, and performance of our products and services,including testing the quality of any new data collected from third parties
To manage the security of our sites, networks and systems and to operate our business
To maintain our records and other administrative purposes, including record keeping and general administrative purposes, including for business transactions (including M&A), to include information sharing with potential transactional partners or other third parties in connection with the consideration, negotiation orcompletion of a transaction in which Bauer Media Outdoor are acquired by or merged with another company or there is a sale, liquidation or transfer all or a portion of assets including any bankruptcy or corporate reorganisation
To comply with legal obligations, to respond to legal processes or requests for information from government authorities, law enforcement or other third parties
Manage any complaints or dispute resolution
To protect the rights and interests of Bauer Media Outdoor, our employees and others as required and permitted by applicable law.

What is the legal basis for processing Personal Data?

Data Protection law means that every organisation must have a lawful ground or reason for processing any personal data about an individual.

To create products and services serving our advertising customers' needs, we process personal data under a lawful ground called “legitimate interest”. As an organisation providing an OOH medium to advertisers our business is dependent on us being able to process limited personal data to build the products and services to help our customers serve creative and contextual advertising through understanding the audience our panels reach so that the audience can be shown relevant content. Bauer Media Outdoor use aggregated, anonymised data to understand the demographics of the audience of the panels and as such do not target specific individuals.

When we process personal data under legitimate interest, we carry out an assessment (DPIA) to consideryour rights under data protection laws as well as any potential impact to you. The DPIA is part of a process to embed data protection by design and by default and as part of the assessment, the DPIA is used to understand the potential privacy risks, record the considerations and mitigations in place to minimise the risks. It is carried out and reviewed with the Bauer Media Outdoor Privacy team under the responsibility of the DPO. A key objective of the DPIA is to assess how data is collected and ensure that only data necessary for the purpose is processed. Where personal data is used to support the interactive campaigns, this is limited to that necessary to provide the advertising services and data is not retained longer than is necessary. All processing is subject to security controls to ensure that Personal Data is adequately protected.

Who do Bauer Media Outdoor share Personal Data with and why?

Personal data is shared with individuals and organisations who need to handle it so that Bauer Media Outdoor can provide the OOH advertising services. Bauer Media Outdoor take steps to allow access to personal data only to when required to perform identified tasks and duties and to third parties who have a legitimate purpose for accessing it. Where a third party is granted access to personal data appropriate measures are put in place to ensure that the security and confidentiality of the information is maintained.

It is also shared with:

Bauer Media Outdoor group companies who may manage or support some parts of the services;
Service providers we have engaged to support our business who receive or have access to Bauer Media Outdoor systems and data as part of providing services. These Bauer Media Outdoor group companies and service providers may be located overseas.

Transfer of personal data overseas

Bauer Media Outdoor Europe are a group of companies located mainly in the UK and European Economic Area andas such any personal data will usually remain within the UK or the European Economic Area. Bauer Media Outdoor group companies and service providers who may support these services also operate elsewhere, in and outside the European Economic Area, so data may be accessed from and transferred to these locations as well. Where data is transferred overseas, we will ensure that any personal data is adequately protected. There are different ways that this can be achieved, for example where it is transferred to a country which has been approved by the European authorities as having adequate protection in place or by putting contracts in place that has been approved by the European commission with the recipient of the personal data that provides a suitable level of protection.

How long do we keep your personal data for?

Bauer Media Outdoor keep personal data for as long as there is a continuing need to do so and in accordancewith the Bauer Media Outdoor data retention and destruction policy. Data that is no longer required will be securely disposed of.

Information may be retained to comply with our legal obligations, resolve any disputes and enforceour rights. These reasons can vary and will depend on the type of data processed, so the amount of time we may keep personal data may vary.

Your rights in relation to the personal data we hold

Data protection laws give individuals a number of rights in relation to personal data. These include:

Right of access – see what information we hold about you
Right to rectification – correct any information you think is wrong
Right to object – ask us to stop using your data
Right to be informed – understand what happens to your personal data
Right to restrict processing – change how your data is used
Right of portability – move your data
Rights in relation to automated decision making and profiling
Right to erasure or right to be forgotten

Bauer Media Outdoor will consider all data subjects requests individually and on a case-by-case basis. Not all the rights apply to the data processed by Bauer Media Outdoor in the provision of OOH advertising services.

To exercise any of these rights, or to find out if they apply or if you require further information on your rights or our use of your Personal Data, please contact us at dpo@bauermediaoutdoor.com

How do Bauer Media Outdoor keep your personal data secure?

Bauer Media Outdoor use a variety ofthe latest technologies and organisational measures to protect data from unauthorised access, destruction, use or disclosure.

Bauer Media Outdoor have an information security framework based on internationally recognised standards ofsecurity. The cyber security measures protecting data include appropriate technical and organisational measures aligned to ISO 27k requirements. Bauer Media Outdoor have a dedicated cyber security investigations team who safeguard Bauer Media Outdoor key assets and systems.

Contacting our Data Protection Officer

If you have any questions, concerns or issues about the way we are handling your personal data or want to exercise any of your data subject rights (or find out if they apply) please contact our DPO by email at dpo@bauermediaoutdoor.com

If you would prefer to contract us by post, please address this to The Data Protection Officer c/o Bauer Media Outdoor International Limited, 33 Golden Square, London W1F 9JT, United Kingdom

Supervisory authority

Having contacted Bauer Media Outdoor if you are still unhappy with any aspect of how we handle your personal data you have the legal right to lodge a complaint with the supervisory authority ofthe relevant Bauer Media Outdoor entity that is the data controller for personal data processed when providing OOH advertising services. Each of the Bauer Media Outdoor companies is an independent data controller for personal data processed when providing OOH advertising services.

Information Commissioners Office (ICO) the supervisory authority that regulates handling of personal data in the UK is the supervisory authority for Bauer Media Outdoor International Limited. You can contact them by going to their website at www.ico.org.uk

Changes to this Privacy Notice

Bauer Media Outdoor may update this Privacy Notice from time to time and ideally you should check it regularly for updates. Previous versions of Bauer Media Outdoor privacy notices are available upon request.

Last Updated – July 2025