Your privacy is our priority
Your data is important. It’s important to us, and we understand that it’s important to you. ITV is committed to safeguarding your information in line with the latest data protection and privacy laws. We also want to be transparent about what information we collect about you, how we use it, and how you can control what we do with this information.
About this notice
In this privacy notice, “we”, “us” and “our” means ITV Consumer Limited. This notice was last updated on 30 April 2019.
What this notice covers
This privacy notice explains how we collect and use your personal information if you are a customer of our products and services, for example if you:
- watch video-on-demand content on any versions of the ITV Hub, ITV Hub+ and ITV Box Office that we control;
- use our websites, e.g. itv.com, www.itvboxoffice.com;
- use our programme apps (except for the The X Factor and Britain’s Got Talent apps, which are subject to separate privacy notices which are accessible within these apps);
- enter one of our prize draws or competitions;
- vote in our votes or polls;
- attend one of our live events or attractions;
- are a member of research panels or engage in surveys related to ITV products and services;
- buy ITV merchandise from us or one of our licensed brand partners;
- send us messages, videos and photos;
- interact with us or our content on social media or in forums; and
- watch our channels on any platform where we have your consent to collect your data.
We use the information we collect in relation to one of more of our products and services in connection with all our other products and services. This helps us analyse and personalise your experience across our products and services, provide and manage our advertising and services across our group and provide or inform you about other services and products you request or which may be of interest to you whether on our platforms or on third party platforms.
What this notice doesn’t cover
We publish specific privacy notices for some of our products and services which may apply in addition to or instead of this privacy notice. Where this is the case, please refer to the product/service-specific privacy notice for more information (for example, for The X Factor and Britain’s Got Talent apps and for Britbox).
This privacy notice doesn’t cover companies, services or applications that we don’t own or control, or people that we don’t employ or manage. This includes (without limitation):
- third party websites, pages, applications/widgets or other services that we link to or offer via our products and services (e.g. if you click on an advert and it takes you to an advertiser website);
- other platforms that we allow to use ITV brands and content where we don’t control such use (e.g. ITV Hub content on Sky and Amazon).
In these cases, please instead refer to the privacy notice of the relevant third party.
What information do we collect?
The information we may collect about you depends on which of our products and services you’re using, but we’ll only collect your personal information where necessary. Information we (or our authorised third parties) collect includes:
- personal information you submit to us when you register for, buy, interact with or subscribe to any of our products and services or when you update these details. – For example, depending on the product/service you are registering for we may ask you to provide your name, address, postcode, email address, date of birth, telephone number and/or payment details. Please note it’s your responsibility to ensure that any registration data you provide to us is accurate and kept up to date;
- information about your use of and interaction with our products and services, for example:
- details of the products and services you are using (including any other ITV group products and services);
- how you access our products and services – for example your internet protocol (IP) address, device type and identifier, operating system and browser version;
- your navigation around the products and services;
- your viewing history;
- your marketing consents and how you have interacted with the marketing we have sent you;
- location data from your IP address or by accessing global positioning functionality on your device (e.g. GPS);
- information you disclose to us when you contact us with an enquiry, request or feedback;
- other data we collect from time to time to help us provide improved products and services – for example when we (or third party research companies we have engaged) ask you to fill in a survey or questionnaire;
- data from third party partners or suppliers who have confirmed they are authorised to pass your information to us in accordance with your legal rights; and
- other data we collect in order to review compliance with our terms and conditions and/or otherwise as required by law.
When and how do we collect information?
We (or our authorised third parties) collect information about you:
- from you directly when you disclose your information to us including when you register for our products and services or otherwise update your details; when you buy, or subscribe to, content or services from us; when you contact us with an enquiry, request or other feedback; when you participate in any of our products and services (for example, when you purchase tickets for or attend one of our live events or submit an entry to a competition or prize draw, or you vote in one of our polls); when you participate in research panels or surveys; and/or when you request to be sent communications such as updates or newsletters when you send communications via the products and services or when you send communications via our products and services;
- in monitoring your use of the products and services;
- when we are checking compliance with our terms and conditions and/or otherwise as required by law;
- from third party suppliers who have confirmed they are authorised to pass your information to us in accordance with your legal rights.
How will we use your information?
We and our authorised third parties will only process your personal information where we have legal grounds to do so. The legal grounds for processing differ depending on which of our products and services you use. Generally, we’ll only process your data on the following grounds:
- you have given consent for the processing. When we rely on consent to process your personal information, you always have the right to withdraw this consent;
- the processing is necessary for the performance of a contract to which you are a party (including the terms & conditions of the relevant product/service);
- the processing is necessary in order to take steps at your request prior to entering into a contract;
- the processing is necessary for compliance with a legal obligation placed on ITV (for example our obligation to ensure that the data we hold is accurate);
- the processing is necessary for the purposes of the legitimate interests pursued by ITV or by a third party. For example, we have a legitimate interest in understanding how people are using our products and services, both to improve them, to sell adverts more effectively and to promote our services. Therefore, we use your personal information to understand and analyse the use of our products and services. In certain limited circumstances you have the right to object to processing based on such legitimate interests (as explained in the ‘What are your rights?’ section below).
Legal grounds for processing
Purposes of processing
Your consent (which you can withdraw at any time)
● Where you have actively asked to receive direct marketing from us or from third parties
● Enabling ITV Box Office purchases via your Sky remote control
● Where you have agreed that we can collect information about your viewing on certain third party platforms (for example YouView or Freeview Play) along with associated information such as platform identifiers.
Fulfilment of contract (product/service Ts&Cs)
● Administering our products and services (e.g. account management, user authentication, playout of content, payment processing, recording responses to polls/votes, competition winner pick, sending you service messages, monitoring your compliance with applicable product/service Ts&Cs and investigating any breaches)
● Enabling you to submit photos, videos and comments to us (e.g. via our “Get Involved” uploader tool)
● Queries and complaints handling
● Taking payment
Required in order to comply with legal obligation
● Compliance with legal and regulatory obligations (e.g. record keeping; regulatory audits)
● Issuing refunds
● Publication of competition / prize draw winner details
● Managing serving of advertising (for example, where advertising is restricted on the basis of age).
Processing based on legitimate interests
● We have set out our legitimate interests in more detail in the next section below.
Processing Based on Legitimate Interests
Purpose of Processing
Understanding our audience and use of our products and services:
We have a legitimate interest in analysing and understanding how people are using and responding to our products and services at an individual and household or broader level.
For example, we collect and analyse data about how you are using our products and services and we (or our authorised third parties) may contact you from time to time to ask you to participate in surveys or research projects to help us understand use of and improve our services.
If you use a product or service we may combine information we collect from that product and service with information we collect from our other products and services, with information from surveys and research and with information which is available publicly or from other reputable sources (which include other broadcasters or trusted providers (such as Konica Minolta Marketing Services Limited)).
We apply modelling techniques to the information we hold to model our audiences based on certain attributes, understand our viewers better and to analyse use across all of our products and services.
We also collect information and insights information from use and interactions with pages or accounts we operate on third party platforms (for example, Facebook Fan Pages) for this purpose and also to administer those pages or accounts. In relation to such insights data, both we and the third party platform are controllers of any insights data relating to that page or account. For Facebook fan pages, we are required to enter into a contract with Facebook to reflect joint controllership. You can download this contract here: https://www.facebook.com/legal/terms/page_controller_addendum. It contains further details and explanations on the joint controllership with Facebook in the context of fan page insights.
Making your user experience more relevant to you including recommendations & editorial content personalisation:
We have a legitimate interest in tailoring your user experience to you and making it easier for you to find the shows and content that you enjoy. We therefore use information we hold about you in order to recognise you across our different services, recommend content to you or personalise your experience. For example, we may use this information to help make your sign-in experience quicker and easier and if you watch a lot of drama then we might recommend the next big new drama series to you.
If you have adjusted the ‘Personalisation’ settings in the ‘Manage Account’ section of our website, your user experience won’t be personalised. We may still recommend content to you but our recommendations won’t be as relevant for you.
Managing serving of our advertising:
Some of our products and services are funded by the sale of advertising and are free for viewers to use. We and our advertisers have a legitimate interest in serving and measuring our advertising efficiently. This is to ensure that our viewers have a good user experience, (for example don’t see the same advertising over and over again) and to allow our advertisers to reach more viewers and know when ads have been served.
If you download any of our apps on a mobile device with a Google Android or Apple iOS operating system then you will be given an advertising identifier by that operating system. We use and pass this identifier to permitted third parties for frequency capping to limit repetitive advertising, for analytics purposes, or to enable us to serve you advertisements of particular relevance to you. You can reset your advertising ID at any time using the settings on your mobile device.
Making advertising on our products and services more relevant to you:
Some of our products and services are funded by the sale of advertising and are free for viewers to use. We therefore have a legitimate interest in using information we hold about you to help us sell our advertising on a more personalised basis and to show you adverts that we think you’ll be interested in or which are more relevant to you. For example, if you live in Leeds then we would be more likely to show an ad for an event in Yorkshire – and less likely to see an ad for an event in London.
We also pass an identifier relating to you and limited data (such as gender, age, postcode and viewing data) to our trusted third party partners (such as Amobee Inc and GroupM UK Limited (who also work with Finecast Limited)) to enable them to match against other data they may legally hold and use that combined information to serve ads of particular relevance to you.
You can choose not to receive adverts on our products and services that are tailored using information about you by adjusting the ‘Personalisation’ settings in the ‘Manage Account’ section of the ITV Hub website. You’ll still see adverts, but they will be generic (which includes advertising served against content being watched) and less relevant to you.
Making advertising and marketing on other services more relevant to you:
Our advertising clients run campaigns across more than one service. We and our advertisers have a legitimate interest in making sure that you don’t see repetitive or less relevant advertising across both our platforms and those run by third parties. We therefore share limited data with third parties to enable a match where you have also already shared your data with that party in the course of using their service; and (where there is a match) additional data to enable the third party and us to make advertising more relevant to you.
We also work with third party advertisers and platforms (such as Facebook and Google) to advertise our products and services to the most relevant audiences. This can involve the provision of protected ID data (for example, an email address which is converted into a stream of numbers or letters (aka hashed) to help make it more secure) to match the data we hold about you with the data they hold on their platform and provide you with relevant advertising (subject to your ad permissions on the relevant platform).
If you have adjusted the ‘Personalisation’ settings in the ‘Manage Account’ section of the ITV Hub website, you may still see adverts and marketing from us on other services, but it won’t use this data. Advertising on other services may still be based on cookie data however unless you have chosen to disable your cookies on the relevant device.
Some of our content is only available in certain parts of the world. This is due to a range of legal and regulatory issues, and we have a legitimate interest in complying with these restrictions. To ensure we only show you content when you’re in the appropriate territories we detect the IP address of your device to work out your location.
Main channel region:
We have a legitimate interest in complying with our obligations to Ofcom and STV with respect to certain ITV main channel programming in STV’s broadcast regions. We therefore use your postcode or other location data to ensure that we only play out content for you in accordance with those obligations.
Storing payment details for repeat purchases:
If you purchase or subscribe to an event or service online then we have a legitimate interest to store your payment details to enable you to make repeat purchases without having to re-enter your details again. For example ITV Box Office stores payment details to enable Sky customers to make repeat purchases via their remote control.
Subject to your direct marketing preferences, we have a legitimate interest in sending you marketing communications that we think will be the most relevant to you (and which will include our own or third party data). We also have a legitimate interest to analyse the performance of our communications. For more details on direct marketing, see below.
If you have adjusted the ‘Personalisation’ settings in the ‘Manage Account’ section of our website, we will still send you direct marketing communications (subject to your preferences) but they won’t be as relevant for you.
We use your data to promote or market our or third party products or services to you via direct marketing in the following circumstances.
Why we send you marketing
How to control the marketing we send to you
At your request: if you have asked us to send you marketing messages about ITV and/or selected third party products, services and special offers or you agree to receive marketing messages from selected third parties (e.g. by ticking a box when you register for a product/service or allowing push notifications when you download one of our apps).
● You can stop receiving email, SMS or MMS marketing communications from us, by using the ‘unsubscribe’, ‘stop’ or similar facility contained in any such communication. Please note that texting STOP in response to our SMS marketing will cost one standard network rate message. Alternatively, you can email us at the email address set out in ‘Contact us’ below stating that you do not wish to receive further communications from us.
● You can stop receiving push notifications from one of our apps by turning these off at any time by adjusting the settings on your device or deleting the app from your device.
● If you agree that we can pass data to third-party for their marketing purposes, you’ll need to contact the applicable third party to opt-out of receiving communications from that third party. Please note that we are not responsible for the communications you receive from any such third party.
You have participated in one of our paid-for services: if you participated in one of our paid for services such as competitions, prize draws, votes, polls or other interactivity by SMS text message, or have signed up for an ITV Box Office event, and have not opted out of receiving marketing then we will send you marketing messages in relation to similar products or services to those you interacted with (for example, if you enter a competition relating to I’m a Celebrity Get Me Out Of Here!, we may send you marketing messages in relation to the competition in the following year of I’m a Celebrity Get Me Out Of Here!).
● If you are participating in our interactivity you can avoid receiving these communications entirely by adding NO INFO at the end of your SMS text entry, vote, poll or other message.
● If you are currently receiving these communications and would prefer not to, you can use the ‘unsubscribe’, ‘stop’ or similar facility described in any such communication. Please note that texting STOP in response to our SMS marketing will cost one standard network rate message. Alternatively, you can email us at the email address set out in ‘Contact us’ below stating that you do not wish to receive further communications from us.
How long do we keep your information?
We keep your personal information for only as long as necessary, which is longer in some cases than in others. The length of this retention period depends on the purpose for which the data was obtained and its nature. For example:
- we need to keep some personal information about you so we can deal with any complaints you might make about the products and services we provide to you;
- if you ask us to stop processing your personal information for direct marketing, we need to retain enough information about you to enable us to ensure we stop including you in those direct marketing activities;
- we need to keep personal information so we can defend possible future legal claims. Unless there’s some other reason for keeping it, personal information will be deleted when such a claim could no longer arise or it is no longer required in order to defend legal claims that have arisen;
- we have a legal or regulatory duty to retain particular personal information for a certain minimum period (for example under Ofcom rules, or under HMRC tax rules).
In what circumstances do we share your information?
We do need to share your personal data with third parties in some circumstances. We pass information about you to other parties as follows:
- to third parties authorised by us and acting on our behalf, such as our employees, contractors, partners, suppliers, auditors and/or agents, to administer the products and services provided to you and/or to help us review and improve these products and services (including reviewing the accuracy of our data and checking how effective we are at making content relevant to you). These third parties are only allowed access to your information as needed to perform functions of the products and services or to provide services to us. They’re not allowed to use it for any other purpose;
- to reputable third parties such as broadcasters to enable you to have a better cross-platform advertising experience (see “Making advertising and marketing on other services more relevant to you” above);
- where ITV Box Office stores details to enable repeat purchases via the Sky remote control. If you want to opt-out of this processing please send an email from your registered email address to firstname.lastname@example.org;
- for marketing communications, where we have your consent to do so (see section above on “Direct Marketing“);
- to conduct analytics in relation to our products and services; including with regard to our user base, sales patterns, traffic volumes and related matters. This could include comparing the information we hold about you against third party datasets;
- so that our products and services can be marketed to you on third party platforms (for example, Facebook or our Facebook Fan Pages);
- for the purpose of industry measurement (for example by the Broadcasters Audience Research Board);
- where relevant, the user name and some profile information you voluntarily provide may be published on areas of the products and services such as forums, leaderboards, chat rooms or pages where user submissions are displayed, and this will be the identity by which you are known on those areas;
- if there are changes to our business (see section below on ‘Changes to our business’);
- to any other third party where you have provided your consent.
We also share your personal information with other parts of the ITV group of companies. We do this to:
- provide a more personalised experience across our different products and services;
- provide and/or manage cross or intergroup products and services; and/or
- provide other services and products you request or to promote those which might be of interest to you.
What are your rights?
Any personal information you supply will be treated in accordance with applicable data protection laws including the Data Protection Act 2018 and the General Data Protection Regulation (the “GDPR”) and any other applicable or superseding legislation. We are committed to delivering the rights that individuals are entitled to under data protection laws in the UK. These are:
- the right to request a copy of the personal information we hold about you. To do this, please contact us at email@example.com making clear that you are requesting a copy of your personal information and including full details of what you require. You may also be required to submit a proof of your identity.
- the right to object to your personal information being used for direct marketing. Where required we will ensure we obtain your consent before undertaking marketing and you will have the ability to opt out (see the section on ‘Direct Marketing’ above).
- the right to object to your personal information being processed where the legal basis for the processing is our own legitimate interests as a business (see ‘How will we use your information?’ section above). In some circumstances (for example, where we are using cookies or in respect of personalising editorial content or advertising or marketing) we have specific mechanisms to enable this objection. In all cases, we will comply with such a request unless there is a lawful reason for not doing so, such as when we need to continue to process your information to defend a legal claim or if this information is necessary for the ongoing provision of our products and services.
- the right to rectification. You may request that we correct any inaccurate and/or complete any incomplete personal information.
- the right to withdraw consent. Where we are processing your personal information on the basis that you have given us your consent to do so, you may withdraw your consent at any time.
- the right of erasure. You may request that we erase your personal information and we will comply, unless there is a lawful reason for not doing so. For example, there may be an overriding legitimate ground for retaining your personal information, such as keeping your payment information for several years to comply with HMRC rules.
- the right to data portability. In certain circumstances, you may request that we provide your personal information to you in a structured, commonly used and machine readable format and have it transferred to another provider of the same or similar services to us. Where this right is applicable, we will comply with such transfer as far as it is technically feasible.
- the right to lodge a complaint with the supervisory authority. We suggest that you contact us about any questions or if you have a complaint in relation to how we process your personal information. However, you do have the right to contact the relevant supervisory authority directly. To contact the Information Commissioner’s Office in the United Kingdom, please visit the ICO website (ico.org.uk) for instructions.
Product/service providers based outside Europe
We use certain third party companies to perform some functions of the products and services on our behalf or to provide services to us. These third parties are only allowed access to your information as needed to perform such functions or to provide such services. They’re not allowed to use it for any other purpose.
Some of these third party companies are located, or have servers that are located, outside the UK and European Economic Area. Where we share your information with such companies, we take all steps reasonably necessary to ensure your information is treated securely and in accordance with this privacy notice.
However, please note that the data protection and other laws of such countries may not be as comprehensive as those in the UK or European Economic Area. We’ll only transfer your personal information to a territory outside of the UK or European Economic Area under the following circumstances:
- the European Commission or UK government has determined that an adequate level of protection for personal information is in place in the country to which we transfer your data
- standard data protection clauses as adopted by the European Commission or UK government are in place governing the transfer (you can view the standard clauses on the European Union’s legal website at eur-lex.europa.eu)
- for transfers to the USA, the recipient organisation is a participant in the EU-US Privacy Shield programme (or equivalent with the UK as and when created); or
- other appropriate safeguards have been put in place, as described in the privacy notice for the applicable product/service
Changes to our business
If we decide to change or restructure our business we may need to pass your personal information to one of our group companies so we can continue to effectively deliver the products and services to you.
Also, if we become involved in a merger, acquisition, restructuring, reorganisation or other transaction involving the sale of some or all of our group companies’ assets, then your information may be included in the assets that are transferred to the new owner and may be provided to the entities and advisors involved. Such a transaction could involve us: (i) retaining the right to continue to use transferred personal information in addition to the right of the new owner to use such information; and (ii) engaging in additional transfers of personal information (including new personal information) with the new owner from time to time following such a transaction.
If there are changes to our business (such as a re-organisation or restructuring), your personal information will remain subject to this privacy notice (as amended from time to time). However, where your personal information is transferred to a new owner following a merger or acquisition it may be subject to a different privacy notice. We, or the new owner, will provide notice to you before any of your personal information becomes subject to a different privacy notice.
For processing that relates solely to Britain’s Got Talent and X Factor: (1) ITV Rights Limited (company number 06633451) with registered office at 2 Waterhouse Square, 140 Holborn, London, EC1N 2AE and VAT registration number 197 0041 67, (2) ITV Consumer Limited (company number 2937518) with registered office at 2 Waterhouse Square, 140 Holborn, London, EC1N 2AE and VAT registration number 197 0041 67 (3) Fremantlemedia Limited (company number 276928) with registered office at 1 Stephen Street, London, W1T 1AL and VAT registration number GB 222 7151 96 and (4) any other producer of the programme, acting as joint data controllers.
All other processing: ITV Consumer Limited is a company registered in England and Wales (registered number 2937518) with registered office at 2 Waterhouse Square, 140 Holborn, London EC1N 2AE. Our VAT registration number is 197 0041 67.
The Information Commissioner’s Office (ICO) regulates our processing of your personal information. You have the right to lodge a complaint with the ICO. Details of how to contact the ICO can be found on their website at www.ico.org.uk.
If you want to contact us about our services, you can find more details at www.itv.com/contactus. If you wish to contact us generally about our privacy notice or with any privacy queries, please email us at firstname.lastname@example.org.