LEO BURNETT COMPANY, INC. PRIVACY NOTICE

Last Updated: September 2, 2021

This Privacy Notice provides information about how Leo Burnett Company, Inc. (“Leo Burnett”, “we”, “our”, or “us”) collects, uses, and shares information about you as well as your rights and choices regarding such information. It applies to any online location that links to this Privacy Notice (the “Website”) or offline location that makes this Privacy Notice available to you.

Introduction

Any data collected through the Website including personal information (as defined under applicable data protection laws, and as may be similarly referred to as “personal data” or “personally identifiable information” under applicable data protection laws), will only be used for the purposes set out in this Privacy Notice. Once collected, personal information will not be used for a different incompatible purpose without notice to you and your consent. Notwithstanding, we may use information that does not identify you (including information that has been aggregated or de-identified) in accordance with the “Aggregate, Deidentified, or Anonymised Information” section below. Leo Burnett, 35 West Wacker Drive, Chicago, IL 60601, is regarded as the Data Controller or Business (under applicable data protection laws). However, in some instances, Leo Burnett acts as a processor or service provider on behalf of a client, which is the Data Controller or Business. Any questions that you have relating to the processing of personal information by Leo Burnett as a processor or service provider should be directed to the relevant client.

Please read this Privacy Notice thoroughly. If you disagree with the way personal information will be processed, please do not use the Website or provide your personal information through the Website or any offline location that makes this Privacy Notice available to you.

We may include links on the Website to other websites including social media platforms. This Privacy Notice only covers our data practices through the Website and does not cover the data practices of these other websites. When you interact with these other websites, including when you leave the Website, those websites may independently collect information about you and solicit information from you. The information collected and stored by those websites remains subject to their own policies and practices, including what information they share with us, your rights and choices on their services and devices, and whether they store information in the U.S. or elsewhere. We encourage you to read the privacy notices available on other websites you visit.

I. Information from our clients

We provide products and services to our clients and collect and process information about individuals (including through tracking technologies) at the direction of our client (“client data”). Client data has historically included contact data, demographic data, content, service use data, device data, and location data, among other information. Our processing of client data is governed by the terms of our service agreements with our clients, and not this Privacy Notice. We are not responsible for how our clients treat the information we collect on their behalf, and we recommend you review their own privacy policies.

For more information on your rights and choices regarding client data, see the “Your rights regarding your information” section below.

II. What personal information do we collect and process through the Website?

The following describes the categories of personal information we collect and the sources of such personal information.

1. Category: Identification and contact data, e.g., online identifiers; IP address; first name, last name, postal address, e-mail address, telephone number

   Categories of Sources:

   • We will collect this directly from you when you interact with our chatbot or send us your questions or comments using the query form.
   • We may collect this from publicly available sources, data brokers, partners (e.g., that offer co-branded services, sell or distribute our products, or engage in joint marketing activities), advertising networks, internet service providers, data analytics providers, operating systems and social media networks.

2. Category: Commercial or transactions information e.g., products or services considered, or other purchasing or consuming histories or tendencies

   Categories of Sources:

   • We will collect this directly from you if you provide such information when you interact with our chatbot or send us your questions or comments using the query form.
   • We may collect this from publicly available sources, data brokers, partners (e.g., that offer co-branded services, sell or distribute our products, or engage in joint marketing activities), advertising networks, internet service providers, data analytics providers, operating systems and social media networks.
   • We may also collect this from internet service providers, data analytics providers, operating systems and social networks.

3. Category: Internet or other electronic network activity information (Technical data) e.g., browsing history; search history; online interests, such as information about categories of consumer interests derived from online usage; and information on a consumer’s interaction with a website, application, or advertisement.

   Categories of Sources:

   • We may collect this from publicly available sources, data brokers, partners (e.g., that offer co-branded services, sell or distribute our products, or engage in joint marketing activities), advertising networks, internet service providers, data analytics providers, operating system and social media networks.
   • We may also collect this from internet service providers, data analytics providers, operating systems and social networks.

4. Category: Geolocation data

   Categories of Sources:

   • We may collect this from publicly available sources, data brokers, partners (e.g., that offer co-branded services, sell or distribute our products, or engage in joint marketing activities), advertising networks, internet service providers, data analytics providers, operating system and social media networks.
   • We may collect this from internet service providers, data analytics providers, operating systems and social networks.

5. Category: Your verbatim communications to us

   Categories of Sources:

   • We will collect this directly from you when you interact with our chatbot or send us your questions or comments using the query form.

To the extent Leo Burnett collects information from or about you within the context of your role as a job applicant, such information is subject to the PublicisGroupeCandidatePrivacyNotice-SmartRecruitersPlatform.pdf and not this Privacy Notice.

III. Purpose of data collection and legal grounds we rely on

The following provides information about our purposes for collecting your personal information:

Our Purposes for collecting and using personal information:

1. To read and respond to your queries to us, sent using the Website or our chatbot.

   Basis for processing:

   • Performance of a contract to which you are a party, if you contact us about our services, or our legitimate interest to respond to individuals’ queries.
   • Consent, where you indicate that you want to receive marketing material from us.
   • Performance of a contract to which you are a party.

2. Operating our Website, for example: 1) improving, testing, updating and verifying our own database, 2) developing new products and services, 3) operating, analyzing, improving, and securing our Website.

   Basis for processing: Our legitimate interest to improve our services and develop new products

3. Other internal purposes, for example: For internal research, internal operations, auditing, detecting security incidents, debugging, short-term and transient use, quality control, and legal compliance. We use the information collected from our own website for the above, as well as for our own marketing purposes.

   Basis for processing: Our legitimate interest to support our internal operations and conduct research

In addition, we use analytics services, such as Google Analytics, to help us understand how users access and use the Website. In addition, we work with agencies, advertisers, ad networks, and other technology services to place ads about our products and services on other websites and services. For example, we place ads through Google and Facebook that you may view on their platforms as well as on other websites and services.

As indicated below, vendors and other parties may act as our service providers, or in certain contexts, independently decide how to process your information. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

IV. With whom do we share personal information?

We will share your personal information for various business purposes, with service providers, vendors, partners, and with other parties including our clients.

We share the personal information we collect as follows:

Sharing with other group entities or service providers: As a global organization, we share limited data with related entities and our affiliates or with selected service providers (as described under V), either to benefit from additional support (technical or otherwise), or to provide you with services you have requested from us. We also share information with our related entities and affiliates for their own internal purposes. We may permit our service providers to use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law.

Vendors and Other Parties: We share information with vendors and other parties for analytics and advertising related purposes. These parties may act as our service providers, or in certain contexts, independently decide how to process your information.

Clients: We share information with our clients in connection with the services we provide to them. For example, we share information with our clients in order to facilitate their orders, maintain and administer accounts, respond to questions, comply with requests, and otherwise comply with the law. Our clients are independent entities and their processing of information is subject to their own privacy policies.

Sharing for Legal Purposes: In addition, we may share personal information with other parties in order to: (a) comply with legal process or a regulatory investigation (e.g. regulatory authorities’ investigation, subpoena, or court order); (b) enforce our Terms of Service, this Privacy Notice, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of other parties; and/or (d) protect the rights, property or personal safety of us, our platform, our customers, our agents and affiliates, its users and/or the public. We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, and spam/malware prevention, and similar purposes.

Sharing In The Event of a Corporate Transaction: We may also share personal information in the event of a major corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.

Aggregate, Deidentified, or Anonymised Information: We may aggregate, de-identify and/or anonymise any information collected so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any other party, including advertisers, promotional partners, and sponsors, in our discretion, unless otherwise prohibited by applicable law.

Facilitating Requests: We share information at your request or direction.

Consent: We share information with notice to you and your consent.

V. Who is processing the personal information?

We have engaged processors to process information on our behalf as described in Section IV above. Any processing of the personal information by these parties is in accordance with our instructions and will be accessed by our service providers only to the extent that is required to provide us with the services and in compliance with applicable law, including with respect to data confidentiality, privacy and security.

For example, we have engaged BEACH HAUS LLC to help with hosting the Website and data storage. The processing of personal information by BEACH HAUS LLC is in accordance with our instructions. BEACH HAUS LLC needs personal information to run the Website and to protect and improve its platform and services. BEACH HAUS LLC analyzes the data in a de-identified form.

Employees of Publicis Health and other Publicis Groupe agencies (e.g., from Sales, Marketing, Communications, IT, Operations, and Talent) process personal information for marketing efforts and talent acquisition purposes. Any processing of personal information by these employees is in accordance with our instructions.

VI. Data Subject rights regarding personal data; Other Rights and Choices

Data Subject Rights: If you are a data subject in Europe, you may exercise the following legal rights regarding personal data that we hold about you.

• The right of access
• The right to rectification
• The right to erasure
• The right to object
• The right to restrict processing
• The right to data portability
• The right to withdraw your consent to the processing of your personal data at any time

Personal data will be stored in accordance with our applicable data retention requirements and corporate policies. The retention period for personal data varies depending on the type of personal data and the purposes of processing it.

If you are a data subject in Europe, and personal data about you has been processed by us as a processor on behalf of a client and you wish to exercise any rights you have with such personal data, please inquire with our client directly. If you wish to make your request directly to us, please provide the name of our client on whose behalf we processed your personal data. We will refer your request to that client, and will support them to the extent required by applicable law in responding to your request.

Do Not Track: Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to “Do Not Track” signals. For more information on “Do Not Track,” visit http://www.allaboutdnt.com.

Analytics: Google provides tools to allow you to opt out of the use of certain information collected by Google Analytics at https://tools.google.com/dlpage/gaoptout and by Google Analytics for Display Advertising or the Google Display Network at https://www.google.com/settings/ads/onweb/. Please note that if you opt out using any of these methods, the opt out will only apply to the specific browser or device from which you opt out. We are not responsible for the effectiveness of, or compliance with, any opt out options or programs, or the accuracy of any other entities’ statements regarding their opt out options or programs.

E-mails: You can opt-out of receiving promotional emails from us at any time by following the instructions as provided in emails to click on the unsubscribe link, or emailing us at the email address set out in the “Further Information” section below with the word unsubscribe in the subject field of the email. Please note that you cannot opt-out of non-promotional emails, such as those about transactions, servicing, or our ongoing business relations.

VII. Viewing, Editing, Updating or Deletion of your personal information:

If you are a data subject in Europe, please contact privacyofficer@publicisgroupe.com if you want to see any personal information stored about you in our records. We will honor your legal right to view your personal information in accordance with applicable privacy law. If you think that any of the personal information collected through the Website is incorrect, confusing or incomplete, please contact privacyofficer@publicisgroupe.com. You may also ask us to erase, restrict or port your personal information and you may tell us if you object to our use of your personal information.

Personal information will be stored by us in accordance with our applicable data retention requirements and corporate policies.

VIII. Your California Rights and Choices

Without being discriminated against for exercising these rights, California residents, under the California Consumer Privacy Act of 2018 (“CCPA”), may have the right to request that we disclose what personal information we collect from you, to delete that information, and to opt-out of the sale of your personal information, subject to certain restrictions. You also have the right to designate an agent to exercise these rights on your behalf. This section describes how to exercise those rights and our process for handling those requests. (To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.)

Our Website is intended to provide information and services to job applicants and business clients. You understand and agree that information collected about you is solely within the context of (i) your role as an employee, job applicant, owner, director, officer, or contractor or (ii) Leo Burnett conducting due diligence regarding, or providing or receiving a product or service to or from, your employer.

We also acknowledge that you may have rights under the CCPA in connection with the personal information we process on behalf of our clients. If personal information about you has been processed by us as a service provider on behalf of a client and you wish to exercise any of the rights described below, please provide the name of our client on whose behalf we processed your personal information. We will refer your request to that client and will support them to the extent required by applicable law in responding to your request.

To understand the categories of personal information we have collected in the last 12 months please review the “What personal information do we collect and process through the website” section above. To understand the purposes for collecting those categories of personal information in the last 12 months please see the “Purpose of data collection and legal grounds we rely on” section above. To understand the categories of parties with whom we have shared the categories of personal information with in the past 12 months, please see the “With whom do we share personal information” section above. “We do not “sell” (as that term is defined by the CCPA) the personal information we collect in accordance with this Privacy Policy.

1. Right to request access to your personal information

   California residents have the right to request that we disclose what categories of personal information that we collect, use, disclose, or sell about them. In particular, you may request:

   • the specific pieces of personal information that we have collected about you;
   • the categories of personal information we have collected about you;
   • the categories of sources from which the personal information was collected;
   • the categories of personal information about you we disclosed for a business purpose or sold;
   • the categories of third parties to whom the personal information was disclosed for a business purpose or sold; and
   • the business or commercial purpose for collecting or selling the personal information.

2. Right to request deletion of your personal information

   You may also request that we delete any personal information that we collected from you, such as if you have been a customer of ours. However, we may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as de-bugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, (f) for our own internal purposes reasonably related to your relationship with us, or to comply with legal obligations. Additionally, we need certain types of information so that we can provide our Website to you.

3. How to exercise your access and deletion rights

   California residents may exercise their California privacy rights by sending an email to privacyofficer@publicisgroupe.com.

   For security purposes (and as required under California law), we will verify your identity – in part by requesting certain information from you — when you request to exercise your California privacy rights. For instance, if you request categories or specific pieces of personal information, we have collected about you, you may need to confirm your possession of an identifier (such as an email address) or to provide a piece of identification that confirms you are the person you claim to be.

   If we are unable to complete your request fully for any reason, we will provide you additional information about the reasons why we could not comply with your request.

4. Right to nondiscrimination

   We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these CCPA rights.

5. Shine the Light

   Customers who are residents of California may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To exercise a request, please write us at the email or postal address set out in the “Further Information” section below and specify that you are making a “California Shine the Light Request.” We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.

6. Authorized Agents

   You may also designate an agent to make requests to exercise your rights under CCPA as described above. We will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.

IX. Additional Disclosures for Nevada Residents

Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us at privacyofficer@publicisgroupe.com.

X. Children

The Website is intended for general audiences and is not directed at children. We do not knowingly collect personal information (as defined by the U.S. Children’s Privacy Protection Act, or “COPPA”) from children. If you are a parent or guardian and believe we have collected personal information in violation of COPPA, contacts us at privacyofficer@publicisgroupe.com. We will remove the personal information in accordance with COPPA. We do not knowingly “sell,” as that term is defined under the CCPA, the personal information of minors under 16 years old who are California residents.

XI. Data Security

We use a variety of methods, such as firewalls, intrusion detection software and manual security procedures, designed to secure your data against loss or damage and to help protect the accuracy and security of information and to prevent unauthorized access or improper use. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you. If you think that the Website or any personal information is not secure or that there has been unauthorized access to the Website or your personal information, please contact privacyofficer@publicisgroupe.com immediately.

XII. Data Transfers

Please be aware that information collected through the Website is transferred to the US and other jurisdictions which are not considered to have the same level of data protection as in the EU. However we will provide appropriate safeguards (for example under intercompany agreements with appropriate contractual protections). Your use of the Website or provision of any information therefore constitutes your consent to the transfer to and from, processing, usage, sharing, and storage of information about you in the U.S. and other jurisdictions as set out in this Privacy Notice.

XIII. Use of cookies, other tracking technology, social media, chatbots, and social media plug-ins

Cookies are small pieces of text or code sent to your device when you visit the Website. Cookies are used to optimize the viewing experience, count visitors to a webpage, troubleshoot any problems, keep websites secure, and better serve content. The following cookies are used on the Website:

• Functional and required cookies are always used to allow our hosting platform, to securely serve this Website to you.
• Analytics and performance cookies are used on the Website to view site traffic, activity, and other analytics data.

Overall, cookies help us provide you with a better Website, by enabling us to monitor which pages you find useful and which you do not. In addition, if you interact with our chatbot, we will drop a cookie that helps provides the chatbot’s functionality and processes the content of the conversation you have with the chatbot to serve you new content you have not seen but might find useful. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the Website.

For more information about the cookies dropped on your device, please review the Cookie Policy.

Any information you provide to us when you engage with our content (such as via our chatbots on our Website our through Facebook Messenger or other social media, as mentioned below) is treated in accordance with this Privacy Policy.

If you engage with us on social media (for example, through our accounts on LinkedIn, Facebook, Twitter, or Instagram), we will also collect information about you in order to understand our followers better and understand the public response to our products and services. We may use this information to contact you, send you marketing information which we think may be of interest to you, and engage in social listening to identify and assess what is being said about us publicly to understand industry trends and market sentiment. Any information you provide to us when you engage with our content (such as through our brand page or via Facebook Messenger) is treated in accordance with this Privacy Notice. Also, if you publicly reference us or our Website on social media (such as by using a hashtag associated with us in a tweet or post), we may use your reference on or in connection with our Website.

We provide social media plug-ins on the Website to allow you to easily share content from our Website through social media, and in doing so, we may receive your personal information from the social media platform that you have authorized to share with us. We have no control over how social media platforms use your personal information and they may independently collect information about you when you leave our Website. The information collected and stored by those parties remains subject to their own policies and practices, including what information they share with us, your rights and choices on their services and devices, and whether they store information in the U.S. or elsewhere. We encourage you to read the privacy notices on the various social media platforms you use.

Find out more about how these social media platforms use your personal information:

• Facebook
• Twitter
• YouTube (Google’s general privacy policy)
• Instagram
• LinkedIn

XIV. Notification of changes

Should we wish to change this Privacy Notice, and if you have already provided personal information through the Website, we will contact you to inform you of the new Privacy Notice and, in some circumstances, we may need to obtain your consent to the changes. In other circumstances, any such changes to this Privacy Notice will be promptly communicated on this page and you should check back regularly to see whether there are any changes. Continued use of the Website after a change in the Privacy Notice indicates your acknowledgement and acceptance of the Privacy Notice then posted.

If you wish to save this text, please mark the entire statement (e.g. with your mouse) and copy-paste by pushing ctrl-c.

XIV. Further information

This Privacy Notice has been designed to be accessible to people with disabilities. If you experience any difficulties accessing the information here, please contact us at privacyofficer@publicisgroupe.com.

If you consider that we are not complying with this Privacy Notice, if you have any questions in relation to this Privacy Notice, or have questions about your rights and choices, please contact privacyofficer@publicisgroupe.com. Data subjects in Europe may also lodge a formal complaint with their competent data protection authority.

If you have any questions about Leo Burnett’s data practices or you wish to exercise your rights or know about the contractual protections in place, please contact the Publicis Chief Data Privacy Officer at privacyofficer@publicisgroupe.com.