Privacy policy: hosted systems (APAC)
Effective as of 23 March 2021
Contact Information
Mediaocean Headquarters – 120 Broadway, New York, NY 10271, United States
Mediaocean Melbourne – 31-33 Bank Street, South Melbourne, Victoria 3205, Australia
Mediaocean Sydney – Unit 11 Level 1, 1-7 Jordan Street, Gladesville, New South Wales 2111, Australia
Mediaocean Singapore – Level 7, Tong Building, 302 Orchard Road, Singapore 238862
PIN Systems Malaysia - 5, Jalan PJU 7/7a Mutiara Damansara, 47800 Petaling Jaya, Selangor, Malaysia
InfoSec&Compliance@mediaocean.com
This page describes how we process Personal Information in our hosted systems for our clients. To return to our main Privacy Policy, please click here.
Mediaocean APAC (“Mediaocean” or “we”) recognize and respect your privacy rights with regard to Personal Information. For definitions, please see the bottom of this page. Please note that any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email or other means. The date the privacy policy was last revised is shown at the top of this page.
The hosted services which Mediaocean provides in Australia, New Zealand and other territories in Asia (except closed ecosystems capabilities) run on systems that we run and maintain at Amazon Web Services. Closed ecosystems are provided from our secure data centres in the US. Where Personal Information is collected, stored or used by our client companies using these hosted systems, please note that we act only as a Data Processor. The client company is the Data Controller and is responsible for data protection obligations pertaining to its notification, collection, accuracy, and timely disposal. The client company is also responsible for arrangements to enable you to access your own Personal Information, subject to confirmation of identification, for authorizing disclosure to Third Parties, and for breach notifications in case of a security incident. As a Data Processor, Mediaocean’s responsibilities for this data are to:
- Process the Personal Information only on documented instructions from the client company
- Ensure that all persons we authorize to process the Personal Information understand and respect the confidential nature of this information
- Make provisions for the security, availability and integrity of data on our systems, including where we have appointed Sub-processors to help us deliver our services to our clients
- In the event that there is a security incident, provide the client company with the information they need to make statutory breach notifications.
Services we provide in China are run and hosted within China. Please click here for more information.
Categories of personal information in our hosted systems
Our clients may ask us to process the following types of Personal Information:
- User credentials, including user names and passwords;
- Logs of actions you have taken within our systems in application logs, usage analysis and audit trails;
- Business contact details for our clients’ employees, and possibly their vendors’ or clients’ employees, for example to facilitate order or payment processes, or to ensure delivery of printed output to the correct person;
- In the case of Aura or our financial systems, information related to payment of staff expenses, staff timesheets etc
We do not process Sensitive Information about you.
How we store your information
Personal Information processed in our hosted systems is stored at our secure cloud hosting provider, AWS, in Singapore and Mumbai.
Staff involved in support, engineering and technical operations may be based in any location where Mediaocean group companies have offices (Australia, Canada, France, Germany, Netherlands, India, Malaysia, Singapore, UK, USA). So please be aware that our staff may access your data from any of those locations. However, staff are only given access to the data if they need it in order to be able to do their jobs, and only if they have completed mandatory training on security procedures.
We retain Personal Information within our hosted systems in accordance with Mediaocean’s Data and Document Retention Policies. These policies define retention rules based on the nature of the information and the purpose for which it is required. We destroy or dispose of all Personal Information securely when it is no longer needed.
How we keep your information secure
Mediaocean has a documented Information Security policy and we have implemented technical and organizational security measures to ensure the confidentiality, availability and integrity of Personal Information within our hosted systems. These include:
- logical access controls
- network security configurations
- physical access controls
- system software support and change control procedures
- processing integrity measures including logging & monitoring systems
- data retention practices including data replication, virtual and physical back-ups
- resilience, recovery and continuity planning
- applications software development and change control procedures
- incident management
Your rights under this policy
You have the right to opt-out of any use of your Personal Information for marketing purposes by contacting us or by unsubscribing using the link provided at the bottom of our emails. You may also demand access to, deletion or correction of the Personal Information we hold about you. In addition, you have a right, on certain grounds, to object to the processing of your Personal Information. For more information about how to do this, please see the section on Complaints below.
Children under the age of 13
Our hosted services are not intended for children under 13 years of age. No one under age 13 may provide any Personal Information to or on the website. We do not knowingly collect Personal Information from children under 13. If you are under 13, do not use or provide any information on this website or on or through any of its features. If we learn we have collected or received Personal Information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at Infosec&Compliance@mediaocean.com.
Complaints
We commit to resolve complaints about privacy and our collection or use of Personal Information. If you have inquiries or complaints regarding this privacy policy or the handling of your Personal Information, please contact datasecurity@mediaocean.com.
We will cooperate with the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, relevant state or provincial agencies and law enforcement and judicial authorities in investigating any privacy complaints or suspected violations of privacy laws or Mediaocean’s privacy commitments, as well as in rectifying any noncompliant practices. Employees or contractors who violate the terms of these principles may be subject to disciplinary consequences up to and including termination of employment or termination or non-renewal of contract, in addition to any other legal measures that may be taken by Mediaocean, its clients, or the affected individuals and their representatives.
Definitions
The following terms are used in this privacy policy:
- Personal Information is any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier, regardless of the medium or format in which the information is stored.
- A Data Controller is a party or entity that determines the purposes and means of the processing of Personal Information. A company functions as a data controller when it decides how such information is to be used, and then uses that information accordingly.
- A Data Processor is a party or entity that processes Personal Information on behalf of a Data Controller. A company functions as a Data Processor when it acts as an agent of another company, following its instructions as to how that information should be handled and processed.
- Sensitive Information consists of Special Categories of Personal Data as defined by the EU General Data Protection Regulation, that is, information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health information, or sex life/orientation.
- A Third Party is an entity or person other than you, Mediaocean or its clients.
