Management of individuals' data protection requests concerning the Utiq technology

1. Introduction

This document outlines how individuals' queries, requests and exercise of data protection rights concerning the Utiq technology are managed by Utiq.

It also clarifies to other entities that work together with Utiq (e.g., Telecom Operators), or make use of the Utiq technology (e.g., Publishers and Advertisers), where responsibility lies in case they receive such requests, if the request does not concern the Utiq technology, or relates to stages of the processing in which Utiq is not involved.

2. Summary

Under European data protection law, individuals have a number of rights that they are entitled to exercise against entities (Data Controllers) that process their personal data.

The Utiq technology involves multiple entities (Utiq, Telecom Operators, Publishers and Advertisers) that play a role in the processing of individuals' data.

Where the Utiq technology is concerned:

1. Utiq has established specific mechanisms to facilitate the exercise of rights.

2. Utiq also acts as the central point of contact for individuals.*

*This is notwithstanding that individuals are entitled to contact and exercise their rights against any of the entities involved which are also Data Controllers.

The above applies only as far as the request concerns the activation of the Utiq technology and processing related to the same, that is undertaken by Utiq. It does not extend to any further processing of personal data by any of the other entities involved which Utiq has no control over and is not in a position to action.

3. Responsibility for responding to individuals' data protection requests concerning the Utiq technology

Each entity (Data Controller) involved in the provision or use of the Utiq technology (i.e., Telecom Operators, Publishers, Advertisers and Tech Vendors) is responsible for responding to any queries or data protection rights requests sent directly to them by individuals, including where they concern the Utiq technology.

This means that:

• The entity that receives the request shall respond to the request.

• If the request concerns the Utiq technology the entity shall make reference to the resources provided in section 5 of this document.

• If the request relates to data under the control of the entity OR is unrelated to the Utiq technology, it shall be dealt with by the entity in accordance with their internal processes for data subject rights requests.

• If there are doubts about the nature of the request, or a suitable response cannot be found under section 5 of this document, please consult with Utiq without delay.

When should the entity send the request / involve Utiq?

If the request specifically relates to data under the control of Utiq OR is more complex and could require a coordinated response, the entity shall, in accordance with the data protection agreement entered into between the parties, notify Utiq without undue delay (typically 3 days) and both parties shall cooperate in order to prepare a response in accordance with the requirements and timelines established under the GDPR.

What is Utiq’s responsibility with regards to responding to individuals' data protection rights requests?

Utiq acts as the central point of contact for individuals where the Utiq technology is concerned. Specifically, Utiq operates a privacy inbox and contact form which individuals can use to directly get in touch with Utiq for any queries or to exercise their data protection rights. Despite this, individuals still have the right to reach out to any of the other parties (data controllers) involved (i.e., Telecom Operators, Publishers, Advertisers or Tech Vendors) to exercise their rights, in which case the entity is responsible for responding as described above in this section 3.

Utiq has also established specific mechanisms to facilitate the exercise of individuals' rights, enabling individuals to self-serve, as further outlined below. As a result, entities can also, where appropriate, direct individuals to these mechanisms.

4. What mechanisms does Utiq make available to individuals to facilitate the exercise of data protection rights?

All individuals are provided with:

1. An FAQ section available at https://consenthub.utiq.com/pages/faq where individuals can find answers to the most common questions and requests.

2. A contact form available at https://consenthub.utiq.com/pages/contact-us which individuals can use to get in touch with Utiq.

3. A privacy email address that enables individuals to get in touch with Utiq directly: privacy@utiq.com.

Individuals that are eligible to use the Utiq technology (i.e., use a supported internet connection provided by one of the participating telecom operators) are provided with:

1. A self-serve privacy portal (“consenthub”) accessible at https://consenthub.utiq.com/ which they can use to manage Utiq technology consents, amongst other things.

2. A “Manage Utiq” section accessible via any digital properties that make use of the Utiq technology (typically found at the footer of participating websites) which enables individuals to withdraw Utiq consent to the digital property being accessed.

How are individuals informed of this by Utiq?

Utiq informs individuals of the data protection rights available to them and how to exercise them in the Utiq technology privacy statement available at https://consenthub.utiq.com/pages/privacy-statement. This is also accessible via the Utiq consent text presented to individuals in digital properties that make use of the Utiq technology.

5. How to respond to requests

Contact teams working within the entities involved in the provision or use of the Utiq technology (i.e., Telecom Operators, Publishers and Advertisers) should make use of the following resource when responding to any queries/requests received that concern the Utiq technology.

Adhering to the below helps to ensure individuals are provided with appropriate information, in a clear, transparent and aligned way, to ensure the best user experience for such individuals.

Outlined below are the most common queries/requests that are raised by individuals and links to answers.

6. Glossary

Definitions and key terms can be found in https://consenthub.utiq.com/pages/privacy-statement#definitions Section 1.