Data Privacy Read ƽ’ Information & Data Security Practices policy Data Privacy & Security: A Key Value At ƽ, protecting the right to privacy is fundamental to maintaining the trust of our customers, readers, subscribers, suppliers and employees. We are committed to implementing leading data protection standards, and we have adopted significant governance measures, corporate policies and operating procedures to do so. We abide by “privacy by default” and “privacy by design,” and we conduct privacy impact assessments for major new products, services and other offerings prior to public launch. We leverage organization-wide tools to document our data flows, manage data subject access rights and assess data processing activities. We regularly review our data collection and processing activities to ensure data is collected lawfully and transparently. A Comprehensive Compliance Program Across All ƽ Brands We have a comprehensive Information Security policy that applies to all of ƽ, and our divisions and brands are committed to transparency in their collection, use, retention and sharing (if applicable) of data. In support of this commitment, each ƽ division or brand has a separate privacy policy with clear terms about how that division or brand collects, uses, retains and shares data and pursuant to which legal basis. You can always find the most up to date policies posted on each of our division or brands’ sites, and exemplary privacy policies available here. As set forth in our divisions’ and brands’ policies, when we rely on consent as the legal basis for data collection, we ensure that user consent is affirmative, specific, informed, and freely given, and we allow consent to be withdrawn at any time. Our policies provide all users, regardless of location, with subject access rights including: right to access, right to deletion, right to transfer, right for information, right to correction, right to opt out of sale (if applicable), right to object and right to restrict processing. Our policies also provide users with controls to allow them to manage their data and exercise their subject access rights. We notify data subjects as legally required in case of data sharing, and we seek to avoid processing of minors’ personal data. We are committed to notifying data subjects in a timely manner if there is a material change in our privacy policies or practices. Adherence to Leading Industry Standards At ƽ, we have also implemented organization-wide measures and tools to regularly monitor core systems, sites and applications for potential vulnerabilities. We also encourage responsible reporting of vulnerabilities that may be found in our sites or our applications, and we review such reports and respond as appropriate. If a data security incident does arise, we have a documented incident response policy and operate under the principles of timely detection, management and response. We notify applicable regulators and affected data subjects as required by applicable law. Although we carry cybersecurity insurance as a precaution, in the past three years, neither we nor our vendors have experienced a data security incident that was material to us, we have not incurred any material expenses in connection with a data security incident, and we have not incurred any payments from penalties or settlements in connection with a data security incident. A Proactive Approach Within ƽ and With Our Vendors To ensure ƽ meets its commitments, we use internal and external audits against information security standards at least annually, require employee trainings on both data security and privacy on hire and annually thereafter, conduct vendor security reviews, and expect and require key vendors to implement data security standards that meet or exceed our own. Our external Data Protection Officer, in conjunction with ƽ’ Chief Technology Officer, Chief Information Security Officer, Chief Auditor, General Counsel, Chief Financial Officer, Chief Accounting Officer, and senior management oversee responsibility for data security matters, and ƽ’ Board of Directors and Audit Committee are regularly briefed on information security. Our Legal team and Information Security team regularly update business executives on new privacy regulations, policy and procedure changes and requirements.