PRIVACY NOTICE
Welcome to the JCDecaux UK Limited Privacy Notice.
JCDecaux respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.
1. IMPORTANT INFORMATION AND WHO WE ARE
PURPOSE OF THIS PRIVACY NOTICE
This privacy notice aims to give you information on how JCDecaux collects and processes your personal data through your use of this website, including any data you may provide through this website when you sign up to our newsletter or take part in a competition.
This website is not intended for minors, and we do not knowingly collect data relating to minors.
It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.
ABOUT US
JCDecaux UK Limited (“JCDecaux” or “we”) is the controller and responsible for your personal data. JCDecaux is an English company (No: 01679670) with its registered office at 991 Great West Road Brentford Middlesex TW8 9DN.
JCDecaux UK Limited is the controller responsible for the personal data processed for the purposes described in this Privacy Notice.
JCDecaux UK Limited forms part of the JCDecaux group of companies, whose group headquarters are located at 17 rue Soyer, 92200 Neuilly-sur-Seine, France ("JCDecaux Group").
We may share personal data with other members of the JCDecaux Group. Depending on the particular processing activity, another JCDecaux Group company may act as an independent controller, a joint controller with JCDecaux UK Limited, or a processor acting on our behalf.
Where we act as joint controllers, we will make appropriate arrangements regarding our respective data protection responsibilities as required by applicable Data Protection Legislation. You may contact us using the details below if you would like further information about the arrangements that apply to a particular processing activity.
In this Privacy Notice, "Data Protection Legislation" means the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable UK legislation relating to the processing of personal data, in each case as amended from time to time, including relevant amendments introduced by the Data (Use and Access) Act 2025.
CONTACT DETAILS
If you have any questions about this privacy notice, including any requests to exercise your legal rights, please use the contact details set out below.
- Full name of legal entity: JCDecaux UK Limited
- Email address: uk.governance@jcdecaux.com
- Postal address: 991 Great West Road Brentford Middlesex TW8 9DN
- Telephone number: 020 8326 7777 (ask for Legal and/or Governance)
THIRD-PARTY LINKS
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
2. THE DATA WE COLLECT ABOUT YOU
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:
- Identity Data includes first and last name.
- Contact Information includes delivery address, billing address, email address, and telephone number.
- Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
- Usage Data includes information about how you use our website and its services.
- Marketing and Communications Data includes opting in to, and opting out from, receiving marketing from us and our third parties, and your communication preferences.
- Video Survey Data: Video Survey Data includes video recordings, images, voice recordings, survey responses and automated transcriptions generated from your responses. We may use automated tools, including Artificial Intelligence ("AI"), to transcribe and analyse survey responses in order to identify themes, trends and aggregated insights. Further information about this processing is provided in the "AI and Automated Processing" section below.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
In some instances, we may invite you to participate in third party video surveys. These surveys may collect and process your personal data, including:
- Images: Your video recording, including your likeness and surroundings.
- Voice: Your responses as captured in the audio recording.
- Video Transcription: Automated transcription of your spoken responses using AI technology.
The information collected in these surveys is used to better understand feedback, opinions, and trends. The video recordings and transcriptions may be processed for analysis, transcription, and reporting purposes.
We ensure that any processing of video survey data is carried out in compliance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.
We do not generally seek to collect Special Category Personal Data through this website or through our video surveys. Special Category Personal Data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, certain biometric data used for identification purposes, health information and information concerning a person's sex life or sexual orientation.
However, where you provide free-text, audio or video responses, you may voluntarily provide information that constitutes Special Category Personal Data. Where this occurs, we will only process such information where we have a valid lawful basis and an applicable condition for processing Special Category Personal Data under Data Protection Legislation.
We do not use images or voice recordings collected through video surveys for the purpose of biometric identification unless we specifically inform you otherwise before that processing takes place and establish the necessary lawful basis and safeguards.
We do not generally seek to collect personal data relating to criminal convictions or offences through this website. Where such information is processed, we will do so only where permitted by applicable Data Protection Legislation.
We may use automated tools, including AI, to assist with the transcription and analysis of survey responses and other information. Our current use of these tools for the purposes described in this Privacy Notice is intended to support analysis and generate insights and does not involve making solely automated decisions about individuals that produce legal or similarly significant effects.
If we introduce significant solely automated decision-making in the future, we will provide appropriate information about that processing and implement the safeguards required by applicable Data Protection Legislation.
We retain personal data only as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specific retention periods are outlined in Section 8 of this privacy notice.
3. HOW IS YOUR PERSONAL DATA COLLECTED?
We use different methods to collect data from and about you including through:
You may give us your Identity by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- subscribe to our service or publications
- request marketing to be sent to you
- enter a competition, promotion or survey or
- give us some feedback.
- Automated technologies or interactions
As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookies Policy for further details.
- Third parties or publicly available sources
We may receive personal data about you from various third parties as set out below:
- analytics providers such as Google based outside the EU
- advertising networks
4. HOW WE USE YOUR PERSONAL DATA
PURPOSES AND LAWFUL BASIS FOR PROCESSING PERSONAL DATA
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
PURPOSE/ACTIVITY | TYPE OF DATA | LAWFUL BASIS FOR PROCESSING INCLUDING BASIS OF LEGITIMATE INTEREST |
To administer, operate and protect our business, IT systems and website, including troubleshooting, maintenance, support, testing, security, fraud prevention, hosting and recovery. | Identity Data; Contact Information; Technical Data; Usage Data | Operating and protecting our business, systems and website. Legal obligation, where applicable. |
To consider or implement a business reorganisation, restructuring, merger, acquisition or sale, including due diligence. | Relevant categories of personal data, as necessary. | Managing and restructuring our business and facilitating corporate transactions. |
To analyse use of our website and services and improve performance, products, services and user experience. | Technical Data; Usage Data | Understanding and improving our website, services and user experience. Consent, where required for cookies or similar technologies. |
To enter into and perform a contract with you, including providing products or services, payments, deliveries and related communications. | Identity Data; Contact Information; Transaction Data | Performing our contract with you or taking steps at your request before entering into a contract. Legitimate interests, where applicable, in managing customer relationships. |
To administer competitions, prize draws or promotions, including verifying eligibility, contacting winners and awarding prizes. | Identity Data; Contact Information; other information required to administer the promotion. | Contract, where applicable. administering competitions and promotions fairly and effectively. |
To respond to enquiries, requests and feedback and contact you about surveys or feedback. | Identity Data; Contact Information; Survey Data; Communications Data | Responding to enquiries and feedback and improving our services. Contract, where applicable. |
To send you marketing and promotional communications. | Identity Data; Contact Information; Marketing and Communications Data | Consent, where required. Otherwise, promoting our products and services, where permitted by law. You may opt out at any time. |
To invite you to and facilitate your voluntary participation in a video survey. | Identity Data; Contact Information; Video Survey Data | Obtaining feedback and carrying out research, as applicable. |
To record, transcribe and analyse video survey responses, including using automated tools or AI to identify themes, trends and insights. | Video Survey Data, including video, images, voice recordings, responses and transcriptions. | Analysing feedback and improving our products and services. Consent, where applicable. An appropriate Article 9 condition will apply where Special Category Data is processed. |
AI AND AUTOMATED PROCESSING
We may use third-party service providers that provide automated technologies, including AI, to process Video Survey Data.
These technologies may be used to:
- transcribe spoken responses into text;
- analyse survey responses;
- identify common themes, patterns and trends; and
- generate aggregated reports and insights.
We use these technologies to assist us in understanding feedback and improving our products, services and activities.
Our current use of these technologies for the purposes described above does not involve making decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
If we introduce processing involving significant decisions based solely on automated processing, including profiling, we will ensure that the processing complies with applicable Data Protection Legislation and will provide affected individuals with appropriate information about the processing.
Where required by applicable Data Protection Legislation, appropriate safeguards will be provided, including the ability to make representations about a decision, obtain human intervention and contest the decision.
Additional requirements apply where Special Category Personal Data is used in significant solely automated decision-making.
Where the proposed use of AI or automated processing is likely to result in a high risk to individuals' rights and freedoms, we will assess the processing in accordance with our Data Protection Impact Assessment procedures before commencing the relevant processing.
IF YOU FAIL TO PROVIDE YOUR PERSONAL DATA
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
OPTING OUT
You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.
5. COOKIES
We use cookies and similar storage and access technologies in connection with our website.
Some technologies are necessary for the operation, security or functionality of our website. Where required by applicable law, we will obtain your consent before using non-essential cookies or similar technologies.
You can manage your preferences through our cookie preference centre. You may also be able to configure your browser or device settings to control certain cookies and similar technologies.
Please note that disabling certain technologies may affect the availability or functionality of parts of our website.
For detailed information about the technologies we use, their purposes, the third parties involved and how you can manage your preferences, please see our Cookies Policy and cookie preference centre.
6. SHARING PERSONAL DATA
When processing your personal data, we may need to share it with third parties (including other entities within our group of companies), as set out in the table below. This list is non-exhaustive and there may be circumstances where we need to share personal data with other third parties.
Where we disclose personal data to third parties, we will ensure that the disclosure is lawful and that appropriate contractual, organisational and security measures are implemented where required.
Third parties receiving personal data may act as processors acting on our instructions, independent controllers responsible for their own processing, or, in some circumstances, joint controllers with us.
Where a third party acts as our processor, we require appropriate contractual commitments relating to the protection and processing of personal data.
Where the disclosure involves a restricted international transfer of personal data, we will implement an appropriate transfer mechanism and any additional safeguards required by applicable Data Protection Legislation. Further information is provided in Section 7 below.
We may share video survey data with trusted third-party service providers to facilitate survey collection and analysis. These providers may process your video survey data, including transcriptions, using AI tools. Processing is governed by strict confidentiality agreements, and your data is used solely for the purposes outlined in this privacy notice.
| |
IT, technology and service providers | We share personal data with suppliers that provide IT, cloud, hosting, software, identity management, website, data analysis, backup, security, storage and other technology services. |
Analytics providers | We share personal data with providers that help us understand the use and performance of our website and services. Further information about website analytics is available in our Cookies Policy and cookie preference centre. |
Payment providers and banks | We share personal data with providers that process payments, transactions and refunds. |
Delivery and courier companies | We share personal data with suppliers that assist us in delivering products and services to our customers. |
Advertising partners | Where permitted by applicable law, we share personal data with advertising partners to provide and measure online advertising. Further information is available in our Cookies Policy and cookie preference centre. |
Marketing and CRM service providers | We share personal data with suppliers that help us manage customer and marketing databases and send marketing, service and account-related communications, surveys and feedback requests. |
Survey, research and AI service providers | We share personal data with suppliers that help us conduct, transcribe and analyse surveys and feedback, including providers of automated or AI-based tools, as described in this Privacy Notice. |
Promotion and competition providers | We share personal data with suppliers that help us administer competitions, prize draws, promotions and the awarding of prizes. |
Event partners and suppliers | We share personal data with suppliers that help us organise and administer events and, where applicable, with partner organisations involved in delivering an event. |
Other JCDecaux Group companies | We share personal data with other JCDecaux Group companies where necessary for legitimate business, administrative and operational purposes, subject to appropriate data protection arrangements. |
Professional advisers | We share personal data with auditors, lawyers, accountants, insurers and other professional advisers where necessary to obtain professional advice, manage our business or establish, exercise or defend legal rights. |
Law enforcement, regulators and public authorities | We disclose personal data where required or permitted by applicable law, including to law enforcement bodies, courts, regulators and other competent public authorities. |
Parties involved in corporate transactions | We may share personal data with prospective buyers, sellers, investors, advisers and other relevant parties in connection with a merger, acquisition, restructuring, financing or sale of all or part of our business or assets, subject to appropriate safeguards. |
Other third parties | We may disclose personal data to other third parties where you have authorised us to do so or where the disclosure is otherwise required or permitted by applicable law. |
7. TRANSFERS OUTSIDE THE UK AND THE EUROPEAN ECONOMIC AREA (“EEA”)
JCDecaux UK Limited may transfer personal data to, or allow personal data to be accessed from, countries outside the UK, including where we use international service providers or share information with other members of the JCDecaux Group.
Where a transfer is a restricted transfer under applicable UK Data Protection Legislation, we will ensure that an appropriate legal transfer mechanism is in place.
Depending on the circumstances, this may include:
- transferring personal data to a country or organisation covered by applicable UK adequacy regulations;
- using the UK International Data Transfer Agreement ("IDTA");
- using the UK Addendum to the EU Standard Contractual Clauses;
- relying on another safeguard permitted by applicable Data Protection Legislation; or
- relying on a permitted statutory exception in appropriate circumstances.
Where required, we will carry out an appropriate assessment of the transfer and the protections applicable to the personal data, taking account of whether the protection provided is not materially lower than the protection provided under UK Data Protection Legislation. We will implement additional contractual, technical or organisational measures where appropriate.
Where EU or EEA data protection law separately applies to a particular transfer, we will also implement an appropriate transfer mechanism required under that applicable law.
You may contact us using the details provided in this Privacy Notice if you would like further information about the safeguards used in relation to a particular international transfer.
8. HOW LONG WE KEEP YOUR PERSONAL DATA
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to satisfy legal, regulatory, accounting or reporting requirements or to establish, exercise or defend legal claims.
When determining appropriate retention periods, we consider the nature, amount and sensitivity of the personal data, the purposes for which it is processed, applicable legal or regulatory requirements, relevant limitation periods and the potential risks associated with continued retention.
Different categories of personal data may therefore be subject to different retention periods.
Video Survey Data will generally be retained for up to 12 months from the date of collection, unless a different retention period is communicated to you at the time of collection or continued retention is reasonably necessary for a documented legal, regulatory or compliance purpose.
At the end of the applicable retention period, personal data will be securely deleted or, where appropriate, effectively anonymised. Information that has been effectively anonymised so that individuals are no longer identifiable may be retained and used for statistical, analytical and reporting purposes.
Where we process personal data in connection with the registration and use of an account on our website, we may retain your personal data for up to six years from the date that the relevant account is terminated (and in compliance with our data protection obligations). We may then destroy such files without further notice or liability.
Where we process any other personal data, we will retain relevant personal data for up to three years from the date of our last interaction with you (and in compliance with our data protection obligations). We may then destroy such files without further notice or liability.
If any personal data is only useful for a short period (e.g. for a specific activity, promotion or marketing campaign), we will not retain it for longer than the period for which it is used by us.
Where you opt out of receiving direct marketing, we may retain the minimum personal data necessary on a suppression list for as long as reasonably necessary to ensure that your marketing preference continues to be respected. Information held for this purpose will not be used to send you marketing communications unless you subsequently opt in or otherwise ask to receive them.
9. CONFIDENTIALITY AND SECURITY OF YOUR PERSONAL DATA
We are committed to keeping the personal data you provide to us secure and we have implemented information security policies, rules and technical measures to protect the personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss. Our security measures include encryption, firewalls, access controls, and regular security audits to protect your personal data from unauthorised access, disclosure, or loss.
In addition, all our employees and data processors (i.e. those who process your personal data on our behalf) are obliged to respect the confidentiality of the personal data of all users of our website and those who purchase our products and services.
10. YOUR RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:
- Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Rights relating to automated decision-making. Where we make a significant decision about you based solely on automated processing, including profiling, you may have rights and safeguards under applicable Data Protection Legislation. Where applicable, these safeguards include the ability to receive information about the decision, make representations about it, obtain human intervention and contest the decision. As explained in the "AI and Automated Processing" section above, our current use of AI to analyse Video Survey Data is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If a Personal Data Breach occurs, we will assess the risks arising from the breach and make any notifications required by applicable Data Protection Legislation. Where required, we will notify the ICO. Where a Personal Data Breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, subject to any applicable legal exceptions.
If you wish to exercise any of these rights set out above, please contact us.
You also have the right to make a complaint to the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection matters.
We would welcome the opportunity to consider and address your concerns directly, and you can contact our Compliance Lead where appropriate / Compliance Office using the details above. However, contacting us first does not affect your right to make a complaint to the ICO.
Current information about how to contact the ICO is available on the ICO's official website. You can find their contact details at https://ico.org.uk.
DATA PROTECTION COMPLAINTS
If you have concerns or wish to make a complaint about how we collect or use your personal data, you can contact our Compliance Lead at:
uk.governance@jcdecaux.com
You do not need to use a particular form or specific legal terminology to make a data protection complaint.
We will acknowledge receipt of your complaint within 30 days beginning with the day on which we receive it and will take appropriate steps to investigate and respond to your complaint without undue delay. We will keep you appropriately informed about the progress and outcome of your complaint.
Making a complaint to us does not affect any right you may have to raise your concerns with the Information Commissioner's Office.
NO FEE USUALLY REQUIRED
You will not normally have to pay a fee to exercise your data protection rights. However, where permitted by applicable Data Protection Legislation, we may charge a reasonable fee or refuse to act on a request where the relevant statutory threshold for doing so is met. If this applies, we will explain our decision and the reasons for it.
WHAT WE MAY NEED FROM YOU
We may request additional information where reasonably necessary to confirm your identity or, where someone is acting on your behalf, their authority to do so. This is intended to protect personal data from unauthorised disclosure.
Any identity verification measures we use will be reasonable and proportionate to the circumstances. Where possible, we will use information already available to us or existing authenticated communication channels rather than requesting additional identification documents.
We may also ask you for information reasonably necessary to help us understand or respond to your request.
TIME LIMIT TO RESPOND
We will respond to requests to exercise your data protection rights without undue delay and within the applicable statutory time limit.
For requests subject to the standard UK GDPR timeframe, we will generally respond within one month. In certain circumstances permitted by Data Protection Legislation, we may extend the response period by up to two further months, taking into account the complexity and number of requests. If an extension applies, we will inform you within the initial response period and explain the reason for the extension.
Where we reasonably require additional information to verify your identity or authority to make a request, this may affect the calculation of the applicable response period in accordance with Data Protection Legislation.
11. CHANGES TO THE PRIVACY NOTICE
We keep this Privacy Notice under regular review and may update it from time to time to reflect changes to our processing activities, legal requirements or regulatory guidance.
Where appropriate, we will notify you of material changes through our website, by email or through another appropriate communication method.
Last updated: 21/08/2026
