PRIVACY NOTICE REGARDING PERSONAL DATA PROCESSING IN CALL CENTER

ACTIVITIES

under Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the „GDPR”)

Section I. INTRODUCTION

Dear business partners and clients,

The Mood Media Group of Companies (hereinafter referred to as “Mood Media”) hereby informs you of the processing of Personal Data (“PD”) for the audio recordings within the Mood Media Group, as well as of the rights you have according to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (hereinafter referred to as GDPR) 1 .

Mood Media undertakes to comply with the principles of Personal Data protection, as specified in the national and European legislation on the protection of Personal Data, as well as in the applicable Internal Policies and Procedures, to maintain the confidentiality of such Data and to process them only for the stated purposes, in accordance with this Privacy Notice.

The Mood Media Group of Companies is present both in the EU and outside the EU; the entities engaged in the processing of Personal Data for the calls recorded by Mood Media are listed in Annex 1 hereto (“Joint Controllers”).

Based on this Privacy Notice, we help you to understand how we process your personal data within Call Center activities, what categories of information we process, why we process them, how long we keep them and who can access those data, including your rights and how you can exercise them.

The Personal Data that are the subject of this document will be processed by the means and for the purposes established jointly by the Joint Controllers, as described below.

Section II. BASIC INFORMATION ON PD PROCESSING

     a) Data Subjects
Clients’ representatives/customer data
Employees of the Joint Controllers: Call Center operators/Agents

b) Categories of Personal Data
The personal data we process in the Call Center activities are those resulting from the audio recording (voice) and the data provided during the phone conversation:
Last and first name
Job title
Department
Location
E-mail address
Telephone number
The Joint Controllers do not record “special categories of data” as mentioned in the General Data
Protection Regulation (GDPR).

1 *Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such Data, and repealing Directive 95/46/EC.

     c) How we collect your personal data?
Call Recording
* For calls that we receive from you, before the telephone connection is established, the welcome message will mention that the call is recorded and you will be asked to express your consent for the call recording. Should you state your refusal to have the conversation recorded, the recording is to be immediately interrupted by our Agent, while the initial conversation until the time of manual interruption of the recording is to be subsequently erased.

Live Monitoring the call
* For calls that we receive from you, before the telephone connection is established, the welcome message will mention that the call is recorded and might be live monitored and you will be asked to express your consent for the call recording and live monitoring. Should you state your refusal to have the conversation recorded and/or live monitored, the recording and monitoring is to be immediately interrupted by our Agent, while the initial conversation until the time of manual interruption of the recording is to be subsequently erased.

Live monitoring the calls is made in specific circumstances related to the quality of services, probation period of the Agent or the performance of the employment contract.

Please note that Mood Media doesn’t live monitor the calls made by EU Clients.
Also, the outbound calls are not recorded or monitored.

     d) What should you do in case you do not agree with the call recording and/or monitoring the call?
In the event that you do not want your calls to be recorded and/or live monitored, please inform our Agent at the beginning of the conversation, after listening the welcome message. Once you express your refusal to have the conversation recorded or/and live monitored, the recording or/and monitoring is to be immediately interrupted by our Agent, while the initial conversation until the time of manual interruption of
the recording is to be subsequently erased as follows:
* the Agent will manually stop the recording and will continue the identification of the client and proceed further to the troubleshooting process
* at the end of the call, the Agent will notify the management team for deletion
* management team will proceed to deletion of the beginning of the call.

 e) How we use the Personal Data we collect. Purposes.
Personal Data will be used by Mood Media for the purpose of ensuring the clients’ service quality control, as well as for assessing the performance of the employees. The data may also be made available within the Joint Controllers for the purpose of training the employees in order to improve the overall quality of the clients’ service across the Mood Media Group. In particular, the activity of the employees providing support phone calls to EU and non-EU Clients is analysed by Mood Media. The analysis is made based on certain key performance indicators communicated to the employees during their induction training within the Company.

In order to achieve the purpose above, the processing operations consist mainly of:
• accessing the PD by the processors of the Joint Controllers,
• storing such PD in the physical archive (transcripts) or in electronic format, on the infrastructure of the Joint Controllers or of the processors of the Joint Controllers, if any,
• transferring PD within Mood Media, as well as to the third parties mentioned in letter i) below.

f) Legal ground of the processing
The legal ground of the processing is Art. 6 (1), letter a) from the GDPR – the data subject has given his/her consent for the processing of PD for one or several specific purposes, mentioned in Section II, letter e) above. The client is informed of the recording and monitoring of the call when a conversation is initiated and he/she has the option to exercise the right to object at any time as described in Section II,
letter d) above.

The use of personal data aforementioned for another purpose not related with the ones stated under letter e) above may be carried out only with the consent of the data subjects.

For the employees of Mood Media, who are subject of the recording operations, the legal ground is Art. 6 (1) letter f) – the legitimate interest of Mood Media to assess the performance of the employees and provide feedback.

 g) The data retention period of the records
The Personal Data is stored as follows:
* the audio recordings are stored for a period of 30 days, excepting the cases when the legitimate interest of Mood Media requires a longer period;
* after the expiry date, the audio recordings are automatically deleted;
* any call with a duration of less than 30 seconds will be automatically deleted.

h) Who can access the recordings?
The recorded calls can be accessed only by the Authorized Users in Mood Media assigned to verify and assess the calls, as listed in Mood Media’s internal policies and procedures, and/or by competent authorities.

i) Recipients or categories of recipients of Personal Data PD are transmitted between Joint Controllers/ within Mood Media Group. Excepting the Joint Controllers and TierPoint LLC, in its capacity as Processor, no other parties have access to or process the Personal Data. The transfer is made with the observance of conditions meant to secure the data and the recipients undertake technical and organisational measures necessary to protect the PD and to comply with the rights of data subjects, according to the law and the contractual commitments concluded.

j) International PD transfers
There may be international transfers of PD, respectively transfers to Joint Controllers located outside the EU. Regarding the international transfers to Joint Controllers located in the United States of America, we hereby inform you that such Controllers have adhered to the Privacy Shield, approved by the European Commission Implementing Decision on the adequacy of the protection of Data transfer (available at this link: https://eur-lex.europa.eu/legal-content/EN/TXT/uri=uriserv%3AOJ.L_.2016.207.01.0001.01.ENG). Under this decision, the United States guarantee the adequacy of protection of Personal Data transferred from the European Union to organisations in the United States, under the EU-US Privacy Shield, provided that such entities have adhered to the Privacy Shield mechanism.

Namely, the Mood US Entities listed here are registered under the Privacy Shield Framework. If at any point in time, any of the Mood US Entities ceases to be part of the Privacy Shield Framework or the Privacy Shield Framework is repealed, then such entities shall fall under the legal regime provided below for Mood Non-EU Entities.

With regard to international transfers to Joint Controllers located in countries outside the EU, other than the United States, such transfers will be regulated by standard contractual clauses regarding transfers between Personal Data controllers, as approved by the European Commission Decision 2004/915/EC (available at this link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0915 ).

Section IV. RIGHTS OF DATA SUBJECTS

Without prejudice to any other legal provisions, data subjects shall, in particular, have the following rights:
1. The right to be informed. This document informs you how we process your PD, in accordance with the provisions of Art. 13 of the GDPR. If you want to find out information regarding the processing other than that specified herein, please send us a request in this regard.
2. The right of access your PD, directly or indirectly collected from you. According to Art. 15 of the GDPR, you have the right to receive a confirmation of the processing of PD and, if necessary, to be informed about: the categories of Data processed, the purpose of the processing, possible recipients, the storage period, as well as information regarding your rights. You can also request a copy of your PD.
3. The right to rectification. In case you consider the Data in question as incorrect or incomplete (in such a case, additional information may be requested).
4. The right to erasure (the right to be forgotten), involves the deletion of your PD, without undue delay, with the exceptions provided by law. Data subjects have the right, at any time, to request the deletion of the PD that the Joint Controllers or their processors process for certain reasons However, a claim grounded on the right might be disregarded by the Controller if, for example, the PD are required to defend a right in court of the Controller.
5. The right to restrict the processing for a limited period. Under certain conditions provided by law, the data subject has the right to restrict the PD processing (for example: if the accuracy or correctness of the PD is challenged by the data subject). In such situations, the processing can only be carried out with the consent of the Data subject, with certain exceptions (for example: storage).
6. The right to Data portability. You have the right to receive, in a structured format, currently used and automatically readable, the Personal Data that you have provided to Mood Media and the right to transmit such data to another controller. This right can only be exercised in compliance with certain legal requirements.
7. The right not to be subject to a decision based solely on automated means, including on profiling. In this regard, we hereby inform you that Mood Media does not carry out automated decision-making processes of your PD.
8. The right to withdraw the consent at any time. Withdrawing your consent will not affect any prior processing.

Section V. EXERCISE OF THE RIGHTS BY DATA SUBJECTS

For any requests you may have regarding the exercise of the aforementioned rights and in order to address any other questions regarding the processing of Personal Data by Mood Media, you can send an email to the following addresses:
o For Mood Media Romania: [email protected]
o For Mood Media US entities: [email protected]
o For Mood Media EU and non-EU entities: [email protected]

Following the review of the request, you will receive a confirmation message that your request has been registered, as well as any other necessary information, as appropriate.

We will try to respond to the request within 30 days. However, the deadline can be extended depending on different aspects, such as the complexity of the request, the large number of requests received or the inability to identify you in a timely manner.
In case it is impossible to identify you, we may request the submission of documents certifying your identity as a data subject or copies thereof. If you do not provide the additional information, we cannot respond to the request.

Also, in the case of a personal data breach, you have the right to lodge a complaint with the Supervisory Authority for data protection issues, but also to address the issues to competent authorities.

Section VI. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

 a) Protection of personal data and security of information
Mood Media constantly maintains adequate technical and organizational security measures for protecting the personal data against accidental or unlawful destruction or accidental loss, deterioration, alteration, disclosure or unauthorized access especially when the processing involves sending data through a network, as well as against any other unlawful processing forms.

Mood Media implemented physical, electronic and procedural protection measures, in order to ensure the protection of personal data. Mood Media restricts the authorized access to personal data to the persons who have a legitimate purpose for accessing the relevant information, in order to provide products and services to clients and to the persons authorized by the client to have access to such information.

b) Protection of minors
The Personal Data do not include data from minors (below 16 years old). Mood Media shall not process the personal data of a natural person regarding whom they are aware that is below sixteen (16) years old. Mood Media does not knowingly request or collect personal data from children below sixteen (16) years old. However, should Mood Media find out that it received Personal Data from an individual mentioning, or about whom the company has reasons to believe that is below sixteen (16) years old, then Mood
Media shall erase such information from its systems. The relevant minor’s parent or legal guardian may request that the personal data regarding the child are erased from the files of Mood Media by sending an email containing such request to the following addresses:
o For Mood Media Romania: [email protected]
o For Mood Media US entities: [email protected]
o For Mood Media EU and non-EU entities: [email protected]

 c) Security measures for the personal data processed for the recorded phone calls
To secure the data, Mood Media undertook the following technical and organizational measures:
* Access to personal data is granted only to a limited number of Authorized Users (as defined in
the internal Policies and Procedures of Mood Media, such as the QA Specialists with specific responsibilities in this area, the Client Satisfaction Directors, the Supervisors working within departments which are subject to audio recordings, the Human Resources Managers, IT Managers, Key Account Managers working within departments which are subject to audio recordings);
*The authorized personnel undertake the obligation to keep the confidentiality regarding any type of personal data processing, by means of a document attesting this fact;
*The authorized personnel is trained with regard to security requirements, to the internal policies of the company and to the applicable laws regarding the fulfilment of duties and obligations incumbent on them in relation to personal data processing and the consequences of infringing upon such requirements;
* Each authorized user has a personal and unique identification code;
* The user ID is not and may not be assigned to another person;
* The information systems and the physical media on which personal data are stored are kept in a secured physical environment;
* The information systems are fit out with antivirus software and devices for detecting intrusions, in order to protect them against attacks, or other unauthorized actions targeting information systems. The antivirus software and the systems of detection of intrusions are regularly updated;
* The software, firmware and hardware used within the information systems are regularly checked, in order to detect and remove vulnerabilities and deficiencies of information systems;
* Audio recordings are AES 256 encrypted;
* All the employees of Mood Media signed the non-disclosure statement regarding personal data;
* It is not allowed to copy, download, erase or alter any recorded file, at one’s own initiative/without authorization.

d) The description and technical specifications of the system
The recording and transmission of personal data are made through a specialized software, licensed from a third party and installed on the Agents’ computers (“Zeacom Software & QMS Software”). The recorded data is protected by two layers of security:
* the Active Directory of the Windows Operating System which allows the access of Authorized users to the records of the Zeacom Software and,
* the Zeacom Software which encrypts the recorded data in order to prevent the unauthorized access.

Quality Management Suite (QMS) is a suite of call recording and quality management applications designed to provide organizations with robust, secure and dependable recording of inbound, outbound and internal communications. QMS contains all the necessary features which allow Mood Media to protect and secure personal data.

Section VII. ADDITIONAL INFORMATION ON PD PROCESSING

 a) Source of Personal Data
Personal Data may be initially collected by one or several Joint Controllers. Subsequently, they are transmitted to one or several Joint Controllers, for meeting the purposes described in Section II, letter e) above in the context of group reporting and analysis.

 b) Automated decision-making and profiling
The above-mentioned personal data will not be the object of an automated decision-making process, such as profiling.

Section VIII. CONTACT DETAILS OF MOOD MEDIA REGARDING PERSONAL DATA PROCESSING

a) Contact details
If you have any questions about this Privacy Notice or how we handle your personal information, please send an e-mail to the following addresses:
o For Mood Media Romania: [email protected]
o For Mood Media US entities: [email protected]
o For Mood Media EU and non-EU entities: [email protected]

b) Identification details of the Joint Controllers/Mood Media entities – Annex 1
See the list below.

1. Convergence, LLC, USA
2. DMX Holdings, LLC, USA
3. DMX Residential Holdings, LLC, USA
4. DMX Residential, LLC, USA
5. DMX, LLC, USA
6. Mood Media North America Holdings Corp., USA
7. Mood Media North America, LLC, USA
8. Mood US Acquisition1, LLC, USA
9. Muzak Capital, LLC, USA
10. Muzak Holdings LLC, USA
11. Muzak LLC, USA
12. ServiceNET Exp, LLC, USA
13. Technomedia NY, LLC, USA
14. Technomedia Solutions, LLC, USA
15. Mood Austria – Mood Media GmbH, AUSTRIA
16. Mood Belgium – Mood Media Belgium SA, BELGIUM
17. Mood CZ – Mood Media Group CZ sro, CZECH REPUBLIC
18. Mood DK – Mood Media A/S, DENMARK
19. Mood Finland – Mood Media Finland OY, FINLAND
20. Mood France – Mood Media SAS, FRANCE
21. Mood Germany – Mood Media GmbH, GERMANY
22. Mood Greece – New Audio Visual Solutions and Applications Ltd, GREECE
23. Mood NL – Mood Media Netherlands BV, NETHERLANDS
24. Mood Hungary – Mood Media Hungary KFT, HUNGARY
25. Mood Ireland – Mood Media Ireland Limited, IRELAND
26. Mood Poland – Mood Polska Sp. Z.o.o. ul., POLAND
27. Mood Media RO – S.C. Mood Media Romania S.R.L., ROMANIA
28. MMC Romania – Mood Media Comercial S.R.L., ROMANIA
29. Mood Spain – Instore Márketing Solutions, SPAIN
30. Mood Sweden – Mood Media Aktiebolag (AB), SWEDEN
31. Mood UK – Mood Media Limited, UK

We will keep you informed if any changes or updates to the aforementioned list will occur. This information is provided in addition to the Privacy Policy available at:
https://us.moodmedia.com/company/privacy-policy/