1. Important information and who we are
What this notice covers
It describes how OOH Global collects and uses personal data through this website, including data you provide in a form, an email or a call. It sits alongside any extra notice we give you at the time we collect data for a specific purpose. If there is a conflict, the specific notice prevails for that purpose.
This website is not aimed at children, and we do not knowingly collect personal data from anyone under 18. If you believe we have, email us and we will delete it.
Controller
OOH Advertising Requisites Trading L.L.C., trading as OOH Global, is the controller.
Questions and requests to exercise your rights: info@outofhomeglobal.com.
You can write to any of the offices below.
Dubai
OOH Global MENA
The Binary by OMNIYATBusiness BayDubai, United Arab Emirates+971 4 555 3005London
OOH Global UK
South Molton StreetLondon W1K 5RJUnited Kingdom+44 20 8003 2827New York
OOH Global US
260 Madison AvenueNew York, NY 10016United StatesSingapore
OOH Global SG
IOI Central BoulevardLevel 32Singapore+65 6860 0495
Changes
We review this notice when our practices or the law change. The version and date at the top of the page show the current revision. Please keep the details we hold about you accurate, and tell us if they change.
Third-party links
The site may link to other websites, plug-ins or applications. If you follow a link, that site's own privacy notice applies. We do not control those sites.
2. The data we collect about you
Personal data means information that identifies a living person, directly or indirectly. It does not include data that has been anonymised so that identification is no longer possible.
We may collect and use:
- Identity data — first name, last name, job title and company.
- Contact data — email address, telephone number and dial code, and billing or delivery details you give us.
- Enquiry data — the markets, timing, message and other campaign details you submit in a form or a brief.
- Technical data — IP address, browser type and version, time zone, operating system, device identifiers and similar technical information.
- Usage data — how you use the website, such as pages viewed, referring page and approximate location derived from your IP address.
- Marketing and communications data — your choices about hearing from us, and records of emails or calls about an enquiry or campaign.
We also use aggregated data, such as the share of visitors who open a particular page. Aggregated data is not personal data unless we combine it with data that can identify you. If we do that, we treat the combination as personal data.
We do not ask you to send special-category data (for example health, religion or biometrics) through this website. Please do not include it in a form or brief.
If you do not provide data
Where we need personal data to respond to an enquiry or to perform a contract, and you do not provide it, we may not be able to proceed. We will tell you if that is the case.
3. How is your personal data collected?
We collect personal data in three ways.
Directly from you
You give us identity, contact and enquiry data when you:
- submit a contact or media-plan form;
- email, call or otherwise write to us;
- brief us on a campaign, or negotiate a booking;
- give feedback.
Automatically
As you use the site we collect technical and usage data using cookies, server logs and similar technologies, including Google Tag Manager. Optional analytics tools (Google Analytics and Microsoft Clarity) run only if you accept them. See Cookies.
From other sources
We may receive data from:
- analytics providers, where you have accepted analytics cookies;
- a colleague who names you as the contact on a brief;
- media owners or production partners, where a booking requires them to hold a contact;
- publicly available business sources, such as a company website, where we need a business contact for a live enquiry.
4. How we use your personal data
We use personal data only where the law allows it. The grounds we rely on are:
- Contract — the processing is needed to take steps you ask for before a contract, or to perform a contract with you;
- Legitimate interests — the processing is in our interests, or those of a client or media owner, and your rights do not override those interests;
- Legal obligation — the processing is needed to comply with a law that applies to us;
- Consent — you have agreed, for example to optional cookies or to a marketing email where consent is required. You can withdraw consent at any time.
We rely on consent for non-essential cookies and for electronic marketing where the law requires consent, including direct marketing email to people in the UK and the EEA who are not existing clients. We rely on legitimate interests for responding in a business context, securing the site, and understanding aggregated traffic once any required consent is in place. We rely on contract for preparing and delivering a campaign you have asked for.
Purposes
| Purpose | Data | Legal basis |
|---|---|---|
| To answer an enquiry, prepare a media plan and set up a campaign | Identity, contact, enquiry | Contract; legitimate interests (responding to a business enquiry) |
| To manage the relationship, including service messages, invoices and proof of posting | Identity, contact, enquiry, communications | Contract; legal obligation; legitimate interests |
| To run the website, keep it secure and remember your cookie choice | Technical, usage | Legitimate interests (security and a working site) |
| To measure how the site is used and improve it | Technical, usage | Consent (analytics cookies) |
| To send a marketing email about our services | Identity, contact, communications | Consent where the law requires it; otherwise legitimate interests in telling existing contacts about similar services, with an opt-out in every message |
| To meet a legal duty, or respond to a court, regulator or law-enforcement request | Any relevant category | Legal obligation |
How we may contact you
If you enquire or book, we contact you by email or telephone about that enquiry or campaign. We do not send SMS or WhatsApp marketing as a standard channel. Promotional email is sent only with your consent where that consent is required, or, where the law allows, as a message about services related to a relationship we already have with you. Every marketing email includes a way to opt out. You can also email us and ask us to stop.
We do not sell your personal data. We do not share it with an outside company for that company's own marketing unless you have agreed.
A new purpose
We will use personal data only for the purposes above, or for a purpose that is compatible with them. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis.
5. Disclosures of your personal data
We share personal data with the parties below for the purposes in How we use your personal data. We require them to protect it and, where they are processors, to use it only on our instructions.
- Media owners and production partners in the countries on a campaign, so the booking can be made, produced and posted. They are independent controllers of what they need for their own legal and operational duties.
- Service providers who host the website, receive enquiry forms, send email, provide security (including Google reCAPTCHA) and, if you accept, measure the site (Google Analytics and Microsoft Clarity, loaded through Google Tag Manager).
- Group companies and staff in our Dubai, London, New York and Singapore offices, where someone in that office is handling the enquiry or the campaign.
- Professional advisers such as lawyers, auditors, bankers and insurers.
- Authorities where the law requires a disclosure, or where we need to protect our rights, our clients or others.
- A buyer or successor if we sell or restructure the business. The new owner would use personal data as this notice describes.
We do not allow a service provider to use personal data from this website for its own purposes. We do not place data collected on this website into a mobile application on your device.
6. International transfers
We are established in the United Arab Emirates and we also work from the United Kingdom, the United States and Singapore. Media owners and suppliers sit in the country where a campaign runs. Your personal data may therefore be stored or accessed in a country other than your own, including the UAE, the UK, the US, Singapore and the market the booking relates to.
Those countries do not all offer the same level of legal protection. Where the UK GDPR or the EU GDPR requires a transfer tool, we use a recognised mechanism such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, and we add extra measures where a risk assessment shows they are needed. Where the UAE Personal Data Protection Law requires a safeguard for a transfer out of the UAE, we use the mechanism that law requires.
You can ask for a summary of the safeguard we use by emailing info@outofhomeglobal.com.
8. Data security
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls limited to people who need the data, vendor checks for processors, and a process for suspected personal-data breaches.
No website or email channel is perfectly secure. Please do not send passwords or payment-card numbers through the enquiry form.
Where the law requires it, we will notify the relevant authority and, if the risk to you is high, the people affected. In the UAE that authority is the UAE Data Office. In the UK it is the Information Commissioner's Office. In the EEA it is the lead supervisory authority for the processing.
9. Data retention
We keep personal data only for as long as we need it for the purpose we collected it, including any accounting, tax or legal period that applies. To set that period we look at the amount and sensitivity of the data, the harm that misuse could cause, whether we can achieve the purpose another way, and the legal minimums.
Typical periods
| Information | How long we keep it | Then |
|---|---|---|
| Enquiry contacts who do not become a client | Up to 24 months from the last contact | Deleted or anonymised |
| Client contacts and campaign files | For the life of the relationship, then up to 3 years | Deleted or archived, then deleted |
| Invoices and accounting records | For the period required by the tax and accounting rules that apply to that invoice, commonly 5 to 7 years | Deleted |
| Email and call history about a campaign | For the life of the campaign, then up to 2 years | Deleted |
| Website analytics | Up to 14 months in our analytics configuration | Expires or is deleted by the provider |
| Cookie choice | 1 year | Replaced when you choose again, or deleted when it expires |
We may keep anonymised statistics indefinitely. You can ask us to delete personal data earlier where the law gives you that right. See Your legal rights.
10. Your legal rights
Depending on where you are, and which law applies, you can ask us to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- delete data where we have no lawful reason to keep it, or where you withdraw consent and we have no other basis;
- restrict processing while a request is being checked;
- object to processing based on legitimate interests, and to direct marketing at any time;
- port data you provided, where the processing is based on consent or contract and is carried out by automated means, and receive it in a structured, commonly used format;
- withdraw consent where we rely on consent. Withdrawal does not affect processing that was already lawful.
Under the UAE Personal Data Protection Law you may also object to automated decisions that produce legal effects, and you may complain to the UAE Data Office. Under the UK GDPR or EU GDPR you may complain to the Information Commissioner's Office or to your local European supervisory authority. We would like the chance to put things right first, so please contact us before you complain.
We do not sell personal information, and we do not share it for cross-context behavioural advertising except through the optional cookies described above, which you can refuse.
No fee, usually
We do not charge for a reasonable request. We may charge a reasonable fee, or refuse, if a request is unfounded, repetitive or excessive.
Confirming it is you
We may ask for information to confirm your identity before we release or change data. That is to stop us disclosing it to the wrong person.
Timing
We aim to respond within one month. A complex request, or several requests at once, can take longer. If a shorter deadline applies under the law that covers your request, we will meet that deadline. We will tell you if we need more time.
11. Glossary
Controller
— the organisation that decides why and how personal data is processed. For this website, that is the company named in this notice.
Processor
— a supplier that processes personal data only on a controller's instructions.
Legitimate interests
— our interest in running and protecting the business, answering business enquiries and improving the site, after we have balanced that interest against your rights.
Contract
— processing needed to take steps at your request before we enter a contract, or to perform a contract with you.
Legal obligation
— processing needed to comply with a law that applies to us.
Consent
— a freely given, specific, informed and unambiguous agreement to processing. You can withdraw it at any time.
UAE Personal Data Protection Law
— Federal Decree-Law No. 45 of 2021, and the regulations made under it.
UK GDPR / EU GDPR
— the General Data Protection Regulation as it applies in the United Kingdom, and Regulation (EU) 2016/679 in the European Economic Area.
A fuller description of your rights is in Your legal rights.
