CUMULUS MEDIA, INC
INTERNET PRIVACY POLICY

PRIVACY POLICY CURRENT AS OF JUNE 15, 2020

CUMULUS MEDIA Inc. (“Cumulus,” “we,” “us,” or “our”) is dedicated to preserving your confidence and trust as it relates to the privacy of your information. Please read this policy so you understand how we collect, safeguard, use and share the information you provide to us through our technology platforms, including, without limitation, our websites, web pages, interactive features, applications, Twitter and Facebook pages, and Mobile Application (collectively the “Cumulus Platform”).

1. PRIVACY POLICY

   Your personal privacy is a principal concern to us at Cumulus. Our goal in outlining our policy on the collection and use of your information is to ensure the highest level of confidentiality and security. When you provide your personal information on any Cumulus Platform, we will not give or sell your personal information to any outside company for its use in marketing or solicitation without your permission, which may be express or implied. We will maintain the confidentiality of your personal information and it will be used only to support your customer relationship with our company and to assist us in providing better and more targeted services to you. Additionally, internal practices are in place to help protect your privacy by limiting employee access to and use of customer information. When we ask you to provide personal information through the Cumulus Platform, it is done with the goal of improving the relationship between you and Cumulus. At Cumulus, we allow you to maintain control over your personal information while attempting to provide a more interactive experience. Our intention is to send communications only those of you who have chosen to receive such communications. At any time, you have the right to decline receiving future communications from Cumulus in any manner, including email, text, social media, fax, telephone and postal mail.

2. INFORMATION COLLECTED THROUGH THE CUMULUS PLATFORMS

   When you utilize any Cumulus Platform, you do so anonymously. Personal information that could be used to identify you as an individual is not automatically collected. However, there are several ways in which information about you may be collected through the Cumulus Platform.

   1. Voluntary Disclosure: Some Cumulus Platforms may request that you voluntarily provide personal information for purposes such as correspondence, site registration, membership, making a purchase, or participating in contests or online surveys. Information that we may ask you to provide may include your name, email address, telephone number, mailing address, birth date, and payment information (such as account or credit card number). We may also request that you provide your preference information, social security numbers, lifestyle interests, and other demographic information that may be needed to register or subscribe you to services or offers.
   2. Device Identifier: Each time the Cumulus Platform is accessed, we or our service providers automatically collect your IP address or other unique identifier for the device (computer, mobile phone, tablet or other device) you use to access the Platforms (“Device Identifier”). Cumulus uses Device Identifiers to analyze trends, administer the site, track movements on the site, help identify you and your shopping cart, and gather broad demographic information for aggregate use. Device Identifiers are not linked to any other personally identifiable information by Cumulus.
   3. Usage Information: Whenever you access or interact with the Cumulus Platform, we, as well as any third party advertisers and/or service providers, may use a variety of technologies that automatically or passively collect information about how the Cumulus Platform is accessed and used (“Usage Information”). Usage Information may include device type, operating system, browser type, application version, the page accessed, the date and time, your use of features or applications, your preceding page views, and your interactions with friends and group activities. This information helps us maintain a platform that is up-to-date and to devise content that is responsive to your interests.
   4. Cookies, Mobile Analytics, and Pixel Tags: Like many other commercial technology platforms, the Cumulus Platform may use standard technologies such as cookies, mobile analytics software and pixel tags to collect Usage Information and Device Identifiers. Cookies are small text files on your system used for keeping track of settings or data for a particular website and can be used to store information necessary to provide a service or access into a site, including associating you with social networking sites like Facebook and Twitter and enable interactions between your activities on the Cumulus Platform and your activities on such social networking sites. We, or our vendors and third party partners, may place cookies or similar files on your Device for security purposes, to facilitate site navigation and to personalize your experience while visiting the Cumulus Platform, such as allowing us to select the ads or offers that are most likely to appeal to you based on your interests, preferences, location, or demographic information), as well as for market research related purposes. Any information that we may store in cookies is used for internal purposes only. You may turn cookies off through your browser or set your browser to notify you before accepting them. You can learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser.

    

   Your browser’s help menu or other instructions related to your browser will show you how to reduce the number of cookies you receive from us or delete cookies that have already been installed in your browser’s cookie folder. If you elect to disable or opt out of receiving cookies, please understand that some features and services on the Cumulus Platform may not work properly because we may not be able to recognize and associate you with your Cumulus account(s). Also, the offers we make available to you when you visit the Cumulus Platform us may not be as relevant to you or tailored to your interests.

   Pixel Tags are transparent graphic images, sometimes called web beacons or tracking beacons, that are placed on a web page or in an email to indicate that the page or email has been viewed. A pixel tag also may tell your browser to get content from another server.

3. HOW WE USE AND DISCLOSE THE INFORMATION WE COLLECT

   We collect only information that is needed, and we tell you how we use it. We limit the collection of information about you to what we need to know to manage your membership; provide customer service, including responding to your questions and communicating with you about your account and activities on the Cumulus Platform; make access to certain areas and features of the Cumulus Platform available to you; verify your identity; offer new products and services; notify you of changes to Cumulus policies; perform market research, analytics and operations; tailor content, advertisements, and offers we make available to you; improve the Cumulus Platform; fulfill any legal and regulatory requirements; and for purposes disclosed at the time you provide your Personal Information or otherwise with your consent. Under certain circumstances we may share location data with our third party partners for market research and other data analytics related purposes. We tell you about the general uses of information we collect about you, and we will provide additional explanation if requested. You may change, update or add additional information about yourself at any time through the Cumulus Platforms that offer this feature. If a Cumulus Platform does not currently provide this ability, you can still change your data profile by contacting your local radio station. All Cumulus Platforms will provide this feature in the near future.

   As a result of providing your personal information to us, the Cumulus Platform can provide a more customized experience, making your interaction with us more productive, helpful and fun, and will enhance the services and offers that we can bring to you. If you provide us with your email address or cell phone number, or have done so in the past, we may send you email or text offers or newsletters. These offers or newsletters are based on information you provided in your membership application, registration forms, surveys, or from information that may indicate purchasing preferences and lifestyle, as well as information available from external sources, such as census bureau data. These email/text offers will come from Cumulus only. Your information, email address or cell phone number is never sold to a third party. All offers are carefully developed to guarantee that they meet our standards. Our goal is to target offers that you will find to be of value to you. At any time, you may request to discontinue receiving these communications from us by simply replying to the email address or text number included in every email/text message that you receive from us.

   From time to time, we may offer contests or other promotions on the Cumulus Platform. If you enter a contest or sweepstakes, or participate in a promotional event, we will ask you to provide information about yourself (such as your name, address, and email address). Among other things, we will need this information to contact you if you win, and we may also use this information for marketing purposes. We may share this information with any sponsors and prize providers of the contest, sweepstakes, or promotional event; sponsors and prize providers will be identified in the official rules. We may also share this information with or other third party service providers that help administer our contests, sweepstakes, and promotional events, such as by conducting drawings, and/or delivering prizes to winners. If you do not want to provide the requested information or have the information provided to sponsors, prize providers, or other third party service providers, please do not enter the contest, sweepstakes, or participate in the promotional event.

   We monitor URL click-throughs found in our electronic communications. The click-through rate is reviewed in order to track (i) participation in contests and sweepstakes to judge effectiveness and award prizes; (ii) your interests and preferences; and/or (iii) response rates for marketing purposes or to report to a client in aggregate form only, the response of listeners. Individual activity is never shared with employees or third parties.

   At times, our clients might collect Personal Information about you on the Cumulus Platform or on-site at a retail locations or other Cumulus events. The collection of this information is clearly marked as information being collected by or for a third party, and providing such information is strictly voluntary. We may help facilitate the collection of the information by providing forms and collection boxes for the client. Sometimes this information is shared with us Cumulus, though we will only market to you if you have given us permission. Information gathered in this manner is shared with our client partners; and other information you may have previously provided to us remains private.

   We may share your Personal Information with third parties that perform functions on our behalf (or on behalf of our partners) such as service providers that host or operate the Cumulus Platform, analyze data, process transactions and payments, fulfill orders or provide customer service; advertisers; sponsors or other third parties that participate in or administer our promotions, surveys or provide marketing or promotional assistance and our partners in co-branded sites and promotions. Your Personal Information may also be used by us or shared with our subsidiaries, affiliates, sponsors, partners, advertisers or other third parties in connection with marketing, promotional, and other offers, as well as product information, and for such third party’s analytics and market research. The Cumulus Platform may include Nielsen’s proprietary measurement software which may allow you to contribute to market research. For more information, visit: http://www.nielsen.com/digitalprivacy .

   We may share your Personal Information with other entities and our affiliates primarily for business and operational purposes. In the event that we are involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, your information may be sold or transferred as part of that transaction. Additionally, we may transfer and disclose your information to third parties to comply with a legal obligation; when we believe in good faith that the law or a governmental authority requires it; to verify or enforce our Terms of Use or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect our rights or property or security of third parties, visitors to the Cumulus Platform or the public.

4. OTHER DISCLOSURES

   Third party platforms and services accessible through the Cumulus Platform have separate privacy and information collection practices, independent of us. Cumulus has no responsibility or liability for these independent policies or actions. You are solely responsible for maintaining your Personal Information, the secrecy of your passwords, membership ID, or any account information. Please be careful and responsible whenever you are online. If you post Personal Information online that is accessible to the public, you may receive unsolicited messages from other parties in return. While we aim to protect your personal information, Cumulus cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk. While we put forth our best efforts in adhering to these minimum privacy standards, additional restrictions may be imposed to comply with state and local laws, and/or station-specific programs, products and services.

5. INFORMATION WE RECEIVE FROM THIRD PARTIES

   We may receive information about you from third parties. For example, if you are on another website and you opt-in to receive information from Cumulus, that website will submit to us your email address and other information about you so that we may contact you as requested. You may also choose to participate in a third party application or feature (such as one of our Facebook or Twitter applications or a similar application or feature on a third party website) through which you allow us to collect (or the third party to share) information about you, including Usage Information, Device Identifiers, and Personal Information such as lists of your friends, “likes”, comments you have shared, groups and location. Services like Facebook Connect give you the option to post information about your activities on the Cumulus Platform to your profile page to share with others within your network. In addition, we may receive information about you if other users of a third party website give us access to their profiles and you are one of their “connections” or information about you is otherwise accessible through your “connections'” web page, profile page, or similar page on a social networking or other third party website or interactive service.

   We may also receive information about you from third party data providers. We may supplement the information we collect about you through the Cumulus Platform with such information from third parties in order to enhance our ability to serve you, to tailor our content to you and/or to offer you opportunities to purchase products or services that we believe may be of interest to you.

6. SECURITY

   Access to your Personal Information is limited to those who specifically need it to conduct their business responsibilities. We use security techniques designed to protect your Personal Information-especially information that is used by employees and business partners to provide services to you. In addition to providing you with the opportunity to refuse marketing offers, we release information only with your consent or at your requests, or when required to do so by law or other regulatory authority. When a court order or subpoena requires us to release information, we notify you directly so that you legal rights can be exercised, if appropriate. The only exceptions to this policy are when we are prohibited by court order or law from notifying you, or cases in which fraud and/or criminal activity is suspected. Finally, each Cumulus employee is personally responsible for maintaining listener and customer confidentiality. All Cumulus employees are required to sign an agreement that they will comply with these policies. Employees who violate these policies are subject to disciplinary action, up to and including termination of employment. Employees are expected to report violations-and may do so confidentially-to their managers or other supervisors. Each radio station has an employee who has been assigned the responsibility for assuring the adherence to Cumulus’s privacy policy. Check your local Cumulus Radio Website for this contact.

   While we take information security seriously, please understand that no electronic data transmission or storage of information can be guaranteed to be 100% secure. Therefore, we cannot ensure or warrant the security of any information you transmit to us or that you use the Cumulus Platform. You are providing your information to us at your own risk.

7. YOUR PRIVACY RIGHTS, CHOICE AND ACCESS

   You may always direct us not to share your Personal Information with third parties (other than our service providers), not to use your Personal Information to provide you with information or offers, or not to send you newsletters, emails or other communications by: (i) modifying your registered user information on the Cumulus Platform; (ii) sending us an email at privacy@cumulus.com; (iii) contacting us by mail at Cumulus Digital Department, 3280 Peachtree Road, Suite 2300, Atlanta, GA 30305; Attn: Customer Service; or (iv) following the removal instructions in the communication that you receive. Your opt-out request will be processed within 30 days of the date on which we receive it.

   If you wish to modify, verify, correct, or delete any of your Personal Information collected through the Cumulus Platform, you may edit your registered user information or contact us at the above address or email. In accordance with our routine record keeping, we may delete certain records that contain Personal Information you have submitted through the Cumulus Platform. We are under no obligation to store such Personal Information indefinitely and disclaim any liability arising out of, or related to, the destruction of such Personal Information. It may not always possible to completely remove or delete all of your information from our databases without some residual data because of backups and other reasons. We will retain your information (including geo-location data) for as long as your account is active or as needed to provide you services. If you wish to cancel your account or request that we no longer use your information to provide you services contact us at privacy@cumulus.com. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We do not control certain privacy settings and preferences maintained by our social media partners like Facebook and Twitter. If you wish to make changes to those settings and preferences, you may do so by visiting the settings page of the appropriate social media site.

8. ADVERTISING/BEHAVIORAL TARGETING; HOW TO OPT-OUT

   We may use third party ad network providers to help present ads on the Cumulus Platform, as well as other service providers to evaluate and provide us with information about the use of the Cumulus Platform and viewing of our content. Such providers may place and access cookies, pixel tags, or similar technologies on your Device to serve you ads or other content personalized to your interests which they infer from your browsing on the Cumulus Platform and other sites you have visited. In doing so, the provider collects or has access to non-Personal Information such as your Usage Information. The use of cookies, pixel tags, or similar technologies by these providers is subject to their own privacy policies, not ours.

   If you do not want to receive the benefits of targeted advertising, you may opt out of some network advertising programs that use your information by visiting the NAI Opt-Out Page. Please note that even if you choose to remove your information (opt out), you will still see advertisements while you’re browsing online. However the advertisements you see may be less relevant to you and your interests. Additionally, many network advertising programs allow you to view and manage the interest categories they have compiled from your online browsing activities. These interest categories help determine the types of targeted advertisements you may receive. The NAI Opt-Out Page provides a tool that identifies its member companies that have cookies on your browser and provides a mechanism to opt out of receiving cookies from those companies. Please note that if you opt-out of targeted advertising, we may still track your visits to the Cumulus Platform for our own analytics, operations and security purposes.

   We do not respond to web browser “do not track” signals. As such, your navigation of our website may be tracked as part of the gathering of quantitative user information. If you arrive at our website by way of a link from a third party site that does respond to “do not track” requests, the recognition of any “do not track” request you have initiated will end as soon as you reach our website.

9. PROTECTING THE PRIVACY OF CHILDREN

   Children should always get permission from their parents before sending any information about themselves (such as their names, email addresses, and phone numbers) over the Internet, to us or to anyone else. The Cumulus Platform is not directed at children under the age of 13 and we will not knowingly allow anyone under 13 to provide us any Personal Information. If you are under the age of 13, please do not provide any information about yourself to any Cumulus Platform.

10. PRIVACY RIGHTS FOR RESIDENTS OF CALIFORNIA ONLY

    The California Consumer Privacy Act of 2018 (“CCPA”) provides “consumers” (California residents) with specific rights regarding their “personal information”. This section describes your CCPA rights and explains how to exercise those rights.

    During the past twelve (12) months, we have collected the following categories of personal information from the listed sources, used it for the listed business purposes and shared it with the listed categories of third parties. The categories of information include information we collect from our customers, partners and website visitors, and any other person that interacts with us either online or offline. Not all information is collected about all individuals.

    Category of information collected	Source	Business purposes* for use	Categories of third parties receiving information
    Identifiers (name, email address, telephone number, mailing address, date of birth, lifestyle interests, “likes” and” preferences, comments you have shared and groups)	Individuals submitting information to us Information we may receive from third-party marketing and data partners.	Performing services for you including joining our clubs or accessing our streaming. Advertising customization. Auditing relating to transactions and contests. Internal research and development. Security detection, protection and enforcement. Functionality debugging, error and repair. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses and advertising partners.
    Sensitive information (invoicing data, payment information (such as account or credit card number), billing details, log-in details (membership ID, password and username)	Individuals submitting information to us. Information we may receive from third-party marketing and data partners.	Performing services for you. Auditing relating to transactions. Internal research and development. Security detection, protection and enforcement. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses.
    Commercial information (transaction history, products/services purchased, obtained or considered and product preferences)	Individuals submitting information to us. .	Performing services for you. Auditing relating to transactions. Internal research and development. Security detection, protection and enforcement. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses.
    Internet or other electronic network activity (IP address, web browser type and version, the operating system used and the domain name of your internet service provider, information about your visit, including pages you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page)	Information we automatically collect from website visitors. Information we may receive from third-party marketing and data partners.	Advertising customization. Internal research and development. Security detection, protection and enforcement. Functionality debugging, error and repair. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses.
    Geolocation	Information we automatically collect from website visitors. Information we may receive from third-party marketing and data partners.	Advertising customization. Auditing relating to transactions. Internal research and development. Security detection, protection and enforcement. Functionality debugging, error and repair. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses.
    Inferences from the above (preferences, characteristics, behaviour, attitudes and abilities, etc.)	Internal analytics. Information we may receive from third-party marketing and data partners.	Advertising customization. Auditing relating to transactions. Internal research and development. Security detection, protection and enforcement. Functionality debugging, error and repair. Quality control.	Service providers (such as those listed in Section 3). Affiliated companies. Government regulators. Law enforcement. Strategically aligned businesses.

    * The business purposes also include those listed at Section 3 of this policy.

    Sale of personal information

    In the preceding twelve (12) months, Cumulus may have sold the following categories of personal information:

    • Identifiers;
    • Commercial information;
    • Geolocation; and
    • Inferences from the above.

     

    Your rights and choices

    As of January 1, 2020, if you are a verified California resident, you have the right to obtain certain information about our collection and use of personal information over the past twelve (12) months, including:

    • The categories of personal information we collect;
    • The categories of sources of personal information we collect;
    • Our business purpose for collecting or sharing that personal information;
    • The categories of third parties with whom we share that personal information;
    • The specific personal information we have collected about you over the past twelve (12) months;
    • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
    • the categories of personal information sold and the category of third party recipients; and
    • list of the categories of personal information that we disclosed for a business purpose.

     

    You have the right to request that we do not sell personal information about you, and to request that we delete (and direct our service providers to delete) your personal information subject to certain exceptions.

    Personal information sales opt-out and opt-in rights

    If you are sixteen (16) years of age or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”). We do not sell the personal information of individuals we actually know are less than sixteen (16) years of age. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following page: Do Not Sell My Personal Information.

    Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales.

    Exercising your rights

    You may change, update or add additional information about yourself at any time through the Cumulus Platforms that offer this feature. If a Cumulus Platform does not currently provide this ability, you can still change your data profile by contacting your local radio station. You can also exercise any of these rights by contacting us using the contact details set out throughout this policy or you may submit a request to us by visiting the following page: Website Request Page. You may make a request up to twice within a twelve (12) month period. You may also call us on the following toll free telephone number: 855-849-0505.

    We will ask you for information that allows us to reasonably verify your identity (that you are the person about whom we collected personal information) and we will use that information only for that purpose. We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you.

    Response timing and format

    We will endeavour to respond within forty-five days of receipt of your request, but if we require more time (up to an additional forty-five days) we will notify you of the reason and extension period in writing.

    Where you request a copy of your personal information, we will endeavour to provide the information in a format that is readily useable, including by mailing you a paper copy or providing an electronic copy. Any disclosures we provide will only cover the twelve (12) month period preceding the receipt of you verified request.

    We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

    We will not discriminate against you as a result of your exercise of any of these rights.

11. CONSENT TO PROCESSING AND TRANSFER OF INFORMATION

    The Cumulus Platform is governed by and operated in, and in accordance with the laws of, the United States, and is intended for the enjoyment of residents of the United States only. We do not target the Cumulus Platform or any of our services at citizens located outside of the United States including, but not limited to, citizens of the European Union. Cumulus makes no representation that the Cumulus Platform is governed by or operated in accordance with the laws of any other nation. Given that we are an international business, our use of your information necessarily involves the transmission of data on an international basis. If you are located in the European Union, Canada or elsewhere outside of the United States, please be aware that information we collect may be transferred to and processed in the United States. By using the Cumulus Platform, or providing us with any information, you (a) acknowledge that the Cumulus Platform is subject to the laws of the United States, (b) consent to the collection, processing, maintenance and transfer of such information in and to the United States and other applicable territories in which the privacy laws may not be as comprehensive as or equivalent to those in the country where you reside and/or are a citizen, and (c) waive any claims that may arise under those laws.

12. CHANGES TO THIS PRIVACY STATEMENT

    Technology is an evolving medium. If we need to change this Privacy Policy at some point in the future, we will post the changes to this Privacy Policy on the Cumulus Platform and update the reference to the effective date to reflect the date of the amendment. By visiting the Cumulus Platform, you agree that your visit, and any dispute over privacy, is governed by this Privacy Policy.