This privacy statement was last updated on 23/09/2025 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.
In this privacy statement, we explain what we do with the data we obtain about you through https://www.granadanoticias.com. We recommend that you read this statement carefully. In our processing, we comply with the requirements of privacy legislation. This means, among other things, that:
we clearly state the purposes for which we process personal data. We do this through this privacy statement;
we aim to limit our collection of personal data to only the personal data necessary for legitimate purposes;
we first ask for your explicit consent to process your personal data in cases requiring your consent;
we take appropriate security measures to protect your personal data and also require this of parties that process personal data on our behalf;
we respect your right to access your personal data or to have it corrected or deleted, at your request.
If you have any questions or want to know exactly what data we keep about you, please contact us.
1. Purpose, data, and retention period
We may collect or receive personal information for a range of business-related purposes, which may include the following: (click to expand)
1.1 Collection and analysis of statistics for website improvement
For this purpose we use the following data:
IP address
Geolocation data
The basis on which we may process these data is:
Retention period
The maximum time Google Analytics retains the data is 2 years.
1.2 Registration and management of the premium subscription
For this purpose (to be able to offer and manage the service associated with your subscription) we use the following data:
Email address
The basis on which we may process these data is:
The performance of a contract or provision of a service requested by the user.
Retention period
We determine the retention period according to objective criteria established: While the subscription remains active and, thereafter, for the legal limitation periods for possible liabilities.
2. Cookies
Our website uses cookies. For more information about cookies, please see our Cookie Policy.
3. Disclosure practices
We disclose personal information if the law or a court order requires us to do so, in response to a law enforcement agency, to the extent permitted by other legal provisions, to provide information, or for an investigation into a matter related to public safety.
If our website or organization is acquired, sold, or involved in a merger or acquisition, your data may be disclosed to our advisers and any potential buyer and will be transferred to the new owners.
We have entered into a Data Processing Agreement with Google.
4. Security
We are committed to the security of personal data. We take appropriate security measures to limit misuse and unauthorized access to personal data. This ensures that only the necessary people have access to your data, that access to data is protected, and that our security measures are reviewed regularly.
5. Third-party websites
This privacy statement does not apply to third-party websites connected by links on our website. We cannot guarantee that these third parties will handle your personal data in a reliable or secure manner. We recommend that you read the privacy statements of these websites before using them.
6. Amendments to this privacy statement
We reserve the right to make amendments to this privacy statement. We recommend that you review this privacy statement periodically to stay informed of any changes. In addition, we will actively inform you whenever possible.
7. Access to and modification of your data
If you have any questions or want to know what personal data we hold about you, please contact us. You can contact us using the following information. You have the following rights:
You have the right to know why your personal data is needed, what will happen to it, and how long it will be retained.
Right of access: you have the right to access your personal data that we know about.
Right to rectification: you have the right to supplement, correct, delete, or block your personal data whenever you wish.
If you give us consent to process your data, you have the right to revoke that consent and have your personal data deleted.
Right to data portability: you have the right to request all your personal data from the controller and transfer it in its entirety to another controller.
Right to object: you may object to the processing of your data. We comply with this unless there are justified grounds for the processing.
Please make sure to always clearly indicate who you are, so that we can be sure we do not modify or delete any data belonging to the wrong person.
8. Filing a complaint
If you are not satisfied with the way we handle (a complaint about) the processing of your personal data, you have the right to file a complaint with the Data Protection Authority.
9. Contact details
Marc Navarro Bros, legal representative of the communications agency OlesaMèdia.
Carrer República Argentina, 12, bajos, Olesa de Montserrat (08640), Barcelona, Catalonia.
Spain
Website: https://www.granadanoticias.com
Email: [email protected]
Phone: 930 306 123
10. Processing of Personal Data of Opinion Authors
This section specifically regulates the processing of personal data of people who register as opinion authors in our media outlet, Granada Noticias.
10.1 Data processed and method of collection
To register an opinion author in our system, the interested person must send an email to [email protected] including the following declaration of express consent, duly completed:
I, [First and Last Name], with ID/NIE [Document number], expressly authorize Granada Noticias to register me in its system with my name, surname, and the photograph I attach, in order to publish my opinion articles.
The personal data processed in this context are:
First and last name
ID/NIE number (solely for identity verification purposes at the time of registration; it will not be published or shared with third parties)
Profile photo provided by the interested person
10.2 Purpose of processing
The personal data indicated — first name, surname, and profile photo — are used exclusively to identify and sign the opinion articles published in our media outlet in a transparent manner, ensuring the correct attribution of authorship for each piece. They will under no circumstances be used for advertising or marketing purposes, nor shared with third parties for any other purpose.
10.3 Editing of the profile photo
The photograph provided by the author may be edited by Granada Noticias professionals solely for the purpose of adapting it to the visual and aesthetic format of our media outlet. These adaptations may include, among others, changing the background of the image (for example, replacing it with a plain white background) or altering the color of the image (for example, converting it to black and white). Under no circumstances will modifications be made that alter the identity or image of the person in a misleading or disparaging way.
10.4 Legal basis for processing
The legal basis for processing these data is explicit and unequivocal consent of the interested person (Art. 6.1.a GDPR), expressed by voluntarily sending the email with the authorization statement indicated in point 10.1.
10.5 Retention period
The author's personal data — first name, surname, and photo — will be retained while the person maintains their status as an active author in our media outlet, or until they exercise their right to withdraw consent, as indicated in point 10.6.
10.6 Right to withdraw consent and delete data
The author may revoke at any time the consent granted for the use of their personal data by contacting us at the following email address: [email protected]
Once the request has been received and the identity of the applicant has been verified, we will proceed to:
Delete the profile photo from our system
Remove the first and last name associated with the author profile
This deletion will be carried out within the legally established timeframes and irreversibly, unless there is a legal obligation that prevents or conditions such deletion.
Detail of personal data processing: collection, purposes, and rights
1. Categories of Personal Data Collected and Methods of Collection (Detailed Information)
In addition to the general information about the data we obtain, we detail below the categories of personal data we may collect and the methods by which we obtain them:
a) Identification and Contact Data Voluntarily Provided by You:
This includes, among others, your first name, last name, email address, phone number, postal address, or other similar data that you provide directly when:
You contact us through the website forms, by email, phone, or any other means.
You subscribe to our newsletters or mailing lists.
You post comments or participate in forums or other interactive areas of the website.
You participate in surveys, promotions, or contests.
b) Browsing Data Automatically Collected During Use of the Website:
When you visit and browse our website, we automatically collect certain information about your device and browsing activity. This information may include:
IP address: The Internet Protocol address of your device (which may be processed in anonymized or truncated form, depending on the settings of our analytics services and your consent).
Device and browser information: Browser type and version, preferred language, device type (computer, mobile phone, tablet), operating system, device manufacturer, screen resolution.
Website usage data: Pages visited within our site, time spent on each page, dates and times of access, clicked links, referral URLs (the website from which you came to ours), search terms used to find us.
Approximate geographic location: Derived from your IP address, for statistical purposes or to personalize certain content (always with your consent if precision is required).
c) Data Collected Through Cookies and Similar Technologies:
As mentioned in point 1, we use cookies and other tracking technologies (such as pixels, web beacons, scripts) to collect information about your preferences, your use of the website, and your interaction with content and ads. This may include unique identifiers assigned to your device or browser. For a comprehensive explanation, please see our separate Cookie Policy and the corresponding point regarding Google AdSense in this statement.
d) Other Voluntarily Provided Data:
Any other information you choose to provide to us voluntarily through free-text forms, surveys, customer service interactions, or other communication channels.
2. Specific Purposes of Processing and Applicable Legal Bases (Detailed Information)
In line with our commitment to clearly state the purposes, below are detailed the specific purposes for which we process your personal data and the legal bases that legitimize each processing activity:
a) Providing you with our services and informational content: Includes operating and maintaining our website, displaying news, articles, reports, and local events.
Legal Basis: The performance of a service that you request by accessing and using our website (Art. 6.1.b GDPR) and our legitimate interest in disseminating information of public interest and maintaining our journalistic activity (Art. 6.1.f GDPR).
b) Managing your inquiries, requests, and comments: Responding to your questions, handling your requests for information, or managing the comments you post.
Legal Basis: Your explicit consent when submitting the inquiry or comment (Art. 6.1.a GDPR) and, where applicable, the performance of pre-contractual or contractual measures if your request is related to a service (Art. 6.1.b GDPR).
c) Sending you informational communications and newsletters: Keeping you informed about updates, featured articles, or relevant information, only if you have explicitly subscribed.
Legal Basis: Your explicit consent (Art. 6.1.a GDPR). You may revoke this consent at any time by following the instructions provided in each communication or by contacting us.
d) Improving the website, our services, and your browsing experience: Analyzing how users interact with our website, carrying out aggregated statistical analyses, identifying areas for improvement, and optimizing the design, functionality, usability, and performance of the site.
Legal Basis: Your explicit consent (Art. 6.1.a GDPR), obtained through the website cookie banner.
e) Displaying personalized advertising and measuring its performance (Google AdSense and other networks): Presenting ads relevant to your interests, based on your browsing behavior and preferences, and measuring the effectiveness of these advertising campaigns. This may involve creating user profiles for these advertising purposes.
Legal Basis: Your explicit consent (Art. 6.1.a GDPR), managed through our Consent Management Platform (CMP) and your cookie preferences.
f) Ensuring website security and preventing fraud: Protecting our systems, detecting and preventing fraudulent activities, abuse, or misuse of our website.
Legal Basis: Our legitimate interest in protecting our assets and the integrity of our services (Art. 6.1.f GDPR) and, in some cases, compliance with a legal obligation (Art. 6.1.c GDPR).
g) Complying with legal obligations and judicial requirements: Responding to requests from competent authorities, courts, or complying with other legal obligations to which we are subject.
Legal Basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
3. Detailed Use of Cookies for Advertising, Google AdSense, and Preference Management
As previously mentioned (Point 1), we use cookies and similar technologies. This section details their use specifically in the context of advertising, including Google AdSense:
a) Google AdSense and Third-Party Advertising Providers:
We use Google AdSense, an advertising service of Google LLC or its affiliates, to display ads on our website. Google, as a third-party provider, uses cookies (such as Google’s advertising cookie, formerly DoubleClick DART) to display relevant ads to users based on their visits to our site and other sites on the Internet.
Other third-party providers or advertising networks may also use cookies, web beacons, or similar technologies to display personalized ads and measure their effectiveness. These third parties collect data directly from your web browser and the processing of this data is subject to their own privacy policies.
b) How Google and Its Partners Use the Data:
Google and its advertising partners use the collected information (which may include cookie identifiers, IP addresses, and information about your browsing behavior) to:
Personalize the ads shown to you.
Limit how often you see a particular ad.
Measure the effectiveness of advertising campaigns.
Combat fraud and abuse.
You can find detailed information about how Google collects, uses, and protects your data in the context of advertising, and how you can control the information sent to Google, by consulting its policy: “How Google uses information from sites or apps that use our services” (accessible at https://policies.google.com/technologies/partner-sites?hl=ca or the updated URL provided by Google). We strongly recommend reading this information.
c) Options for Managing Personalized Advertising (Opt-Out):
You have several options to manage and limit personalized advertising:
Consent Management Platform (CMP): You can adjust your cookie consent preferences, including advertising cookies, at any time through the cookie management tool available on our website.
Google Ads Settings: You can customize the types of Google ads you see or disable ad personalization by visiting the Google Ads Settings.
Industry Self-Regulatory Advertising Initiatives: You can learn more and opt out of interest-based advertising from many third-party advertising networks through websites such as:
Please note that opting out of personalized advertising does not mean you will not see ads, but that the ads you see may be less relevant to your interests.
d) Cookie Policy: For complete information about all the cookies we use (essential, performance, functional, advertising), their purposes, duration, and how to manage them, please see our Cookie Policy (link to your cookie policy).
4. Retention Periods for Personal Data
Your personal data will be retained for as long as strictly necessary to fulfill the purposes for which it was collected, or while you do not revoke your consent (when consent is the legal basis for processing) or request its deletion or restriction, and always provided that there is no legal obligation requiring retention for a longer period.
The criteria we use to determine retention periods are:
The purpose of the processing: The data will be retained as long as they are necessary for the specific purpose. For example, data for newsletter subscription will be retained while you remain subscribed.
Legal obligations: In certain cases, we are required to retain certain data for periods established by law (for example, for tax or accounting obligations, or for defense in legal proceedings).
Revocation of consent or exercise of rights: If you revoke your consent or exercise your right to deletion, your data will be deleted or anonymized, unless there is another legal basis or obligation that allows or requires us to retain it.
Browsing data and cookies: These data have specific retention periods detailed in our Cookie Policy. Some cookies are retained only for the session, while others may persist for longer periods.
Once the personal data are no longer necessary for the indicated purposes, or the legal retention period has expired, they will be securely deleted or irreversibly anonymized.
5. Additional Data Recipients and Possible International Transfers
In line with what is indicated in the section on Disclosure practices of this policy and in order to provide more detail, your personal data may be disclosed to the following recipients or categories of recipients, in addition to the aforementioned cases of legal requirement or merger/acquisition processes:
a) Service Providers (Processors):
We may share your data with third-party companies that provide services to us and act as processors on our behalf. These providers will only have access to the personal data necessary to carry out their services and are contractually required to keep your data confidential and not use it for purposes other than those agreed with us.
These providers may include web hosting companies, data analytics service providers (such as Google Analytics), electronic communications delivery platforms, cookie consent management service providers (CMP), technical maintenance services, etc.
We have entered into the corresponding data processing agreements with these providers, in accordance with Article 28 of the GDPR.
b) Advertising Partners and Advertising Networks:
We share information (mainly through cookies and similar identifiers, and always with your consent) with advertising partners such as Google (through AdSense) and other advertising networks. These partners may collect information to display personalized advertising and measure its effectiveness, and may act as independent or joint controllers for these purposes. Please refer to their own privacy policies.
c) Competent Public Authorities:
We may disclose your personal data to judicial, administrative, police, or other competent public authorities if required by law, a court order, or if necessary for the investigation of unlawful activities or to protect public safety, as indicated in the Disclosure practices section.
d) International Data Transfers:
Some of the recipients mentioned, especially large technology providers and advertising networks (such as Google), may be located in or process data outside the European Economic Area (EEA).
When these international data transfers take place, we ensure that they are carried out with appropriate safeguards to protect your personal data, in accordance with the GDPR. These safeguards may include:
Transfer to countries that have been declared by the European Commission to have an adequate level of data protection.
The use of Standard Contractual Clauses (SCCs) approved by the European Commission, signed with the data recipient.
In the case of transfers to the U.S., the possible adherence of the recipient to recognized adequacy frameworks (such as the former Privacy Shield or future frameworks that replace it and are validated by European authorities).
Other mechanisms permitted by the GDPR, such as binding corporate rules or specific exceptions.
The data processing agreement we have entered into with Google, mentioned in the Disclosure practices section, covers these aspects for the data processed by Google on our behalf.
6. Expansion and Detail of User Rights and Specific Exercise Channels
In addition to the rights already mentioned in Point 6 (“Access to and modification of your data”), you, as the data subject, have the following additional rights and/or specifications on how to exercise them:
Right to Know: Right to know why your personal data is needed, what will happen to it, and how long it will be retained.
Right of Access: Right to obtain confirmation of whether we are processing your personal data and, if so, to access a copy of that data and additional information about the processing.
Right to Rectification: Right to request the correction of your personal data if it is inaccurate, or to have it completed if it is incomplete.
Right to Erasure (“Right to Be Forgotten”): Right to request the deletion of your personal data when, among other reasons, it is no longer necessary for the purposes for which it was collected, you have withdrawn your consent (and the processing is not based on another legal basis), you object to the processing, the data have been unlawfully processed, or must be erased to comply with a legal obligation.
Right to Restriction of Processing: Right to request the restriction of the processing of your data in certain circumstances, such as:
While the accuracy of your data is being verified (if you have contested it).
If the processing is unlawful and you oppose the deletion of the data and instead request restriction of its use.
If we no longer need the data for the purposes of processing, but you need them for the establishment, exercise, or defense of legal claims.
If you have objected to processing, while it is being verified whether our legitimate grounds override yours.
Right to Data Portability: Right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller without hindrance from us, provided that the processing is based on your consent or on a contract, and is carried out by automated means.
Right to Object: Right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on public interest or our legitimate interest, including profiling. We will stop processing the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. If the data are processed for direct marketing purposes, you have the right to object at any time.
Right Not to Be Subject to Automated Individual Decisions: Right not to be subject to a decision based solely on automated processing of your data, including profiling, which produces legal effects concerning you or significantly affects you in a similar way, unless the decision is necessary for entering into or performing a contract between you and us, is authorized by law, or is based on your explicit consent.
Right to Withdraw Consent: If the processing of your data is based on your consent, you have the right to withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. How to exercise your rights: You may exercise these rights by contacting us via:
Specific email for data protection: [email protected]
General email: [email protected]
WhatsApp number (if you wish to use this channel for initial inquiries or exercise of rights): 930 306 123.
Please make sure to always clearly indicate who you are (providing, if necessary to verify your identity, a copy of your ID card or equivalent document) and which right or rights you wish to exercise. We will respond to your request within the legally established timeframes.
Right to Lodge a Complaint: If you believe that your rights have not been properly addressed or that the processing of your personal data violates applicable regulations, you have the right to lodge a complaint with the competent supervisory authority. In Spain, the main authority is the Spanish Data Protection Agency (AEPD) (https://www.aepd.es/). If you reside in Catalonia, you may also обратиться to the Catalan Data Protection Authority (APDCAT) (https://apdcat.gencat.cat/ca/inici/index.html). Nevertheless, we recommend that you first contact us so that we can try to resolve any issue amicably.
7. Specific Contact for Privacy and Data Protection Matters
For any inquiry, question, suggestion, or exercise of rights specifically related to this privacy statement or the processing of your personal data, in addition to the general channels indicated in this policy, you may use the following dedicated privacy contacts:
Preferred email for data protection: [email protected]
WhatsApp for privacy inquiries: 930 306 123
These channels are intended to facilitate more direct communication for data protection matters, complementing the organization’s general contact details.
Granada Noticias WhatsApp Broadcast Channel Policy
1. Purpose and nature of the channel
Granada Noticias makes a broadcast channel available to the public through the WhatsApp platform (hereinafter, the "Channel"), managed through WhatsApp’s "Channels" functionality ("Channels").
The Channel is strictly one-way: Granada Noticias publishes information, news, and content of its own media outlet on it, but no private or two-way conversation is maintained with followers. Users cannot reply to messages posted in the Channel or contact Granada Noticias directly through it; they can only view its content, react to it (for example, with emojis), and, if they wish, stop following the Channel at any time.
For any inquiry, request, or two-way communication with Granada Noticias, the user must use the usual contact channels indicated in this policy.
2. How the Channel works technically (information provided by WhatsApp)
According to the public information provided by WhatsApp/Meta about the Channels feature:
Following the Channel does not reveal the phone number of the follower to the administrator (Granada Noticias) or to other followers.
Granada Noticias, as administrator of the Channel, does not have access to the names, profile photos, or phone numbers of the people who follow it.
WhatsApp/Meta may collect certain technical and usage information relating to Channels (such as reactions, language, interactions, or device information), the processing of which is governed by WhatsApp’s own privacy policy, independent of Granada Noticias.
The content published in the Channel is public and may be viewed by any WhatsApp user, even if they are not a follower.
For detailed information on how WhatsApp/Meta processes data relating to Channels, please see:
WhatsApp Channels privacy policy (EEA): https://www.whatsapp.com/legal/channels-privacy-policy-eea
WhatsApp general privacy policy: https://www.whatsapp.com/legal/privacy-policy
WhatsApp Terms of Service: https://www.whatsapp.com/legal/terms-of-service
3. Data processed by Granada Noticias and purpose
Given the technical operation described in point 2, Granada Noticias does not collect, receive, or store the phone number or any other identifying data of the Channel followers. Granada Noticias does not know the identity of the people who follow the Channel.
The only "data" directly managed by Granada Noticias is the informational content it publishes (news, articles, notices, images, videos, and links related to its journalistic activity), the dissemination of which constitutes the exclusive purpose of the Channel.
Legal basis: legitimate interest of Granada Noticias in disseminating information of public interest arising from its journalistic activity (Art. 6.1.f GDPR), without prejudice to the fact that following the Channel is always free, voluntary, and revocable at any time by the user.
4. Retention period
Granada Noticias will retain the content published in the Channel as long as it remains relevant to its informational purpose, without prejudice to the platform’s own technical retention policy applied by WhatsApp/Meta to its servers, which is separate from and independent of Granada Noticias.
Since Granada Noticias does not collect personal data from followers, there is no user data retention period for us to determine in relation to the Channel.
5. User rights
Since Granada Noticias does not have identifying data of the Channel followers, it is not in a position to locate, rectify, or delete specific personal data of a follower simply because they follow the Channel, as it has no technical record of this.
Nevertheless, any person may at any time exercise the rights of access, rectification, deletion, restriction, objection, and portability with respect to any other personal data they have provided to Granada Noticias by other means (for example, by email), by contacting:
Email: [email protected]
General email: [email protected]
WhatsApp: 930 306 123
For matters specifically related to data managed by WhatsApp/Meta in relation to the Channel (for example, technical data collected by the platform itself), the user must contact WhatsApp/Meta directly using the mechanisms provided in its own privacy policy.
Any person has the right to file a complaint with the Spanish Data Protection Agency (AEPD, https://www.aepd.es) or, if they reside in Catalonia, with the Catalan Data Protection Authority (APDCAT, https://apdcat.gencat.cat).
6. How to stop following the Channel
Any follower may stop following the Channel at any time directly from the WhatsApp application, without needing to request it from Granada Noticias or justify the reason. Stopping following the Channel means the immediate cessation of content reception.
7. Content and editorial responsibility
The content published in the Channel is the editorial responsibility of Granada Noticias and is additionally governed by the WhatsApp Terms and Conditions of use and Channel Guidelines (https://www.whatsapp.com/legal/channels-guidelines), which Granada Noticias undertakes to respect.
Communications received through Granada Noticias social media accounts (Instagram, TikTok, Facebook, and X)
Granada Noticias maintains official profiles on the social networks Instagram, TikTok, Facebook, and X (formerly Twitter), which it uses both for the public dissemination of informational content and for receiving direct messages or comments from users, as an additional contact channel.
1. Data processed
When a user sends a direct message, a comment, or interacts with Granada Noticias profiles on these networks, Granada Noticias may view the information that the social network itself makes available to it depending on the user’s privacy settings, such as their username or profile, profile photo (if public), and the content of the message or comment sent.
2. Storage of data
These data are stored within the social platform itself (application or website) used, as part of the message or comment history associated with the Granada Noticias profile, as a direct consequence of each network’s operation. Granada Noticias does not systematically export or incorporate this information into its own databases, without prejudice to the fact that it may retain the content strictly necessary to manage the inquiry raised.
3. Purpose and legal basis
The purpose of this processing is to handle the inquiries, requests, comments, or messages that the user decides to send voluntarily through these profiles, as an additional channel to the other contact channels of Granada Noticias.
Legal basis: the user’s consent, expressed through the voluntary act of contacting Granada Noticias via this means (Art. 6.1.a GDPR), and, where applicable, the performance of pre-contractual measures or the handling of a request related to a service (Art. 6.1.b GDPR).
4. Retention period
Messages and comments will be retained as long as necessary to handle the inquiry raised and, thereafter, for the legal limitation periods for possible liabilities, without prejudice to the retention policies of each social network, which are independent of Granada Noticias.
5. Processors and international transfers
Each of these social networks acts as an independent communications service provider and processes data in accordance with its own privacy policy, which may involve international data transfers outside the EEA with the safeguards provided for by the GDPR (such as Standard Contractual Clauses):
Instagram / Facebook (Meta Platforms, Inc.): https://www.facebook.com/privacy/policy/
TikTok (TikTok Technology Limited): https://www.tiktok.com/legal/page/eea/privacy-policy/en
X, formerly Twitter (X Corp.): https://x.com/en/privacy
6. User rights
The user may at any time exercise the rights of access, rectification, deletion, restriction, objection, and portability over the data provided through this means, or directly manage their privacy and messaging settings within each social network. For matters related to data processed directly by the social network itself (for example, technical data collected by the platform), the user must contact the corresponding service through the mechanisms provided in its own privacy policy.