Privacy and Security Policies

User-Provided Information

During your use of a Service (whether as a registered or unregistered user), you may provide us with personal information, such as your name and e-mail address, or other information that could be used to identify you as an individual or allow someone to contact you, as well as any information associated with such information (collectively, “Personal Information”). Personal Information includes both things that specifically identify you (like your real name) and things that don’t specifically identify you, but might be connected back to you (like the IP address of your computer or the device identifier of your smartphone).

Location Data

When using our Services from a mobile device (a “Mobile Service”), you may share the geographic location of your device with us. Your device location may be transmitted to us whenever a Mobile Service is running (even if you are not actively using the Mobile Service or it is running in the background on your device). Your device may continue to transmit its location to us until you change your device settings.

If you set your device not to transmit location information to us, certain features of our Services may not be available or their functions may be limited. For example, you will have to manually enter a location when conducting a search. You should also know that turning off location sharing only prevents your device from sharing its precise location. Your network service provider may still provide general location information (based on access points you’ve connected to, for example). The information provided varies by network service provider. You should check with your network service provider to find out what information is provided and if there are ways for you to limit it.

Service Usage Information

As is typical of many web sites and mobile applications, when you use our Services, we may collect information about your device and your usage of our Services including:

• Your IP address (which we may associate with your domain name or that of your Internet access provider or wireless carrier, and your location);
• Unique ID number associated with your device;
• Other unique identifiers such as advertising identifiers (e.g., “ad-ID” or “IDFA”);
• Web browser and operating system information;
• Language of your device;
• Wireless connections you are using;
• Referring page that linked you to us;
• Your activities, including browsing and transaction history;
• Pages, content, and ads you view or click on during your use of our Services, and when and for how long you do so;
• The next web site you visit after leaving our web site; and
• Search terms you enter on our Services or a referral site.

In addition, we may deploy tracking technologies through our Services to collect additional information about your use of the Services, as set out in the “Cookies and other tracking technologies” section of this Privacy Policy.

We or our service providers may use the information we collect from or about you to perform the following functions:

• administer our Services and your account with us;
• enable you to use our Services and their features;
• customize our Services to your interests and history with us;
• localize the content and articles that are displayed to you based on your geographical location;
• conduct market research;
• improve or develop new features and offerings in our Services;
• tailor ads displayed to you in our Services and elsewhere;
• send you marketing and other communications, including information about products, services, or events that we think might be of interest to you;
• assess your level of interest in and use of our Services, e-mails, and other messaging campaigns, both on an individual basis and in aggregate;
• generate analytics reports on the usage of our Services; and
• respond to your requests, questions, and concerns protecting our rights and property.

We may also use Personal Information to meet our internal and external audit requirements and for information security purposes. Where permissible under applicable law, your Personal Information may be used for other purposes, which will be disclosed to you at the time when your information is collected. There may be instances, however, when we will use your Personal Information for purposes that were not disclosed at the time of the data collection; for example, when doing so is necessary to comply with a legal obligation or requirement. We may use Personal Information to (a) respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence; (b) enforce our terms and conditions; and (c) protect our rights, privacy, safety, or property, or those of other persons.

Some of the uses specified above are necessary for the performance of a contract between us, or for the provision of a service requested by you. In other cases, the uses are based on our legitimate interests such as marketing our services to people who have expressed an interest in them or similar services.

We may share your information:

• with our lawyers, auditors, and other professional advisors, third party advertising companies (including exchanges and brokers) and third party providers of services such as cloud storage, customer relationship management systems, travel and expense management, analytics databases, who need your information to provide services to us (or on our behalf);
• when we believe in good faith that disclosure is necessary to protect our rights or property, protect your safety or the safety of others, investigate fraud, or respond to a government agency, law enforcement, judicial or public authority, or other legal request, or to comply with the law;
• in connection with a proposed corporate change or dissolution, including for example a merger, acquisition, reorganization, consolidation, bankruptcy, liquidation, sale of assets or wind down of business.

We may share non-personally identifiable information about usage of the Services (including aggregate data) with others, for their own use, in a de-identified form.

In addition, what you voluntarily post to public areas of our Service may be available to other Service users.

Transfers outside the European Economic Area (“EEA”)

The information described in this section of the Privacy Policy, with respect to the transfer of data outside the EEA, applies to those individuals located in the EEA. To process information of individuals located in the EEA for the purposes set out in this Privacy Policy, it is sometimes necessary for us to share your personal data outside the EEA, for example:

• with our offices outside the EEA;
• with service providers located outside the EEA;
• if you are based outside the EEA;
• where we consider that the transfer is necessary for exercising, establishing or defending legal rights including, as appropriate, providing information to respond to a government, law enforcement, judicial or other legal request, or otherwise to comply with applicable law.

Non-EEA countries might not have the same legal framework for data protection as the EEA countries. In particular, the United States, which is the most common destination of our transfers of Personal Information outside the EEA, is not considered to provide a level of personal data protection equivalent to that of the EEA. We will, however, ensure the transfers comply with EU data protection law. Our standard practice is to use standard data protection contract clauses approved by the European Commission as the basis for such data transfers.  You may read more about this on the European Commission Justice website at (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

If you would like further information, please see “Contact us” section below.

We use reasonable technical, administrative and physical security measures to protect Personal Information collected via our Services. We cannot guarantee that any information, during transmission through the Internet or while stored on our systems or otherwise in our care, will be absolutely safe from unauthorized access or use (e.g., by hackers). You use the Services, and send us information, at your own risk.

If you correspond with us by e-mail, text message, or using a “Contact us” feature on our Service, a third party could view the information you send in transit by such means. We have no liability relating to disclosure of your information due to errors, omissions or unauthorized acts or failures to act by third parties during or after transmission.

If you create an account on our Services, you are responsible for maintaining the strict confidentiality of your account password, and you shall be responsible for any activity, including disclosure of your Personal Information, that occurs using your account credentials, whether or not you authorized such activity. Please notify us of any unauthorized use of your password or account or any other breach of security.

We have procedures in place to deal with any suspected data security breach. If we believe that the security of your Personal Information in our care may have been compromised, we will endeavor to notify you of that development promptly taking into consideration the circumstances. If we have your e-mail address, we may notify you by e-mail. Where legally required to do so, we also will notify any applicable regulator.

We, and/or our service providers or partners on our behalf, may use tracking technologies which may run on your device when you use the Services. The circumstances in which we may deploy tracking technologies include:

• We may use cookies or local shared objects, such as “Flash cookies.” Cookies are small data/text files that store information, such as your preferences and account settings, on your computer. Similar to many other websites, if you have enabled cookies in your browser, we, independently and through enabled third-party tools and programs, collect certain technical information using cookies, such as originating IP address, browser type, browser language, how a user got to the Service (i.e., the URL of the last website you visited), the next website the user visits, what pages are visited, the length of each site visit, and the date and time of the user’s visit. This information helps us track trends and improve user experiences when using the Services
• HTML5 may be used to store information on your computer or device about your Service usage activities. This information can be retrieved by us to determine how our Services are being used by our visitors, how our Services may be improved, and to customize our Services for our users.
• We may send instructions to your computer or device using JavaScript or other computer languages to gather the sorts of information described above and other details about your interactions with the Service.

These tracking technologies may be deployed by us and/or our service providers or partners on our behalf. These technologies enable us to assign a unique number to your computer or device, and relate information about your use of the Services to other information about you, including your Personal Information. These technologies also enable us to recognize you when you access our Services using different web browsers or devices.

You can manage website cookies in your browser settings. You always have the choice to have your device warn you each time a cookie is being sent or change these settings by accepting, rejecting, or deleting cookies. If you choose to change your settings, you may find that certain functions and features will not work as intended on the Services. All browser settings are slightly different, so to manage cookies, you should refer to the relevant settings within your browser.  If you would like to obtain more detailed information about types of cookies, how they are used, and how you can manage your cookie preferences you may want to visit: www.aboutcookies.org or www.allaboutcookies.org.  Please click below for detailed information on how to disable and delete cookies in some commonly used browsers:

• Mozilla Firefox®: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored
• Microsoft® Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies#ie=ie-11
• Google Chrome™: https://support.google.com/accounts/answer/61416?hl=en
• Safari®: https://support.apple.com/en-gb/105082

Cookie Settings

We maintain a presence on social media and other external platforms, such as Facebook and Twitter. We may occasionally incorporate third party social networking features into our Services. This Privacy Policy applies to our use of information you submit to us there, but it does not apply to what those third-party platforms do with your information.

Our Services may allow you to share information with us that you have already provided to a third party social networking platform. For example, you may be able to create an account on our Service or log in to our Service using your Facebook account or other third-party credentials. If you do so, Personal Information or other data that you have provided to the third party may be made available to us by that third party subject to its own privacy policy, terms, and conditions. Privacy policies of social networks and other external platforms explain how those third parties use, protect, and share your information, including any information you share on those platforms from our Services, and we encourage you to read them. The information we receive from these platforms may depend on your privacy settings. Any such information that we obtain will remain subject to that third party’s privacy policy and we will use any such information in accordance with this Privacy Policy.

We may also include tools in our Services that allow you to share or publicly post content from our Services to your profile on a third party social network. You may choose to share information about your activities on the Service with such third party platforms and its users, including publishing your information about what content you may have viewed on our Services. If you visit a Service while logged into certain social media platforms, the social media platform may be able to identify your browser and associate the technical information provided by your web browser with other information that they have already collected about you, which may result in their ability to identify you. In addition, when you choose to share information about your activities on the Service with certain social media platforms, AP may send technical information about you to that platform as well as information about what content you are viewing.

Our Service may contain links, banners, widgets, or advertisements that lead to third-party web sites. We are not responsible for these other web sites, and so their posted privacy policies (not this Privacy Policy) will govern the collection and use of your information on them. We encourage you to read the privacy statements of web site visited after leaving our Services to learn about how your information is treated by others.

Our Services may contain certain co-sponsored content and you may be requested to provide additional Personal Information to the co-sponsor of such content. We will disclose to you when you are submitting Personal Information to co-sponsors. The information practices of any third party co-sponsors are governed by their own privacy policies and are not covered by this Privacy Policy.

Third-Party Ad Servers and Networks

We use third-party advertising companies to serve ads when you visit our Services.

When you view an advertisement, whether or not you click on it, the advertiser, advertising technology companies, web analytics companies and service providers that perform advertising-related services for us and our business partners may collect some information from or about you. These companies may use information about your visits to the Services, the geographic location where your IP address indicates you are located, as well as other information about (which such companies may obtain via your use of our Services or elsewhere) you in order to provide advertisements about goods and services of interest to you. These advertisements may appear in our Services and on other online properties or mobile applications. These companies may employ cookies, clear GIFs and other tracking technologies to cause relevant ads to be displayed to you. We do not control any such technologies that may appear in our Services or other online properties or mobile applications.  The information practices of these third parties are governed by their own privacy policies and are not covered by this Privacy Policy. We encourage you to read these businesses’ privacy policies to learn about how they treat your information.

For more information about third-party advertisers and how to prevent them from using your information, visit the Digital Advertising Alliance’s site at http://www.aboutads.info/choices/ or the Network Advertising Initiative’s site at http://www.networkadvertising.org/choices/. However, if you opt-out we may still suggest offerings (including content sponsored by third-parties) to you on our Service based on your history or your account preferences.

Some web browsers may transmit “do-not-track” (“DNT”) signals to mobile applications with which the user communicates. We currently do not change our tracking practices (which are explained in more detail under “Service Usage Information” above) in response to DNT settings in your web browser.

Our third party partners, such as web analytics companies and third party ad networks, may collect information about you and your online activities over time and across our Services and other online properties. These third parties may not change their tracking practices in response to DNT settings in your web browser and we do not obligate these parties to honor DNT settings. We utilize Google Analytics for our web analytics and you can opt out of your usage data being included in our Google Analytics reports by visiting https://tools.google.com/dlpage/gaoptout.

You may review, update or correct certain of the Personal Information that is stored in your user account in our Services (if you have one) by using the “Contact Us” information below. We may ask you to verify your identity and to provide other details before we are able to provide you with any information, correct any inaccuracies, or delete any information. Your right to delete information is subject to our records retention policies.

You can opt out of our promotional e-mails by clicking the opt-out/unsubscribe link within the e-mail you receive. Please understand that it may take us a few days to process any opt out request and that even if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your relationship, activities, transactions, and communications with us.

In some jurisdictions, including in the countries of the European Economic Area, you have the right, in certain circumstances, to (i) require us delete your Personal Information, (ii) require us to restrict processing of your Personal Information (for example, if you contest the accuracy of that information), (iii) receive a copy of the Personal Information you provided to us in a structured, commonly used, and machine-readable format and/or instruct us to transmit that data to a third party; and (iv) object to our continued processing of your Personal Information, for direct marketing (including profiling) or other purposes. You can exercise these rights free of charge by contacting us using the details in the “Contact us” section below.

Your Personal Information will be held for the purposes and uses set out in this Privacy Policy and for as long as there is a legal, taxation, accounting, risk management or business requirement to do so. Different retention periods apply to different types of records and data which are dependent on the nature of your interaction with AP.

We may change this Privacy Policy from time to time. When we do, we will let you know by posting the changed Privacy Policy on this page with a new “Last Updated” date. In some cases, we may also tell you about changes by additional means, such as by sending an e-mail to the e-mail address we have on file for you.

The Services are not aimed at children. If, however, we collect and use information about children, we will comply with industry guidelines and applicable laws.

If you have any questions or comments regarding our privacy practices, you may contact us at:

privacy@ap.org

We hope that can resolve any query or concern you may raise about our use of your information.

Individuals located in the EEA have the right to lodge a complaint with a supervisory authority of the EEA state where you work or live or where any alleged infringement of data protection laws occurred. A list of the supervisory authorities can be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

The personal data processed by us in connection with your engagement includes names, postal addresses, email addresses, telephone numbers, bank details, passport details, visa information, VAT ID information, transaction details, next of kin information, Cintra ID, national insurance number, contribution to pension scheme.

We process this personal data for the following purposes and relying on the legal bases described below:

• As required to establish and fulfill a contract with you. This may include verifying your identity, allowing you to sign a contract with us, making payments, communicating with you, and providing support and assistance for your assignment or as you request;
• As required by AP to enable our business and pursue our and your legitimate interests, in particular:
  • we will use your information to provide services that AP or you have requested, and respond to any comments or complaints you may send us;
  • we may use your information to analyse previous reporting, assess resource levels, and make strategic decisions about AP priorities;
  • we monitor use of our systems, and may use your information to help us monitor, improve and protect the services we offer through our systems;
  • we may process your personal data in operating and enforcing the Bring Your Own Device to Work Policy;
  • we may share your information within AP to allow for your selection for various AP assignments and roles;
  • we may monitor any freelancer/independent contractor account to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law; and
  • we may use information you provide to investigate and respond to any complaints received from you or from others.
• Compliance with applicable laws and protection of AP’s legitimate business interests and legal rights, including, but not limited to, use in connection with legal claims, compliance, regulatory, investigative purposes (including disclosure of such information in connection with legal process or litigation).
• Sometimes we will ask for your express consent for the processing of your personal data.

In addition, we may send you information about relevant assignments. If you wish to opt-out of receiving further communications from us, you will be able to advise the AP representative that retained you to close out your account or to make it inactive..

We may share your personal data within AP to allow for your selection for assignments and positions relevant to your interests and experience. We also share personal data within AP in the United States and the United Kingdom to administer the engagement of freelancers/independent contractors and manage operations and payroll, and analyze AP’s performance and the provision of the services.

Personal data may be shared with government authorities, law enforcement officials, legal advisors and other professionals, if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws. Personal data may also be shared with third party service providers, who will process it on behalf of the AP for the purposes above. Such third parties will include the providers of our systems, SAP and may also include providers of website hosting, maintenance, call center operation and identity checking.

In the event that the part of AP’s business which is relevant to the services you provide is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.

For the purposes described above, we may transfer your personal data to countries outside of your country of residence. For individuals in the UK or the European Economic Area (“EEA”), this may include countries that do not have equivalent data protection laws to the UK or the EEA. We take steps to ensure that your personal data is adequately protected, even when transferred outside the UK or the EEA. For more information on how we safeguard personal data that we transfer, please contact Privacy@AP.org.

AP will retain information you provide in connect with your engagement for the length of any contractual relationship you have with us, and, to the extent permitted, after the end of that relationship for as long as necessary to perform the purposes set out in this notice, or for one of these reasons:

• to respond to any questions, complaints or claims made by you or on your behalf;
• to show that we treated you fairly;
• to keep records required by law.

Where provided for by law, you may be entitled to ask the AP for a copy of your information, to correct it, erase or restrict its processing, or to ask us to transfer some of this information to other organizations. You may also have rights to object to some processing. These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data. In some instances, this may mean that we are able to retain data even if you withdraw your consent.

Where we require personal data to comply with legal or contractual obligations, then the processing of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship, or to meet obligations placed on us. In all other cases, provision of requested personal data is optional.

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data or wish to exercise any of the rights referred to above, please contact Privacy@AP.org. You also have the right to complain to data protection authorities., in particular in the UK or the EEA member state in which you normally live or work, if applicable, or where any alleged infringement of data protection laws occurred. For example, the supervisory authority in the UK is the Information Commissioner, who may be contacted at ico.org.uk.

We may change this privacy notice from time to time, so please review it periodically. When we do, we will publish the new version in a place readily accessible to you.

ACCURACY

We hate inaccuracies, carelessness, bias or distortions. We will not knowingly introduce rumor or false information into material for publication or broadcast; nor will we distort visual content. Quotations must be accurate and precise. We preserve appropriate professional distance from those we cover.

TRANSPARENCY

We identify all the sources of our information in stories. We allow anonymous information from sources only under limited circumstances. Any use of anonymity must be approved by a news manager familiar with AP’s strict standards and who must be told the identity of the source of the information.

RESPECT OF COPYRIGHT

We never plagiarize content, and we respect others’ copyrights.

INDEPENDENCE

We guard our independence. We avoid any behavior or activities that create a conflict of interest, that compromise our ability to report the news fairly and accurately, free from outside influence or pressure.

Freelance journalists working for AP should work to remain impartial and avoid expressions of opinion in public forums or on social media that might compromise AP’s reputation as an unbiased and fair news source, such as commenting on public figures or public controversies.

HONESTY

We don’t misrepresent ourselves to get a story. When we seek an interview, we identify ourselves as AP journalists.

PRIVACY AND SAFETY

We balance the newsworthiness of a story with a reasonable respect for individuals’ privacy and safety interests. Freelance journalists working for AP are expected to conduct themselves in a way that does not cause undue risk or danger to themselves or others.

INTERVIEWS

We never pay newsmakers for interviews, to take their photographs or to film or record them. We do not provide full lists of questions in advance or allow interview subjects to approve our stories or images before publication.

FAIRNESS AND BALANCE

We work to be fair. Whenever we portray someone in a negative light, we must make a real effort to obtain a response from that person in the story. We work to provide balance in stories to reflect all important viewpoints and perspectives on a news event.

CORRECTIONS

When mistakes are made, they must be corrected – fully, quickly and transparently. Alert your manager immediately if you learn of an error in your work.

IMAGE INTEGRITY

We do not manipulate photos or video, adding or subtracting elements. If in doubt about permissible editing techniques, consult an AP editor or manager.

It is the responsibility of every freelance journalist or contractor working with AP to ensure that these standards are respected and reflected in their work.

If you perceive a conflict, or realize that you have, in the past, been involved in some conflict that would reflect badly on your work for AP, you must immediately notify your AP editor and the AP shall then determine whether your assignment may go forward. Examples of conflicts of interest are set forth below and include, but are not limited to the following:

1. You may not accept gifts or payments from sources, public relations agencies, corporations or others hoping to encourage or influence AP news coverage. You may accept trinkets of nominal value, $25 or less – for example, caps or mugs.
2. You may not sell for personal gain books, tapes, recordings or other items received for review or provided as promotional material for an event, person or company.
3. You may not accept free transportation, lodging, food or related goods or services, or any media discounts, or any preferential treatment (such as upgrades on flights or hotels) that may be offered because you are a contractor for the AP. You may accept shuttle bus rides or food at a news event, since the effect is to make it easier to do your job, without having to absent yourself.
4. You may not refer to books or commercial enterprises within your AP stories, with the intent to benefit the promoters of those books or enterprises – or for any other purpose other than their relevance to your AP assignment.
5. You may not own a financial interest in any company, enterprise or industry about which you write.
6. You may not buy or sell stocks or other securities with knowledge of a story that might affect their price, or while in possession of other nonpublic information; nor can you pass that information along to others who engage in stock transactions.
7. You may not engage in openly partisan or political behavior or expressions of opinion on contentious public issues, being mindful that positions you express publicly may damage the AP’s reputation as an unbiased source of news.

AP Playbook may store and process certain personally identifiable information which is necessary for the provision and support of AP Playbook. This may include, without limitation, user-provided phone numbers for opt-in SMS text notifications; user email addresses for login authentication; user location data, where the user has opted to share their location with other users via AP Playbook; and mobile device identifiers.

Other information (such as names, phone numbers, and email addresses) may be stored regarding non-users of AP Playbook, where such data has been entered into the system by an authorized user for the purpose of facilitating coverage of a news story.

Location Data

When using AP Playbook from a mobile device, users may share the geographic location of their device with the system. Such device location may be transmitted to AP Playbook whenever the AP Playbook mobile app is running (even if you are not actively using the app or it is running in the background on your device). Your device may continue to transmit its location to AP Playbook until you change your device settings.

If a user sets their device not to transmit location information to AP Playbook, the staff location mapping feature will be unable to show authorized colleagues the user’s location.

Service Usage Information

As is typical of many web sites and mobile applications, when you use AP Playbook, we may collect information about your device and your usage of AP Playbook including:

• Your IP address (which we may associate with your domain name or that of your Internet access provider or wireless carrier, and your location);
• Unique ID number associated with your device;
• Web browser and operating system information;
• Language of your device;
• Wireless connections you are using;
• Elements of the AP Playbook service you click or tap on during your use of AP Playbook.
• In addition, we may deploy tracking technologies to collect additional information about your use of AP Playbook, as set out in the “Cookies and other tracking technologies” section of the AP Privacy Policy.

How is your information used?

We may use the information we collect from or about you to perform the following functions:

• Enable you to use AP Playbook and its features;
• Conduct market research;
• Improve or develop new features and offerings in our provision and support of AP Playbook;
• Generate analytics reports on the usage of AP Playbook.

The uses specified above are necessary for the performance of a contract for the provision and support of AP Playbook or are based on our legitimate interests in improving the provision and support of AP Playbook and/or developing new AP services.

Some of the data we gather, including how users are using AP Playbook, and their unique IDs, may be shared with third-party providers of services to us, such as guided help or analytics, to assist with the purposes specified above.

Cookies and other tracking technologies

We, and/or our service providers or partners on our behalf, may use tracking technologies which may run on your device when you use AP Playbook. The circumstances in which we may deploy tracking technologies include:

• We may use cookies or local shared objects, such as “Flash cookies.” Cookies are small data/text files that store information, such as your preferences and account settings, on your computer. Similar to many other websites, if you have enabled cookies in your browser, we, independently and through enabled third- party tools and programs, collect certain technical information using cookies, such as browser type, browser language, the date and time of AP Playbook usage; and how it is being used.
• We may send instructions to your computer or device using JavaScript or other computer languages to gather the sorts of information described above and other details about your interactions with AP Playbook.

You can manage website cookies in your browser settings. You always have the choice to have your device warn you each time a cookie is being sent or change these settings by accepting, rejecting, or deleting cookies. If you choose to change your settings, you may find that certain AP Playbook functions and features will not work as intended.

Data Retention

Upon the termination of a contract governing a customer’s use of AP Playbook, AP will decommission the customer instance of AP Playbook. This will generally result in the destruction and/or return of customer data to the customer as agreed and detailed in the customer contract.

AP Systems and Security Obligations:

 AP implements the following security measures with respect to customer data processed or stored in AP Playbook:

• Encryption of data at rest using AES256 or higher (or equivalent technology), with the encryption key rotated on an annual basis.
• Encryption of data in motion using HTTPS/SSL, with TLS 1.2 or higher.
• Deployment of web application firewall(s), or equivalent technology, in the hosted environment in which AP Playbook is running.
• Provides continuous system monitoring with notifications of adverse events.

Data Security Breach:

A “data breach” is defined as any incident where the security or integrity of personal information or customer data in our care has been or may have been compromised.

In the case of such a data breach, AP’s corporate incident response plan will be activated, as appropriate, and we will notify any customer who may be impacted as promptly as possible given the specific circumstances. Where legally required to do so, we will also notify any applicable regulator.

In the event of a security issue identified by a customer, AP will investigate as soon as possible and provide a written response. AP will liaise with the customer to determine if the provision and support of AP Playbook need to be suspended until the issue is resolved and/or if a software update is required and agree an appropriate resolution path.

All personnel and contractors are obligated to follow the procedures detailed in this AP Playbook information security policy.

All personnel and contractors have a responsibility for reporting security incidents and any identified weaknesses.

Any deliberate act to jeopardize the security of information that is the property of The Associated Press or their customers or contractors will be subject to disciplinary and/or legal action as appropriate.

Review

The policy is reviewed regularly and, in the event of influencing changes, updated to ensure it remains appropriate for the business and ensures our ability to serve our customers.

Contact

Playbook Support at: ENPSSupport@ap.org

Telephone:    +44 207 482 7707 (International – EMEA/APAC)

+1 202 641 9641 (Americas)