Data Privacy Read 91精选鈥 Information & Data Security Practices policy Data Privacy & Security: A Key Value At 91精选, protecting the right to privacy is fundamental to maintaining the trust of our customers, readers, subscribers, suppliers and employees. We are committed to implementing leading data protection standards, and we have adopted significant governance measures, corporate policies and operating procedures to do so. We abide by 鈥減rivacy by default鈥 and 鈥減rivacy by design,鈥 and we conduct privacy impact assessments for major new products, services and other offerings prior to public launch. We leverage organization-wide tools to document our data flows, manage data subject access rights and assess data processing activities. We regularly review our data collection and processing activities to ensure data is collected lawfully and transparently. A Comprehensive Compliance Program Across All 91精选 Brands We have a comprehensive Information Security policy that applies to all of 91精选, and our divisions and brands are committed to transparency in their collection, use, retention and sharing (if applicable) of data. In support of this commitment, each 91精选 division or brand has a separate privacy policy with clear terms about how that division or brand collects, uses, retains and shares data and pursuant to which legal basis. You can always find the most up to date policies posted on each of our division or brands鈥 sites, and exemplary privacy policies available here. As set forth in our divisions鈥 and brands鈥 policies, when we rely on consent as the legal basis for data collection, we ensure that user consent is affirmative, specific, informed, and freely given, and we allow consent to be withdrawn at any time. Our policies provide all users, regardless of location, with subject access rights including: right to access, right to deletion, right to transfer, right for information, right to correction, right to opt out of sale (if applicable), right to object and right to restrict processing. Our policies also provide users with controls to allow them to manage their data and exercise their subject access rights. We notify data subjects as legally required in case of data sharing, and we seek to avoid processing of minors鈥 personal data. We are committed to notifying data subjects in a timely manner if there is a material change in our privacy policies or practices. Adherence to Leading Industry Standards At 91精选, we have also implemented organization-wide measures and tools to regularly monitor core systems, sites and applications for potential vulnerabilities. We also encourage responsible reporting of vulnerabilities that may be found in our sites or our applications, and we review such reports and respond as appropriate. If a data security incident does arise, we have a documented incident response policy and operate under the principles of timely detection, management and response. We notify applicable regulators and affected data subjects as required by applicable law. Although we carry cybersecurity insurance as a precaution, in the past three years, neither we nor our vendors have experienced a data security incident that was material to us, we have not incurred any material expenses in connection with a data security incident, and we have not incurred any payments from penalties or settlements in connection with a data security incident. A Proactive Approach Within 91精选 and With Our Vendors To ensure 91精选 meets its commitments, we use internal and external audits against information security standards at least annually, require employee trainings on both data security and privacy on hire and annually thereafter, conduct vendor security reviews, and expect and require key vendors to implement data security standards that meet or exceed our own. Our external Data Protection Officer, in conjunction with 91精选鈥 Chief Technology Officer, Chief Information Security Officer, Chief Auditor, General Counsel, Chief Financial Officer, Chief Accounting Officer, and senior management oversee responsibility for data security matters, and 91精选鈥 Board of Directors and Audit Committee are regularly briefed on information security. Our Legal team and Information Security team regularly update business executives on new privacy regulations, policy and procedure changes and requirements.