PRIVACY POLICY
PRIVACY POLICY OF "PHILADELPHIA INDEPENDENT"
Controller and privacy contact
SCANDIC TRUST GROUP LLC is responsible for the collection and use of personal information described in this Privacy Policy where it determines the purposes and means of that activity. References to "we", "us" and "our" mean SCANDIC TRUST GROUP LLC in its capacity as the publisher and service provider of "PHILADELPHIA INDEPENDENT", also referred to as "PI". The term "controller" describes that role; the precise statutory designation and obligations depend on the applicable law.
SCANDIC TRUST GROUP LLC
IQ Business Centre
Bolsunovska Street 13–15
01014 Kyiv / Ukraine
Email: [email protected]
Legal form: limited liability company incorporated under Ukrainian law, LLC.
Registration number: 1010351020000018952.
The address above is our operational and correspondence address. Privacy inquiries, complaints and requests concerning personal information may be sent to this address or to the email address above. The registration number identifies the Ukrainian company and is not a Pennsylvania or other United States company registration number.
Registered office and company address
SCANDIC TRUST GROUP LLC
Oksamytova Street 1-b, Office 30
Sofiivska Borshchahivka
Kyiv Region - 08147 / Ukraine
Technical operation and administration
SCANDIC ASSETS FZCO
Dubai Silicon Oasis DDP
Building A1/A2
Dubai - 342001 / United Arab Emirates
Telephone: +971 54 221 5217.
SCANDIC ASSETS FZCO provides technical services within the scope of its appointment. Where it handles personal information on behalf of SCANDIC TRUST GROUP LLC, access is limited to the information and functions necessary for its assigned work and governed by appropriate instructions, confidentiality obligations, security requirements and restrictions on further use. Its involvement does not transfer the publisher’s responsibilities to the technical company. Whether an organization acts as a service provider, processor or independently responsible recipient depends on its actual activities and the law concerned, rather than its name or membership of a corporate group.
Commercial cooperation
LEGIER Beteiligungs mbH
Kurfürstendamm 14
10719 Berlin
Federal Republic of Germany
Commercial register: HRB 57837
Register court: Amtsgericht Charlottenburg, Berlin
VAT identification number: DE413445833
Telephone: +49 30 99211 3469
Fax: +49 30 99211 3225
Email: [email protected]
Where LEGIER Beteiligungs mbH is involved in an advertising inquiry or commercial arrangement, personal information may be disclosed to it only for a specified lawful purpose and to the extent necessary for its role. Commercial cooperation does not give that company unrestricted access to reader, subscriber or editorial information. Where it independently determines how information is used, its responsibilities and the applicable privacy information must be identified in connection with the particular arrangement.
Introduction and scope
This Privacy Policy explains how personal information is handled in connection with the websites, applications, editorial activities and other services of "PHILADELPHIA INDEPENDENT". It addresses information collected directly from you, information generated through use of a service and information obtained from other sources. Provisions concerning accounts, subscriptions, payments, newsletters, comments, events or other additional functions apply where those functions are actually offered. References to external technologies describe their relevant privacy implications when used; they do not mean that every named technology operates on every page. Information provided when a particular service collects your information supplements this Policy and must accurately describe that activity. Reading this Policy or accepting the Terms of Service does not constitute blanket consent to advertising, tracking, recording or unrelated disclosure.
Applicable United States and Pennsylvania law
The relevant framework includes applicable United States federal law, Pennsylvania statutes and common-law protections concerning privacy, confidentiality, contracts and reasonable care. Principal provisions include section 5 of the Federal Trade Commission Act, the Pennsylvania Unfair Trade Practices and Consumer Protection Law, the Pennsylvania Breach of Personal Information Notification Act and the Pennsylvania Wiretapping and Electronic Surveillance Control Act. Federal rules governing children’s information, commercial email, electronic communications and qualifying video-viewing records apply within their respective scope. Freedom of speech and freedom of the press must also be respected. These laws do not operate as a single general privacy code equivalent to the European Union General Data Protection Regulation. Rights arising under another applicable jurisdiction remain unaffected, but are not attributed to Pennsylvania law merely because similar rights exist elsewhere. The overseas addresses of the companies identified above do not, by themselves, remove obligations arising from activities affecting United States users.
A) General information on personal information processing
For this Policy, personal information means information that identifies, relates to or can reasonably be linked with an individual, household or device. A particular statute may use a narrower or different definition. Depending on the activity, information may include names, contact details, account identifiers, correspondence, transaction records, contributions, photographs, recordings, IP addresses, device information and records of interaction with our services. Replacing a name with an identifier, hashing an email address or combining records into a dataset does not necessarily make the information anonymous. We limit collection and use to defined purposes, seek to keep relevant records accurate, restrict access and avoid keeping identifiable information longer than necessary. Information described as deidentified must be protected against reasonably foreseeable reidentification and must not be deliberately reidentified except where lawfully necessary to assess the effectiveness of those protections.
Purposes and grounds for processing
The purposes and legal requirements depend on the particular activity. Our principal purposes are:
- Providing requested services, including delivering content, administering accounts, handling subscriptions and responding to inquiries.
- Processing transactions, confirming payments, addressing billing issues and maintaining necessary financial records.
- Protecting services, detecting misuse, investigating faults and managing legitimate security incidents.
- Researching, verifying, preparing, publishing, correcting and preserving journalistic material.
- Providing optional newsletters, personalization or advertising functions in accordance with the choices offered and applicable law.
- Complying with binding legal obligations and establishing, exercising or defending legal claims.
These purposes are not independent statutory permissions to carry out every activity that might be commercially useful. A service agreement does not authorize unrelated surveillance, and describing a purpose as a legitimate business interest does not override a consent requirement, confidentiality obligation or statutory restriction. Where consent is required, it must relate to the actual activity and be obtained before that activity begins.
Consent, legal requirements and exceptional circumstances
When we request consent, the information presented must explain the relevant purpose, the information involved and any material disclosure to another organization. Consent obtained through deception, an obscured choice or an inaccurate description is not treated as valid authorization under this Policy. Information may also be used or disclosed where a specific legal obligation or lawful emergency exception applies. Such circumstances do not create unrestricted access to all account, reading or editorial records. Requests from authorities are assessed for their legal basis, scope and applicable confidentiality protections. Where legally permissible and appropriate, affected individuals will be informed of a demand concerning their information. This Policy does not authorize the provider to disregard a lawful preservation obligation or court order.
Sources of personal information and information notices
We may obtain information directly from you, from an authorized representative, through the technical operation of a service, from organizations involved in a transaction or from sources relevant to legitimate editorial work. Editorial sources may include interviews, public records, contributors, published material and information supplied by confidential sources. The source and intended use must be assessed before information obtained elsewhere is added to a commercial account, marketing list or profile. Public availability does not make information unrestricted for every purpose. We provide service-specific information when necessary to explain collection, disclosure and available choices. These notices must distinguish information required for a requested service from optional information and must not conceal a materially different use.
Editorial and journalistic processing
Personal information may be handled when investigating events, checking facts, interviewing people, preparing reports, publishing material, responding to corrections and maintaining an editorial archive. The First Amendment protects newsgathering and publication within its constitutional scope, while generally applicable laws may still govern how information is obtained and used. Journalism is not an automatic exemption from duties concerning unlawful interception, actionable intrusion, confidentiality or reasonable security. In Bartnicki v. Vopper, 532 U.S. 514 (2001), the Supreme Court protected publication in the particular circumstances of information concerning a matter of public concern that the defendants had obtained lawfully without participating in its unlawful interception. That decision does not authorize journalists or technical providers to intercept communications unlawfully. Commercial subscriber records, advertising profiles and account administration are assessed separately from editorial publication.
Privacy, confidential sources and editorial archives
Editorial decisions take account of accuracy, sensitivity, public importance, the circumstances in which information was obtained and the likely consequences of publication. Particular care is required with children, medical information, private communications and people in vulnerable circumstances. Confidential sources and source-identifying material receive appropriate protection, including consideration of Pennsylvania’s Shield Law, 42 Pa.C.S. § 5942, where applicable. The scope of protection depends on the material, the person claiming protection and the proceeding concerned; it is not a guarantee that every record is immune from every legal demand. Confidentiality arrangements should be made clear before a source relies on them. A valid promise of confidentiality is not displaced merely by invoking editorial freedom. An archive may preserve accurate historical reporting, but retention of unpublished personal information requires a continuing purpose. Corrections, contextual updates, restricted access or removal may be appropriate depending on the facts and applicable law.
External platforms and distribution services
Where content is distributed through social networks, video or audio platforms, applications, connected televisions or voice assistants, the platform operator may collect information for its own purposes. Such services may include X, Facebook, Instagram, YouTube, Telegram, TikTok, Apple services, Amazon services, Google services, Roku, Huawei, Spotify or other platforms where actually used. An ordinary link, an embedded player and an externally loaded image can create different disclosures. An embedded resource may contact its provider when the page loads, before you click it. Being signed in to a platform may allow that provider to associate the interaction with your account. Your relationship with the platform does not automatically authorize every disclosure initiated from our services. We remain responsible for collection or disclosure that we determine or cause, to the extent provided by applicable law.
Technical information and voice assistants
When content is requested from our systems, technical records may be generated. Depending on the service and connection, they may include:
- The requested page or file and the date and time of access.
- Response status, transferred data volume and technical error information.
- The IP address and available browser, operating-system or device information.
- Referring-page information transmitted by the browser or platform.
- Network information necessary to deliver the request or investigate a fault.
These records support delivery, troubleshooting and security within the limits described below. Their collection does not authorize an unrelated advertising profile. A voice-assistant provider may separately process commands, audio, transcripts or account activity. Use of a voice assistant does not necessarily mean that "PHILADELPHIA INDEPENDENT" receives the original recording or the complete conversation. Any recording or transcription that we initiate must comply with the applicable communications laws and the information given to the participants.
Sensitive information and criminal-record information
Health information, precise location, financial-account details, government identifiers, intimate information, biometric identifiers and information about children require particular care. Reading an article about a sensitive subject does not establish that the reader has a particular medical condition, political affiliation or other personal characteristic. We do not treat such reading activity as permission to create or disclose sensitive advertising inferences. A photograph or ordinary voice recording is not automatically a biometric identification system; processing it to recognize or uniquely identify a person introduces different risks and may trigger additional legal requirements. Criminal allegations must be distinguished from charges, convictions and findings that have been overturned or otherwise changed. Sealing, confidentiality and other applicable restrictions must be assessed before obtaining, using or disclosing records. Sensitive information supplied privately for an inquiry or editorial purpose must not be repurposed for unrelated promotion without an appropriate legal basis and any required permission.
B) Contacting us
When you contact us by email, telephone or an available contact form, we handle the information needed to understand and respond to your inquiry. This may include your contact details, correspondence, attachments and information relevant to the matter. Please provide only information necessary for the inquiry and avoid sending passwords, complete payment-card details or unnecessary identity documents through ordinary email. Contacting us does not subscribe you to advertising. A message submitted for possible publication is assessed according to its stated purpose and any agreed confidentiality arrangements. Where a call is recorded or transcribed, the purpose and recording arrangements must be explained and any necessary prior consent obtained. Routine correspondence is retained while the matter is being handled and thereafter within the limits in section H.
C) Reservations, orders, subscriptions and user accounts
Where these functions are offered, we handle the identification, contact, account, order, contractual and payment information reasonably necessary to provide them. Account records may include login credentials, preferences, subscription status and administrative history. Information genuinely required to provide a service must be distinguished from optional information and marketing choices. Payment providers may handle information independently for payment processing, authentication, fraud prevention or regulatory purposes. Their involvement does not necessarily give the publisher access to complete card or bank-account details. We do not require unrelated sensitive information merely because an account or subscription is being created. Account closure, subscription cancellation and a request to delete information are different actions; where a request concerns more than one, we will clarify and address it without imposing unnecessary obstacles. Necessary transaction records may remain after an account closes, but retention does not authorize continued billing.
D) Accounting and statutory record retention
Financial and transaction records are retained for the period required by the law applicable to the company and transaction concerned. Where United States federal tax obligations apply, supporting records generally must be kept through the relevant assessment or limitation period. Internal Revenue Service guidance commonly identifies three years for ordinary income-tax supporting records, with longer periods in specified circumstances. This is not a universal three-year rule for every company or category of information. Applicable state requirements, overseas corporate obligations, audits and specific legal claims may require different periods. A statutory retention duty does not justify keeping unrelated browsing histories or marketing profiles. Records retained for accounting, tax or legal purposes are separated from routine marketing use and remain subject to appropriate access restrictions.
E) Technical provision of the website and operational security
Technical information is handled to deliver requested content, maintain functionality, investigate faults and protect the services against unauthorized access, attacks and misuse. We limit routine logs to information reasonably needed for those purposes and avoid recording passwords, complete payment credentials or unnecessary message content. Relevant records may be examined together when investigating a particular fault or security incident; this does not authorize unrestricted combination with advertising profiles. Technical suppliers receive access only to the extent needed for their work. Operational records are retained for the shortest period justified by their purpose, subject to section H. Evidence of a particular incident may be preserved separately while necessary for investigation, recovery or related legal proceedings.
Cloudflare and cdnjs
Where Cloudflare services are used for content delivery, network protection or distribution of technical resources through cdnjs, the provider may receive IP addresses, request times, requested-resource information and other technical details transmitted by the browser. The privacy implications depend on the service and configuration. Necessary delivery and security functions must be distinguished from optional measurement, profiling or independent use by a recipient. Browser caching of a technical file is different from retention of request information in server logs. A content delivery network does not become exempt from every privacy or communications requirement merely because it performs a security or performance function. The applicable supplier arrangements and overseas processing safeguards are addressed in section G.
Google Fonts and externally loaded resources
Where fonts, images, scripts or other resources are loaded directly from Google or another external provider, the browser may disclose an IP address, the requested resource and associated technical information. The absence of cookies does not mean that no information is transmitted. The purpose and necessity of the connection, the information disclosed and any further use must be considered. Serving a resource locally avoids the separate browser request to the external provider for that resource. Optional external resources must respect the choices presented to you and any applicable consent requirement. Their use must not expose private account pages, form contents or sensitive information through unnecessary referring-page details or other request data.
F) Cookies, device access and tracking technologies
Cookies and similar technologies can store information on a device, recognize a browser, measure interactions or send information to another organization. Relevant technologies include local storage, pixels, software development kits, advertising identifiers, fingerprinting and session-replay tools. Pennsylvania does not apply a general cookie-consent rule identical to the European electronic-privacy framework. Nevertheless, particular activities may require consent or be restricted by communications law, children’s privacy law, video-privacy law, consumer-protection rules or another applicable state law. Descriptions such as "cookieless", "analytics", "optimization" or "first party" do not settle the legal question. The actual information collected, timing, recipients, purposes and choices determine the assessment.
Consent and communications privacy
Where collection involves interception of a protected communication under the Pennsylvania Wiretapping and Electronic Surveillance Control Act, the applicable statutory requirements must be met. The consent exception in 18 Pa.C.S. § 5704(4) requires prior consent from all parties; other exceptions have their own conditions. This must not be confused with a rule that every ordinary cookie necessarily intercepts a communication. In Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (Third Circuit 2022), the amended opinion rejected a broad direct-party exemption for the third-party tracking at issue and addressed where the interception occurred. The court left the disputed consent question for further consideration. A buried privacy statement or the location of a supplier’s server does not automatically resolve these issues. Under this Policy, optional advertising tracking and individual audience profiling require a separate affirmative choice before activation.
Statistics used to improve our services
We distinguish limited operational statistics from information used to follow a particular person, combine activity across services or select individualized advertising. Statistics may be used to understand readership, identify faults and improve performance within the purposes disclosed. Where identifiable interaction data is involved, we assess the information collected, access by suppliers, retention and any required authorization. Calling a dataset aggregate does not establish that the underlying individual records have been deleted or rendered unidentifiable. Information collected for service measurement must not be silently repurposed for unrelated profiling. Optional individual tracking follows the choice described above; a statutory exception, where available, applies only within its actual conditions.
Your choices and withdrawal of consent
You may change optional choices through the privacy or cookie settings made available for the relevant service or by contacting [email protected]. Refusing an optional purpose must be straightforward. Where we rely on consent, withdrawal stops future reliance on that consent without making earlier lawful activity unlawful. Silence, continued browsing or general acceptance of the Terms of Service is not treated under this Policy as a separate affirmative advertising choice. Browser settings can block or delete cookies, but deletion of a cookie does not necessarily notify every organization of a withdrawal. Choices may need to be set separately on different browsers or devices. Where applicable law requires recognition of an opt-out preference signal, including Global Privacy Control, we honor it for the purposes covered by that law. It is not treated as a request to delete every account or to disable essential security functions.
Remembering cookie and language choices
Under this Policy, our own routine record used to remember a cookie or consent choice is retained for no longer than 12 months from the last active choice, subject to limited evidential retention under section H. Where a cookie named "laravel_cookie_consent" is used, its function must be limited to recording the relevant choice rather than creating an advertising identifier. A language preference, including a session cookie named "language" where used, is retained for the session or, where a persistent preference is requested, for the necessary period up to 12 months. These are policy limits, not a claim that Pennsylvania law prescribes a universal cookie duration. A further visit does not itself provide fresh consent to an additional purpose.
Cloudflare Web Analytics
Where Cloudflare Web Analytics is used, it may receive information concerning page views, performance, referring pages and browser or device characteristics. Its operation must be assessed separately from Cloudflare’s content delivery and security services. The description of a product as privacy-focused does not determine whether a particular implementation requires consent or another safeguard. Cloudflare’s published documentation describes seven days of unsampled beacon data, followed by sampling or aggregation, and access to historical reporting for the preceding six months. Sampling is not proof of anonymization. Those product descriptions do not establish the retention period for every Cloudflare service or every record held by the publisher. Optional tracking remains subject to the choices and restrictions explained in this Policy.
Advertising, personalization and measurement purposes
Where these functions are offered, separately explained purposes may include:
- Selecting advertisements using limited contextual information.
- Creating profiles for personalized advertising.
- Using profiles to select personalized advertising.
- Creating profiles to personalize content.
- Using profiles to select personalized content.
- Measuring advertising performance.
- Measuring content use and performance.
- Analyzing audiences using statistics or information from different sources.
- Developing and improving services.
- Selecting content using limited information.
This list does not establish that every activity takes place or authorize every possible recipient. An active advertising arrangement must identify the relevant information, purposes, recipients and choices with sufficient clarity. A disclosure may be treated as a sale, sharing or targeted advertising under an applicable state law even where no money changes hands. We do not treat the word "partner" as an exception from such rules. Confidential sources, private editorial correspondence and payment credentials are not made available for unrelated advertising. Industry frameworks, including IAB systems, do not replace legal requirements or provide unlimited authorization for unidentified future participants.
G) Recipients and international processing
Personal information is disclosed only for an identified purpose and to the extent justified by that purpose. Depending on the service, recipients may include technical suppliers, organizations involved in a requested transaction, communication providers, professional advisers, editorial contributors and competent authorities or courts where disclosure is lawful. A supplier acting on our behalf must be subject to appropriate restrictions concerning use, access, confidentiality, security, further disclosure and deletion or return of information. An independently acting recipient must have its own lawful basis for its activities where applicable and provide the information required of it. Common ownership or a commercial relationship does not give every group company unrestricted access. If a business transfer is proposed, information disclosed during due diligence must be limited and protected; a transaction does not automatically authorize materially different uses of previously collected information.
Principal organizations and service-related recipients
Relevant roles may include:
- SCANDIC TRUST GROUP LLC, Ukraine: the publisher responsible for the activities described in this Policy that it determines or controls.
- SCANDIC ASSETS FZCO, United Arab Emirates: technical operation and administration, with access limited to its actual tasks.
- LEGIER Beteiligungs mbH, Germany: commercial cooperation where involved in a particular advertising inquiry or arrangement.
- Cloudflare, Inc., United States: where the relevant content delivery, security, cdnjs or Web Analytics services are used.
- The relevant Google service provider: where Google-hosted fonts, YouTube or other Google resources are used, with the responsible entity determined by the actual service and applicable arrangements.
- Payment, communications, delivery and other suppliers: where involved in a service you request, with their identity and role explained in the relevant service information.
This description must be read with the information supplied for the actual feature. It does not mean that each organization receives all information held about a reader, subscriber or source.
Overseas processing and remote access
The publisher is established in Ukraine, and the technical company is established in the United Arab Emirates. Depending on the service and supplier, information may be handled in those countries, in the United States or elsewhere. Remote access from another country can create a disclosure or processing activity even if the server remains in its original location. An address in this Policy does not establish the location of every server or support employee. Overseas processing must respect applicable confidentiality, security, consumer-protection and disclosure requirements. Use of a website is not treated as unrestricted consent to transfer all information to any country or any recipient.
Safeguards for international processing
We assess the information involved, the recipient’s role, the purposes of access, security arrangements and any applicable legal restrictions before permitting international processing. Appropriate measures may include contractual limits, access controls, confidentiality obligations, encryption, restrictions on onward disclosure and procedures for addressing lawful government demands. These measures must reflect the actual relationship; a provider’s general compliance statement is not proof that a particular agreement or safeguard has been implemented. Where another applicable privacy regime requires a specific international-transfer mechanism, that mechanism must be established for the transfer concerned. A European or United Kingdom adequacy decision is not a general United States authorization, and no certification or adequacy status is claimed for the companies identified above merely because they appear in this Policy.
Additional statutory transfer restrictions
Certain transfers and access arrangements may be prohibited or restricted independently of a person’s consent. Where applicable, the United States Department of Justice’s Data Security Program under Executive Order 14117 and 28 C.F.R. Part 202 regulates specified transactions involving United States government-related data or bulk sensitive personal data and countries of concern or covered persons. Its application depends on the parties, information, transaction and relevant exceptions. Neither a generic consent clause nor a change of server location removes an applicable prohibition. These requirements do not establish that every ordinary overseas service arrangement falls within the program.
H) Retention and deletion of personal information
Under this Policy, the ordinary maximum for our own routine operational records is 12 months from the event specified below. Information is deleted or irreversibly deidentified earlier where it is no longer needed. Longer retention is limited to a continuing service, a specific legal obligation, a properly justified legal claim, the need to respect a privacy choice or an assessed journalistic purpose. The existence of a maximum does not justify retaining unnecessary information until that period expires.
- Inquiries and correspondence: while the matter is being handled and ordinarily no longer than 12 months after closure, subject to necessary legal or evidential retention.
- Accounts and contracts: while needed for an active account or continuing contract, followed by ordinarily no more than 12 months for remaining routine records after closure, except for applicable financial, legal or claims requirements.
- Technical and security records: for the period justified by their operational purpose and ordinarily no longer than 12 months from recording; relevant incident evidence may be preserved separately while needed.
- Cookie and preference records: ordinarily no longer than 12 months from the last active choice, with shorter periods appropriate to the function.
- Consent and request records: while needed to demonstrate and respect the relevant choice, followed by ordinarily no more than 12 months after the matter ends, except for a necessary limited compliance record.
- Marketing suppression records: the minimum information necessary to prevent further unwanted marketing for as long as that purpose remains relevant.
- Accounting and tax records: for the period justified by the applicable requirements described in section D.
- Journalistic material and archives: for the period justified by the editorial purpose, public importance, source protection and freedom of expression, with appropriate safeguards.
- Children’s information: only for the period necessary for the specific authorized purpose, with any additional requirements under the Children’s Online Privacy Protection Rule observed.
- Independently held supplier records: according to the supplier’s actual role and applicable law; our routine limit does not control an independent organization’s entire retention schedule.
A shorter statutory requirement takes precedence. Where 18 U.S.C. § 2710(e) applies, qualifying video records must be destroyed as soon as practicable within its prescribed limits and conditions. Backup copies are protected against ordinary use and removed through the relevant deletion or replacement cycle. Restoring a backup must not permanently reverse an earlier deletion or marketing objection. A legal hold is limited to relevant information and reviewed when the reason for preservation ends.
I) Your rights
Your statutory rights depend on the information, the activity, your location and the law that applies. Pennsylvania’s existing sector-specific protections do not create an unrestricted general right to obtain, delete or port every record held by a private newspaper. We nevertheless provide the request process described below and adopt the following commitments for ordinary account and commercial information, subject to necessary identity checks and the exceptions explained in this Policy:
- Information: you may ask how your information is collected, used, retained and disclosed.
- Access: you may request confirmation of relevant information held about you and an appropriate copy, subject to lawful restrictions.
- Correction: you may ask us to correct inaccurate account or commercial information.
- Deletion: you may request deletion of information that is no longer needed or is otherwise eligible for deletion.
- Optional processing: you may withdraw a consent or ask us to stop an optional use covered by the choices we provide.
- Marketing: you may stop promotional email and other optional marketing communications through the applicable mechanism.
- Additional statutory rights: where applicable law provides portability, sale or sharing opt-outs, targeted-advertising choices, sensitive-information controls or an appeal right, those protections remain available.
- Children’s information: a qualifying parent or guardian may exercise the rights provided by the Children’s Online Privacy Protection Act and Rule.
These commitments do not require disclosure of another person’s private information, confidential sources, protected editorial material, privileged communications or information whose release would create a material security risk. Any restriction must be assessed for the particular request rather than imposed as a general refusal.
Your right to stop optional uses
You may object to optional marketing or profiling through the relevant settings or by contacting us. We will stop the optional use covered by the choice and retain only information needed for another lawful purpose or to respect the objection. A request to stop marketing does not normally require deletion of a necessary invoice or abandonment of a pending service inquiry. Conversely, retaining an invoice does not authorize further marketing. Where a statutory right to opt out of sale, sharing or targeted advertising applies, the relevant definitions, exceptions and response requirements govern. We will not penalize a lawful privacy request or make an unrelated paid entitlement conditional on withdrawing it. A feature that genuinely depends on optional information may become unavailable when that information is no longer supplied, and the effect will be explained.
Requests concerning journalism and published material
Requests concerning an article, image, recording or editorial record are assessed in their specific context. Please identify the material and describe the correction, restriction or other action sought. We consider accuracy, source protection, the rights of other people, lawful newsgathering, public importance and applicable restrictions. There is no general Pennsylvania right requiring a newspaper to erase accurate reporting solely because it is unfavorable or concerns events in the past. Equally, prior publication does not excuse every later use or remove responsibility for an actionable privacy violation. A correction, contextual update, qualification, anonymization or access restriction may be appropriate. A reader’s ordinary account-access request does not automatically entitle that reader to unpublished reporting files or confidential source identities.
How to exercise your rights and response periods
Requests may be sent to [email protected] or to the correspondence address above. You do not need to cite a statute or use a prescribed form for an ordinary request. We ordinarily handle requests without charge. Verification is limited to information reasonably necessary to protect the person concerned; a complete identity document or Social Security number is not automatically required. An authorized representative may act where the relevant authorization can be established. For requests handled under our voluntary commitments, we will ordinarily respond within 45 calendar days. If additional time is reasonably necessary, we will explain the reason within that period and ordinarily complete the response within a further 45 days. These are policy commitments, not a statement of a general Pennsylvania statutory deadline. Any shorter or otherwise different legally binding period takes precedence, including applicable marketing and children’s privacy requirements.
Access searches and reasons for decisions
We make reasonable efforts to locate information relevant to a properly identified request. We may ask for clarification where needed to distinguish between people or identify the service concerned, but will not use clarification to create unnecessary delay. Access may require redaction of another person’s information or withholding of material protected by law, privilege or a legitimate security restriction. Where a request is refused in whole or part, we will explain the reason as far as legally permissible and identify any applicable review or complaint route. We do not require you to create a new paid account to make a privacy request. Information obtained solely for verification is not reused for unrelated marketing.
Privacy complaints and public authorities
You may complain directly to us using the contact details above. Please describe the relevant service, the concern and any previous request or response. We will consider the complaint promptly and provide an explanation appropriate to the circumstances. You may also contact a competent public authority, including the Pennsylvania Office of Attorney General or the Federal Trade Commission, where the matter falls within its jurisdiction. This Policy does not require you to complete our correspondence process before approaching an authority. A complaint to an authority does not guarantee an individual award of compensation or suspend a legal deadline.
Pennsylvania Office of Attorney General
Bureau of Consumer Protection
15th Floor, Strawberry Square
Harrisburg, PA 17120
United States of America
Consumer Protection Helpline: 800-441-2555.
Privacy contacts and responsibility
The publisher’s privacy contact is [email protected]. This contact point handles requests and directs matters to the responsible personnel where necessary. It is not presented as an independently appointed statutory data protection officer or as an unidentified United States representative. The involvement of a technical supplier, commercial partner or external adviser does not remove the publisher’s responsibility for activities it determines or controls. If a particular applicable law requires an additional representative, responsible person or contact arrangement, the relevant information must be supplied for that activity.
J) Security and personal information breaches
We apply reasonable safeguards appropriate to the information and risks involved, including access restrictions, confidentiality controls, secure authentication, appropriate encryption, maintenance and recovery arrangements. No system can guarantee prevention of every incident. Under Pennsylvania’s Breach of Personal Information Notification Act, qualifying affected residents must generally be notified without unreasonable delay following determination of a reportable breach, subject to the Act’s permitted investigation, restoration and law-enforcement provisions. Relevant vendors must notify the organization for which they hold the information. When notice must be given to more than 500 affected Pennsylvania residents, concurrent notification to the Office of Attorney General is required, subject to applicable exemptions. Separate nationwide consumer-reporting-agency notice requirements may also apply. These are not replaced by a general European 72-hour deadline.
Where section 5.4 applies to the specified combinations of names and Social Security numbers, bank-account numbers or driver’s-license or state-identification numbers, the required assistance includes 12 months of credit monitoring without charge and access to an independent credit report where the statutory condition is met. Other applicable laws may impose additional duties. Security notifications will explain relevant protective steps and will not require the affected person to waive a legal claim to receive assistance required by law.
Risk assessment and responsible use of technology
Before introducing technology that materially changes the handling of personal information, we assess its necessity, recipients, security implications, retention and potential effects on individuals. Particular attention is given to session replay, sensitive inferences, children’s information, biometric identification and automated decisions that could significantly affect a person. Forms and recording tools must be designed to avoid unnecessary capture of passwords, payment credentials, private messages and other sensitive content. A supplier’s description of its product as secure, anonymous or compliant does not replace assessment of the implementation. Where applicable law requires a formal assessment or additional safeguards, those requirements must be met before the relevant activity begins.
K) Disputes, judicial remedies and compensation
This Policy does not restrict access to a competent court or authority or impose compulsory arbitration, a waiver of jury trial or a contractual class-action waiver. Available remedies depend on the cause of action and its requirements. Pennsylvania’s Wiretapping and Electronic Surveillance Control Act and the federal Video Privacy Protection Act provide civil remedies within their scope. Other claims may arise under applicable contract, consumer-protection or common law. The Federal Trade Commission Act does not itself establish a general private damages action, and enforcement of Pennsylvania’s breach-notification statute is assigned to the Attorney General as provided by that statute. A separate common-law claim must satisfy its own requirements. No automatic compensation amount is promised. Jurisdiction, standing, procedure and limitation periods are determined by applicable law; internal complaint handling does not automatically suspend them.
L) Relevant legislation and case law
The following authorities inform the protections and activities described in this Policy. Each applies according to its scope, the facts and subsequent legal developments. Proposed legislation is not treated as an enacted source of rights or obligations.
- Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45: applicable prohibitions on unfair or deceptive practices, including relevant privacy representations and data-security practices.
- The Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §§ 201-1 and following: applicable consumer protections and remedies, subject to the requirements of the particular claim.
- The Pennsylvania Breach of Personal Information Notification Act, 73 P.S. §§ 2301 and following, as amended, including by Act 33 of 2024: qualifying breach notifications and associated duties.
- The Pennsylvania Wiretapping and Electronic Surveillance Control Act, 18 Pa.C.S. §§ 5701 and following, including sections 5703, 5704 and 5725: interception restrictions, statutory exceptions and applicable civil remedies.
- The federal Electronic Communications Privacy Act of 1986, including relevant provisions of the Wiretap Act, 18 U.S.C. §§ 2510–2523, and the Stored Communications Act, 18 U.S.C. §§ 2701–2713: protections concerning specified communications and records within their respective scope.
- The Video Privacy Protection Act of 1988, 18 U.S.C. § 2710, as amended: restrictions on disclosure of qualifying identifiable video-viewing information and related consent, retention and remedy provisions.
- The Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, as amended: requirements governing covered collection, use and disclosure of children’s personal information.
- The CAN-SPAM Act of 2003, 15 U.S.C. §§ 7701–7713: requirements concerning commercial email, sender information and opt-out mechanisms.
- Pennsylvania’s Shield Law, 42 Pa.C.S. § 5942: protection of qualifying journalistic sources against compelled disclosure within the statute’s scope.
- The First Amendment to the United States Constitution: protection of speech and press freedom, subject to the relevant constitutional principles and generally applicable laws.
- Executive Order 14117 and 28 C.F.R. Part 202: restrictions on specified transactions involving sensitive United States data and countries of concern or covered persons, where applicable.
- Applicable federal, state and overseas accounting and tax requirements: retention of records where the company and transaction fall within those requirements.
- Dittman v. UPMC, 196 A.3d 1036 (Supreme Court of Pennsylvania 2018): recognition of a reasonable-care duty concerning employees’ sensitive information collected and stored electronically in the circumstances considered; the decision does not guarantee that every security incident gives rise to liability.
- Federal Trade Commission v. Wyndham Worldwide Corporation, 799 F.3d 236 (United States Court of Appeals for the Third Circuit 2015): confirmation of the Federal Trade Commission’s authority to challenge qualifying unfair data-security practices under section 5.
- Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (United States Court of Appeals for the Third Circuit 2022), amended opinion of October 18, 2022: application of Pennsylvania’s interception rules to the third-party website tracking at issue, including the rejection of a broad direct-party exception and consideration of consent.
- Castellani v. The Scranton Times, L.P., 956 A.2d 937 (Supreme Court of Pennsylvania 2008): protection of confidential journalistic sources under Pennsylvania’s Shield Law and rejection of the proposed nonstatutory crime-fraud exception in that case.
- Bartnicki v. Vopper, 532 U.S. 514 (Supreme Court of the United States 2001): constitutional protection for publication in the particular circumstances of lawfully obtained information of public concern by persons who did not participate in its unlawful interception.
- Cohen v. Cowles Media Company, 501 U.S. 663 (Supreme Court of the United States 1991): the First Amendment does not categorically prevent enforcement of an otherwise actionable promise of confidentiality under state law.
M) Additional information about particular services
Newsletters and electronic marketing
Where newsletters or promotional communications are offered, the subscription process explains their nature and the relevant use of contact information. Under this Policy, an ordinary service inquiry or account registration is not treated as a request for unrelated newsletters. Commercial email must comply with the CAN-SPAM Act where applicable, including accurate sender information, nondeceptive subject lines, a valid postal address and an effective opt-out mechanism. Qualifying opt-out requests must be honored within ten business days, and the mechanism must remain available for at least 30 days after the message is sent. No fee or unnecessary identifying information will be required to unsubscribe. You may use the mechanism in the message or contact [email protected]. A minimal suppression record may be retained to prevent further unwanted messages.
Newsletter measurement and service messages
Requesting a newsletter does not automatically authorize individualized tracking of when a message is opened, which content is read or which links are selected. Where such measurement is used, it must be explained and assessed under applicable communications, privacy and consumer-protection requirements, together with the optional-tracking commitments in this Policy. Technical email delivery information is distinguished from an individual marketing profile. Necessary messages about a subscription, payment, security incident or service request must remain limited to their purpose and must not be used to evade an unsubscribe request. A message containing promotional material is assessed according to its actual content and primary purpose, rather than being described as operational merely to avoid applicable rules.
Embedded content, social networks and affiliate links
Embedded video, audio, images and social functions may disclose an IP address, device information, the page visited and interaction details to their providers. This can occur without an account with that provider. Where an embed involves optional tracking covered by a choice, it must respect that choice before activation. A platform’s privacy notice does not replace information or consent for which we are responsible. Affiliate links may generate information used to attribute a purchase or calculate a commission; the commercial relationship and any material tracking must be explained. Receiving a commission does not itself authorize the transfer of private account information or sensitive browsing data. Confidential forms and private correspondence must not be exposed to an external advertising tool simply because it is present elsewhere on the website.
YouTube and external video resources
Where YouTube or another video service is embedded, both the player and an externally hosted preview image may initiate connections to that provider’s servers. Playback may create additional requests, device storage or account-related processing. A privacy-enhanced player does not necessarily eliminate every disclosure. The actual implementation, including previews and associated scripts, must respect the choices and legal requirements described above. Where the Video Privacy Protection Act applies, disclosure of qualifying identifiable viewing information requires a permitted statutory basis. Consent relied upon under that Act must satisfy its separate, informed-consent requirements and withdrawal provisions; a general acceptance of financial or contractual terms is insufficient. Advance consent under that provision cannot exceed two years and ends sooner if withdrawn. Not every embedded video or visitor automatically falls within the Act’s definitions.
Examples of Google cookie durations
Google’s published information describes the following examples. Actual use depends on the service, settings, location and account status; this list is not a statement that every cookie is placed through our website.
- "YSC": associated with security during a browsing session and ordinarily retained for that session.
- "__Secure-YNID": used for YouTube functions and troubleshooting, with a stated duration of six months; Google identifies it as replacing "VISITOR_INFO1_LIVE".
- "PREF": stores playback or display preferences and expires eight months after the user’s last use.
- "SOCS": remembers Google cookie choices, with a stated duration of 13 months.
A cookie’s expiry is not the retention period for all information already transmitted to a provider. The actual implementation must be described accurately, and a provider’s classification of a cookie as functional or necessary does not by itself determine every applicable legal requirement.
Profiling and automated decisions
Personalization may involve assessing identifiers, viewed content or interactions to infer interests. Such inferences may be inaccurate and must not be presented as verified facts about a person. These services are distinguished from automated decisions affecting matters such as access to an account or suspected fraud. Pennsylvania law does not impose a universal equivalent of the European automated-decision framework on every newspaper recommendation system. Nevertheless, applicable consumer-protection, discrimination, privacy and other sector-specific requirements remain relevant. Where automated processing materially affects an account or service entitlement, we will provide an appropriate route to raise an error and request human review. Additional statutory rights apply where their conditions are met. Private correspondence, confidential source material and account records are not authorized for unrestricted external artificial-intelligence training merely because they have been submitted to the publisher.
Children and young people
The services are intended for a general audience. That description does not override the actual scope of the Children’s Online Privacy Protection Act and Rule. They apply to covered services directed to children under 13 and to relevant general-audience services with actual knowledge of collecting children’s personal information. Where required, parental notice and verifiable parental consent must precede collection, use or disclosure. Parents must be able to exercise the applicable review, deletion and refusal rights. The amended Rule also requires separate verifiable parental consent for covered third-party disclosures unless they are integral to the service, together with applicable security and retention safeguards. The general compliance date for the 2025 amendments was April 22, 2026.
If we discover that information has been collected without a required authorization, we will stop the unauthorized activity and take the necessary corrective steps. An age statement does not replace these obligations. We do not treat the age of 13 as a general prohibition on reading publicly available journalism, and children’s privacy rules do not replace the separate rules concerning contractual capacity. Any age-assurance measure must itself be proportionate and avoid unnecessary collection of identity documents or biometric information.
Events, competitions, photographs and access control
Where events, competitions, reservations or controlled access are offered, the relevant notice explains the information required, its purpose, recipients and retention. Participation does not automatically include agreement to unrelated marketing. Photography, filming and security monitoring require consideration of the location, reasonable expectations, applicable law and the intended use. Attendance alone is not blanket permission for every future promotional use of an identifiable image. Audio recording must independently satisfy applicable communications rules. Particular care is required with children and sensitive circumstances. Identity documents, dates of birth and access records are collected only where justified by the activity. Security footage is retained only for the period needed for its purpose, with relevant incident material preserved separately where necessary.
Changes to this Privacy Policy
This Policy may be updated to reflect changes in services, information practices or applicable law. Material changes will be communicated in a manner appropriate to their significance. Before introducing a materially different use of information already collected, we will assess the original representations, applicable restrictions and any requirement for new notice or consent. Publishing an amended Policy does not automatically authorize retrospective expansion of a consent or removal of an existing privacy choice. Where consent is relied upon, it may be withdrawn without a two-week deadline or another arbitrary restriction. The date below identifies the latest revision of this text.
Contact:
"PHILADELPHIA INDEPENDENT"
Email: [email protected]
© 2026 "PHILADELPHIA INDEPENDENT" - All rights reserved, subject to statutory exceptions.
Last updated: 1 November 2026.