Privacy Policy

1. About this Policy

This Privacy Policy is issued by GNR Media Pty Ltd, ABN 80 668 188 289, trading as GNR Media (GNR Media, we, us or our).

It explains how we manage information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual. In this Policy, we call that information personal information. Where European or United Kingdom law applies, the equivalent term is personal data.

This Policy should be read with our Terms and Conditions, the applicable plan, Order or Card, the Data Processing Addendum where applicable, the Cookie Policy, the Content and Rights Complaints Policy, the Rewards, Referral, Affiliate and Collaboration Program Terms where applicable, and any collection notice shown at the point information is collected.

If a law gives an individual a right that cannot be excluded or waived, that law prevails to the extent of any inconsistency with the Terms or this Policy.

2. Who we are and our privacy roles

2.1 When GNR Media determines the purpose

GNR Media acts as the organisation responsible for determining why and how personal information is handled when we manage our websites, prospects, Clients, subscriptions, billing, account administration, GNR Network, community, rewards, referrals, affiliates, collaborations, service improvement, security, our own marketing, evidence reports, publicity, testimonials and case studies. Under European terminology, we are generally the controller. Under some United States laws, we may be the business.

2.2 When a Client determines the purpose

A Client may use our Platform or Services to hold contacts, operate a CRM, send campaigns, manage leads, schedule appointments or process its own customer information. For that information, the Client generally determines the purpose and means of processing. GNR Media acts as the Client's processor, service provider or contractor, subject to the applicable agreement and Data Processing Addendum.

If your information is contained in a Client-controlled account, campaign or database, you should normally direct your request to that Client. We will assist the Client as required by contract and applicable law.

2.3 Shared or separate responsibility

In some activities, such as a jointly operated campaign, event, publication, integration, referral or commercial collaboration, GNR Media and another organisation may each be an independent controller or may jointly determine parts of the processing. Where required, the relevant agreement or collection notice will explain the allocation of responsibilities.

3. Who and what this Policy covers

This Policy applies to personal information relating to:

• website visitors, enquiry contacts, prospects and referral contacts;
• current, former and prospective Clients and their owners, directors, employees, contractors and authorised users;
• people who complete a Marketing Passport®, audit, quiz, form, survey, assessment or onboarding workflow;
• GNR Network and community members, event attendees, speakers, interview participants and contributors;
• participants and applicants in GNR Media rewards, referral, affiliate, partner, collaborator, distribution, fee-split or revenue-share programs;
• prospective customers, contacts and representatives introduced or attributed through an approved referral, affiliate or collaboration process;
• people featured in content, feedback, testimonials, case studies, reports, screenshots, audio or video;
• newsletter subscribers and recipients of lawful marketing communications;
• Client customers, leads and contacts where GNR Media processes their information on the Client's behalf;
• suppliers, publishers, strategic partners, contractors and professional advisers; and
• job applicants and people seeking to work with GNR Media.

GNR Media's Services and Programs are designed for trade, business and professional use. They are not intended for personal, family or household use.

This Policy does not replace a Client's or Program Participant's own privacy policy. Each organisation remains responsible for explaining how it handles information through its business, websites, campaigns, CRM, referral activity and connected accounts.

4. Information we collect

The categories below describe the information we may collect or hold, depending on how a person or business interacts with us.

Identity, contact and account information

Name, business name, position, username, email address, telephone number, postal or business location, account identifiers, profile information, login records and authentication details.

Business and professional information

ABN or other business identifier, industry, qualifications, employment or professional role, business description, website, products, services, locations, audience, objectives, pricing, brand information and authorised representatives.

Marketing Passport® and strategy information

Mission, vision, values, customer segments, offers, positioning, messaging, competitors, assets, channels, goals, budget information, decision-making details, compliance information and other answers supplied through the Marketing Passport® or related strategy processes.

Commercial, subscription and transaction information

Plan, Order, subscription status, invoices, amounts, discounts, payment status, billing address, tax information and transaction history. Payment card numbers are normally collected directly by the payment processor; we may receive a token, card type, last four digits, expiry indicator and payment result.

Program, referral, affiliate and collaboration information

Program applications and Cards, referral source, approved links or codes, lead and attribution records, qualifying actions and transactions, reward or commission balances, fee splits, revenue-share settings, validation and hold periods, payment thresholds, invoices, tax residence, ABN or GST status, payment destination, disclosures, compliance records, disputes, reversals and audit information.

Platform, CRM and campaign information

Contacts, leads, pipelines, calendar bookings, forms, messages, email or SMS campaign information, consent records, suppression records, workflow activity and other information placed in or generated by a Client-controlled account.

Connected website, search, social and advertising information

Information accessed from authorised websites, content systems, analytics accounts, search tools, social profiles, advertising accounts, directories, domains, DNS, hosting and other connected services, including impressions, clicks, rankings, traffic, engagement, leads and conversions.

Content, communications and Publicity Materials

Emails, messages, support requests, meeting notes, survey responses, feedback, reviews, testimonials, community posts, interviews, photographs, video, audio, voice, likeness, biography, business logo, reports, screenshots, case-study information, content drafts and approvals.

Technical, device and usage information

IP address, browser, device type, operating system, approximate location derived from IP, referring page, pages or features used, dates and times, identifiers, cookie data, logs, error reports, security events and interaction information.

Preferences and marketing information

Communication preferences, subscription choices, event interests, content engagement, campaign responses, opt-ins, opt-outs and information used to understand likely business interests.

Support, compliance and security information

Verification records, permissions, complaints, disputes, legal notices, records of authority, fraud indicators, security incidents, access history and evidence needed to protect rights or comply with law.

Recruitment and contractor information

Resume, work history, qualifications, references, application correspondence, availability, payment details and other information required to assess or manage a working relationship.

Derived, aggregated and de-identified information

Scores, classifications, recommendations, benchmarks, trends, observations and insights created from the information above. Information that is genuinely de-identified so that it is no longer personal information may be used more broadly, subject to applicable law.

4.1 Sensitive information

We do not seek health information, government identifiers, biometric data, precise geolocation, political opinions, religious beliefs, sexual information or other sensitive information unless it is genuinely necessary, authorised and collected through an appropriate process. People should not place sensitive or confidential third-party information into general forms, community spaces or AI-enabled workflows.

5. Where information comes from

We may collect personal information:

1. directly from the individual or Client, including through forms, checkout, onboarding, emails, calls, meetings, interviews, surveys, community participation and support;
2. from a Client or its authorised user, including where a business adds representatives, contacts, leads, staff, customers or featured people to the Platform or supplies information for content and campaigns;
3. from connected services, where the Client authorises access to websites, analytics, search, social, advertising, CRM, calendar, email, domain, hosting or other accounts;
4. from public or commercial sources, including business websites, social media, professional profiles, search engines, directories, corporate registers, media, public reviews and published content;
5. automatically, through cookies, pixels, tracked links or codes, logs, analytics, security tools and interaction with our websites, Platform or Program pages;
6. from service providers, Program Participants and partners, including payment processors, referrers, affiliates, collaborators, publishers, event partners, fraud-prevention providers and integration providers; and
7. by generation or inference, through analytics, research, AI-assisted tools, audits, reports, comparisons, recommendations and service delivery.

Where we obtain personal information indirectly and European or United Kingdom transparency rules apply, we will provide required information within the applicable timeframe unless the individual already has it, the Client is responsible for providing it, or another lawful exception applies.

6. Why we use information and lawful bases

The lawful basis depends on the activity and jurisdiction. Where the EU GDPR or UK GDPR applies, we generally rely on performance of a contract, steps requested before a contract, legitimate interests, legal obligations or consent. Where we rely on legitimate interests, those interests are described below and balanced against the individual's rights and reasonable expectations.

6.1 Legitimate interests

Our legitimate interests may include:

• operating, securing, supporting and improving GNR Media and its Services;
• building a useful business Network and increasing participating businesses' visibility;
• understanding service performance and creating reliable benchmarks and evidence;
• promoting GNR Media through accurate testimonials, case studies and demonstrated results;
• communicating with business contacts about relevant services and events;
• administering rewards, referrals, affiliate attribution, commissions, fee splits and commercial collaborations;
• protecting GNR Media, Clients, users and third parties from fraud, misuse and legal risk; and
• establishing, exercising and defending contractual and legal rights.

6.2 Consent

Where we rely on consent, it may be withdrawn at any time for future consent-based processing. Withdrawal does not affect processing already carried out or processing supported by another lawful basis. We do not describe a contractual permission as “consent” where contract or legitimate interests is the appropriate basis.

7. Client-controlled CRM and campaign data

A Client may place information about its customers, prospects, staff, suppliers or other contacts into the Platform or provide that information so we can perform Services. In that situation:

1. the Client is responsible for having a lawful basis, providing required privacy notices and obtaining required marketing permissions;
2. the Client must not upload purchased, scraped, unlawfully obtained or excessive information;
3. GNR Media processes the information for the agreed Services, security, support, legal compliance and documented purposes;
4. GNR Media may use approved subprocessors and integrations subject to contractual, privacy and security controls appropriate to the service;
5. GNR Media does not use raw Client customer lists for GNR Media's unrelated direct marketing or publicity; and
6. return, export, retention and deletion are governed by the applicable Order, Data Processing Addendum, Platform capability, legal obligations and backup cycles.

If you make a privacy request about information held in a Client-controlled account, we may ask you to identify the relevant Client and may refer the request to that Client unless GNR Media is independently responsible for the relevant processing.

8. Publicity, testimonials, case studies and Service Data

Clauses 11 and 12 of the Terms and Conditions contain the automatic publicity, evidence and data licence. By accepting the Terms, joining GNR Media, using the Services or continuing a subscription after the Terms take effect, the Client grants the stated licence without a separate permission request, further approval, notice before each use or payment.

8.1 Information covered

Subject to the Terms and applicable law, this may include:

• the Client's business name, trading name, logo, trade marks, website, public contact details, brand assets, business description, products and services;
• genuine feedback, reviews, comments, survey responses, emails, messages, meeting statements, interview answers and community contributions;
• the professional name, position, biography, photograph, video, audio, voice, likeness and statements of an owner, director, employee, contractor, spokesperson or representative supplied to or captured through the Services;
• website, search, social, content, advertising, campaign, CRM, Network and Platform metrics;
• reports, dashboards, screenshots, recordings, audits, recommendations, Marketing Passport® information, Report Cards and before-and-after comparisons; and
• case-study information, commercial context, outcomes, learnings, stories and results generated or obtained in connection with the Services.

8.2 Uses

GNR Media may use that information for service delivery, reporting, Network profiles, directories, articles, testimonials, case studies, evidence reports, white papers, benchmarks, media releases, award entries, investor or partnership materials, proposals, presentations, training, social media, email, video, podcasts, print, public relations, sales material and paid advertising.

8.3 Duration and approval

The licence is worldwide, royalty-free, fully paid, transferable, sublicensable, perpetual and irrevocable to the maximum extent permitted by law. It survives cancellation and termination. GNR Media is not required to submit each testimonial, case study, report, data selection, advertisement, layout, image or caption for further approval.

8.4 Accuracy and exclusions

GNR Media may edit, shorten, format, combine, paraphrase or adapt material for clarity and channel requirements, but must not knowingly fabricate a testimonial or materially misrepresent a genuine opinion or the underlying data. A case result is evidence of what occurred in the stated circumstances, not a promise that another Client will obtain the same result.

The licence does not authorise publication of passwords, private authentication information, payment card details, raw customer contact lists, health information, government identifiers or other highly sensitive information that is not reasonably relevant to a legitimate case study, evidence report or promotional purpose.

8.5 Client authority for featured people

The Client must ensure that each featured owner, employee, contractor, spokesperson or other person is authorised to participate and is informed that supplied or captured material may be used under the Terms. The person accepting the Terms also gives the stated permission for their own professional identity, image, voice, likeness and statements.

Once material is public, it may be indexed, cached, archived, copied, downloaded, screenshotted, syndicated or republished by third parties. GNR Media cannot guarantee removal from systems it does not control.

9. AI, automation and profiling

GNR Media may use artificial intelligence, machine learning, automation, analytics and similar tools to assist with research, drafting, content generation, optimisation, categorisation, reporting, scheduling, recommendations, workflow, support, fraud prevention and service improvement.

Information appropriate to the task may be processed through contracted AI or automation providers. We use reasonable controls based on the nature of the information and do not intentionally submit passwords, payment information or the highly sensitive information excluded by the Terms for public general-purpose model training.

We may use aggregated, de-identified and derived information to improve systems, prompts, methods, workflows and models, subject to applicable law and contract.

AI-assisted outputs can be inaccurate, incomplete or outdated. Human review is used where appropriate to the Service, and Clients remain responsible for reviewing regulated, factual and client-facing content before approval or publication.

10. How we disclose information

We may disclose personal information to the following categories of recipients where reasonably necessary:

• GNR Media personnel and contractors who need the information for service delivery, support, administration, security, content, publishing or compliance;
• hosting, infrastructure, content-delivery, domain, security and backup providers;
• CRM, automation, communications and Platform providers, including HighLevel and related email, SMS, calendar, form, pipeline and workflow providers;
• payment, invoicing, accounting, tax and debt-recovery providers;
• analytics, search, social-media, advertising and measurement providers;
• AI, research, transcription, video, meeting, design and content-production providers;
• publishers, media partners, GNR Network participants, distribution partners and advertising partners for uses authorised by the Terms;
• referrers, affiliates, collaborators, Program Participants and relevant prospective or acquired customers where reasonably necessary to validate attribution, administer a Card, deliver a joint offer, resolve a dispute or make an authorised payment;
• the relevant Client, its authorised users and connected service providers;
• professional advisers, auditors, insurers, banks and corporate advisers;
• regulators, courts, law-enforcement bodies and government agencies where required or permitted by law; and
• prospective or actual purchasers, investors, funders or successors in connection with a corporate transaction, subject to appropriate confidentiality and legal controls.

Service providers are expected to use personal information only for the contracted purpose or as lawfully permitted. The exact provider and recipient list may change as tools and delivery methods change.

10.1 No sale for money

GNR Media does not sell personal information in exchange for money. Certain analytics, social-media or advertising technologies can involve disclosures that some United States state laws define as a “sale”, “sharing” or use for targeted advertising even where no money is paid. Applicable choices are described in clause 20.

11. Public Network, community spaces and content complaints

The GNR Network may include public or member-only profiles, directories, Report Cards, articles, aligned stories, links, comments, events, recordings and community spaces. The audience depends on the relevant feature and settings.

Information posted to a public area may be viewed by anyone, indexed by search engines and used by AI or archival services outside GNR Media's control. Information posted to a member area may still be copied or shared by other participants. Users should not publish passwords, private customer lists, health information, confidential commercial material or other sensitive information unless the audience and purpose are appropriate.

GNR Media may moderate, restrict, correct, preserve or remove content to enforce the Terms, protect users, respond to rights complaints, maintain quality or comply with law. Community contributions may also be used under the licence in the Terms.

Copyright, trade mark, privacy, image, voice, publicity, defamation, confidentiality, illegal-content and related complaints should be submitted under the Content and Rights Complaints Policy. Privacy requests about access, correction, deletion, objection or another privacy right remain governed by clause 17 of this Policy.

12. International data transfers

GNR Media is based in Australia and uses global technology and service providers. Personal information may be stored, accessed, supported or processed in Australia, the United States and other countries where our providers, contractors or connected services operate. Depending on the service, these locations may also include Canada, the United Kingdom, countries in the European Economic Area and other global infrastructure or support locations.

GNR Media's principal subprocessors, the functions they perform and their relevant processing locations are identified in Schedule C of the Data Processing Addendum. Questions about subprocessors or international processing may be sent to [email protected].

12.1 Australian cross-border handling

Where the Australian Privacy Principles apply, we take reasonable steps appropriate to the circumstances before disclosing personal information to an overseas recipient. Foreign laws may permit a recipient or authority to access information in circumstances different from Australian law.

12.2 EEA transfers

Where EU data-transfer rules apply, a transfer outside the EEA is made only under an applicable adequacy decision, approved Standard Contractual Clauses, another permitted safeguard, or a lawful exception. Where required, we or the transferring party assess the transfer and apply supplementary contractual, technical or organisational measures.

12.3 UK transfers

Where UK data-transfer rules apply, a restricted transfer is made under UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, another permitted safeguard, or a lawful exception. A transfer risk assessment or corresponding data-protection test is completed where required.

A person may request information about an applicable transfer safeguard by emailing us. We may redact commercial or security information while still providing a meaningful explanation.

13. Cookies and online technologies

Our Cookie Policy provides the detailed notice about cookies, pixels, tags, local storage, software development kits, logs and similar technologies used on our websites and Platform. These technologies can be placed by GNR Media or by providers acting for us.

Strictly necessary technologies

Support security, authentication, load balancing, fraud prevention, forms, sessions, checkout and core website or Platform functions. These are generally active because the service cannot operate properly without them.

Preference and functional technologies

Remember settings, choices, language, display preferences and other convenience features.

Analytics and performance technologies

Measure visits, engagement, errors, traffic sources, feature use and service performance so we can understand and improve the experience.

Advertising and social technologies

Measure campaigns, limit repeated advertising, build audiences, attribute conversions and support advertising or social-media features.

Where law requires consent, non-essential technologies are not activated until the user makes a valid choice through the cookie banner or preference tool. Users can reject non-essential categories and later change or withdraw a choice through the available cookie settings. Accepting the Terms or acknowledging this Privacy Policy or Cookie Policy does not itself constitute consent to non-essential technologies.

Browser controls may also block or delete cookies, but doing so can affect functionality. We process recognised opt-out preference signals, including Global Privacy Control, where required by applicable law and technically received by our systems. We do not respond to every browser “Do Not Track” signal because there is no single universal standard.

14. Marketing communications

We may send service, billing, account, security and legal notices where necessary to administer a relationship. These are not promotional messages and may continue while an account or obligation remains active.

We send promotional email, SMS or other electronic marketing only where permitted by applicable law. Depending on the jurisdiction and relationship, this may be based on consent, an existing-business relationship, legitimate interests or another permitted basis.

You may stop promotional communications by:

• using the unsubscribe link in an email;
• replying STOP to an SMS where that function is available;
• changing available account preferences; or
• emailing [email protected].

We may retain a minimal suppression record so that we can honour an opt-out. Unsubscribing from GNR Media marketing does not automatically unsubscribe a person from a Client's separate campaign, and vice versa.

15. Data retention

We retain personal information only for as long as reasonably necessary for the relevant purpose, Client instruction, contractual licence, security, backup cycle, legal obligation, dispute or legal claim. The following are our general retention settings or criteria; an Order, the Data Processing Addendum, provider capability or law may require a different period.

When retention is no longer justified, we take reasonable steps to delete, destroy or de-identify the information. Information may remain temporarily in secure backups until the normal backup cycle completes.

16. Security and data breaches

We use technical and organisational measures appropriate to the nature and risk of the information. Depending on the system, these may include access controls, role-based permissions, multi-factor authentication where available, encryption in transit, secure hosting, backups, logging, monitoring, confidentiality obligations, provider due diligence, staff and contractor controls, incident response and data minimisation.

No internet transmission, software platform or storage system is completely secure. We cannot guarantee absolute security, continuous availability or that a determined attacker will never defeat safeguards.

We investigate suspected incidents and notify Clients, affected individuals and regulators where required by applicable law, including applicable Australian data-breach rules and European or United Kingdom breach-notification requirements.

Clients and users must use strong unique passwords, protect credentials and devices, limit account access, promptly remove former users and notify us at [email protected] if they suspect unauthorised access or disclosure.

17. Privacy rights and requests

Privacy rights vary by location, our role and the lawful basis. Subject to applicable conditions and exceptions, a person may have rights to:

• know whether and how personal information is processed;
• access or receive a copy of personal information;
• correct inaccurate or incomplete information;
• delete or erase information;
• restrict or limit processing;
• receive portable information in a commonly used format;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent for future consent-based processing;
• opt out of sale, sharing, targeted advertising or qualifying profiling where a United States state law provides that right;
• obtain human review of a qualifying automated decision;
• not be discriminated or retaliated against for exercising a privacy right; and
• complain to a privacy regulator or appeal a denied request where the law provides that right.

17.1 How to make a request

Email [email protected] with the subject line Privacy Request. Please state:

1. your name and preferred contact method;
2. the business, Client, account or service involved;
3. the right you want to exercise; and
4. enough detail for us to locate the relevant information.

We may request proportionate information to verify identity, authority or the scope of the request. We will not require more information than reasonably necessary. An authorised agent may act where permitted, but we may verify the agent's authority and, where lawful, confirm the request directly with the individual.

We respond within the period required by applicable law. Requests are generally free, although a reasonable fee or refusal may be permitted for manifestly unfounded, excessive or repetitive requests.

A right may not apply where GNR Media is acting only for a Client, the information cannot be linked to the requester, retention is legally required, the request would adversely affect another person's rights, or an exemption applies. We will explain a refusal where required.

17.2 Appeals

If we deny a request and your applicable United States state law provides an appeal right, reply to the decision with the subject Privacy Appeal within 45 days. We will review the decision and explain the outcome and any regulator contact available to you.

18. Australia privacy notice

Where the Privacy Act 1988 and Australian Privacy Principles apply, GNR Media manages personal information in accordance with those requirements.

In particular:

• you may request access to or correction of personal information we hold about you;
• where practical and lawful, you may interact anonymously or using a pseudonym, although identification is generally required for subscriptions, contracts, billing, account access and service delivery;
• we disclose the likely overseas handling described in clause 12;
• you may complain about our handling of personal information by contacting us; and
• we will investigate and respond within a reasonable period.

If you are not satisfied after giving us a reasonable opportunity to resolve the matter, you may contact the Office of the Australian Information Commissioner.

19. EEA and UK privacy notice

This clause applies where the EU GDPR, EEA-equivalent law or UK GDPR applies to GNR Media's processing.

19.1 Controller and contact

The controller is GNR Media Pty Ltd, ABN 80 668 188 289, Melbourne, Victoria, Australia. Privacy enquiries may be sent to [email protected].

GNR Media does not currently maintain an establishment in the EEA or United Kingdom. Before beginning targeted offering or monitoring that legally requires an Article 27 representative, GNR Media will appoint the required representative and publish its details in this Policy.

19.2 Required information

Clauses 4 to 6 explain the categories, sources, purposes, lawful bases and legitimate interests. Clause 10 explains recipients, clause 12 explains international transfers, clause 15 explains retention, and clause 17 explains rights and request methods.

Account, billing, business and service information is generally required to enter into or perform a contract. If required information is not provided, we may be unable to create the account, process payment, connect services, perform the work or provide support.

19.3 Rights

Subject to applicable conditions and exceptions, you may request access, rectification, erasure, restriction, portability and human review of a qualifying automated decision. You may withdraw consent for future consent-based processing and complain to the supervisory authority in the country where you live, work or believe an infringement occurred.

EEA supervisory authorities are listed by the European Data Protection Board. In the United Kingdom, you may complain to the Information Commissioner's Office.

20. United States state privacy notice

This clause supplements the rest of the Policy for residents of United States states with applicable comprehensive privacy laws. The rights and obligations apply only where GNR Media meets the law's scope and the relevant information is not exempt.

20.1 Notice at collection and preceding 12 months

The table below describes California statutory categories and equivalent information that GNR Media may have collected in the preceding 12 months. It also states the general business-purpose disclosures. The examples are illustrative and not every item is collected about every person.

Sources are described in clause 5. Business and commercial purposes are described in clause 6. Categories of recipients are described in clause 10.

20.2 Sale, sharing and targeted advertising

• GNR Media has not sold personal information for monetary consideration in the preceding 12 months.
• GNR Media does not knowingly sell or share personal information of consumers under 16 years of age.
• GNR Media does not intentionally sell or share Client account data, Client CRM data, Marketing Passport® information or Publicity Materials for cross-context behavioural advertising.
• Website identifiers and internet activity may be processed by analytics, social-media or advertising providers. Where a state law treats that disclosure as a sale, sharing or targeted advertising, a resident may opt out through available cookie controls, a recognised Global Privacy Control signal or a request to [email protected].

20.3 Sensitive personal information

We use sensitive personal information only for purposes reasonably necessary to provide, secure and administer the Services, process payments, verify access, comply with law and prevent fraud. We do not use it to infer characteristics or for purposes that would require a separate right-to-limit notice unless we first provide that notice and mechanism.

20.4 Rights

Depending on the state and applicable thresholds, a resident may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising or qualifying profiling, limit certain sensitive-information uses, appeal a denial and avoid discrimination or retaliation.

Requests may be made under clause 17. We verify requests by matching information reasonably related to the account, transaction or interaction. We may ask for signed authority from an authorised agent. Opt-out requests do not require account creation.

20.5 Opt-out preference signals

Where required, we treat a technically received Global Privacy Control or other legally recognised opt-out preference signal as a request relating to the browser or device that sends it. If the signal can be linked to a logged-in account, we may apply it more broadly as required by law.

20.6 Rewards and financial incentives

GNR Media may offer rewards, referral benefits, affiliate commissions, fee splits or collaboration payments under the Program Terms and an applicable Card. Those benefits are offered for qualifying business activity or commercial contribution, not in exchange for the sale or sharing of personal information.

If a particular Program is treated as a financial incentive or price or service difference under an applicable United States state privacy law, GNR Media will provide any additional notice required before enrolment, including the material terms, how to participate or withdraw, and the method used to estimate the value of the relevant information.

20.7 California direct-marketing disclosure

California residents may ask about certain disclosures of personal information to third parties for those parties' own direct-marketing purposes. GNR Media does not disclose personal information to unaffiliated third parties for their own direct marketing without an applicable legal basis and required choice.

21. Children and sensitive information

GNR Media's websites and Services are intended for adults acting in a business or professional capacity. A person must be at least 18 years old to create an account or purchase the Services.

We do not knowingly collect personal information from children under 13, knowingly sell or share personal information of people under 16, or direct behavioural advertising to children. If you believe a child has provided information to us, contact [email protected] so we can investigate and take appropriate action.

Clients must not upload children's information, health information, government identifiers, biometric data, payment card details, passwords or other sensitive information unless it is necessary, lawful, specifically authorised and supported by an appropriate written process.

22. Third-party sites and services

Our websites and Services may link to, embed, connect with or rely on third-party services, including HighLevel, payment processors, hosting providers, search engines, social networks, advertising platforms, analytics tools, AI providers and external publishers.

A third party may collect information under its own terms and privacy policy, particularly where a user has a separate account with that provider or follows a link away from GNR Media. We do not control a third party's independent privacy practices, algorithms, retention, security or legal obligations.

Where the third party acts as our processor or service provider, we take reasonable steps appropriate to the relationship. Where it acts independently, users should review that provider's privacy information.

23. Changes, complaints and contact

23.1 Changes to this Policy

We may update this Policy when our Services, Programs, providers, practices or legal obligations change. The current version will show its effective and update dates. If a change materially affects how existing personal information is used, we will provide additional notice where required by law or contract.

Previous versions should be retained with the relevant Terms, Order or Card and acceptance record so that the applicable version can be identified.

23.2 Privacy complaints and the correct process

For a privacy complaint or privacy-right request, describe the issue, the relevant account or Client, the information involved and the outcome you seek. We will acknowledge, investigate and respond within a reasonable period and within any mandatory legal timeframe.

A copyright, trade mark, defamation, privacy-in-content, image, voice, publicity or illegal-content complaint should use the Content and Rights Complaints Policy. A reward, referral attribution, commission, fee-split or Program payment dispute should use the process in the Program Terms. A request to change cookie preferences should use the available cookie settings described in the Cookie Policy.