The data controller is MPG Media Group, Oscar Romerolaan 14, 1216 TK Hilversum, the Netherlands, together with – depending on the relevant service – its group companies, including Your Channels Benelux B.V., Your News & Entertainment Channels Benelux B.V., Your Music Channels Benelux B.V., Your Content Store B.V., Your Platform B.V., Your Ad Sales Benelux B.V., and StoryZoo & Friends B.V.. For specific services, a particular group company may act as the controller. Where relevant this is shown in your account, in‑app or via the relevant platform. In some cases, a platform (e.g. an operator or TV manufacturer) acts as an independent controller for viewer data it collects itself. In such case, please also consult the privacy notice of that platform.

This notice applies to: • Our websites, apps and customer support; • Our FAST channels and other linear/OTT distribution via partners (e.g. Samsung TV Plus, operators); • Our commercial activities (including ad sales via partners).

We only process what is necessary for the purposes below. For each purpose we state the legal basis under the GDPR (Article 6). A. Account and contact data (name, email, place of residence, language preferences) • Purposes: create account, provide services, support • Legal basis: performance of a contract / pre‑contractual steps (Art. 6(1)(b)) B. Usage and viewing data (content viewed, searches and clicks, timestamps, device and app settings) • Purposes: personalization (recommendations), analytics, service improvement, abuse prevention • Legal basis: legitimate interests (Art. 6(1)(f)) C. Device data (operating system, device type, technical identifiers) • Purposes: technical delivery, troubleshooting, security • Legal basis: performance of a contract / legitimate interests (Art. 6(1)(b)/(f)) D. Transaction and payment data (bank/card details via payment provider, invoicing data) • Purposes: payment processing, financial administration • Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (tax retention) (Art. 6(1)(c)) E. Marketing & communications (preference lists, open/click data) • Purposes: newsletters, channel promotions, campaigns (including from partners) • Legal basis: consent (Art.6(1)(a)) or – for B2B contacts – legitimate interests with an easy opt‑out (Art. 6(1)(f)) • NL‑specific (Telecommunications Act/Telecommunicatiewet): consumer email generally requires prior consent unless the “existing customer” exception applies (with opt‑out). B2B emails are sent on an opt‑out basis. We do not sell personal data.

In addition to data you provide directly, we may receive data – depending on the service – from distribution/platform partners (e.g. smart‑TV platforms, operators), adtech and measurement partners, payment providers and fraud/security service providers. This may include viewing and interaction data, technical identifiers and campaign/conversion metrics. Where such parties are located outside the EEA, we apply the safeguards described in §7 International transfers.

We use functional cookies (necessary), analytics cookies (implemented with privacy‑friendly settings) and – only with your consent – advertising and personalization technologies (e.g. advertising IDs such as IDFA/GAID, SDKs and pixels). You can manage your choices through our cookie banner (CMP). Our cookie policy lists, per vendor, the purpose, retention period and whether data is transferred outside the EEA.

We share data where necessary with: • Service providers/processors (hosting, security, analytics, playout, payment services, customer support, identity/consent management). We conclude data processing agreements and appropriate security terms with these parties. • Adtech and sales partners (DSP/SSP/ad exchanges, measurement and anti‑fraud services, data clean rooms, CMPs, sales partners such as programmatic via Talpa) strictly within your consent choices. • Distribution partners (e.g. FAST platforms, operators) for distribution and reporting. • Legal obligations (e.g. regulators, tax authorities) or to protect our rights. • Corporate transactions (merger/acquisition/reorganization): the acquirer must respect this notice.

Where data is transferred outside the EEA, we use an appropriate mechanism, such as an EU adequacy decision (including the EU‑US Data Privacy Framework for certified organizations) or EU Standard Contractual Clauses (SCCs) with supplementary measures where required.

• Account and service data: as long as your account is active plus up to 24 months after closure. • Logs/usage: 6–24 months (shortened where possible; anonymized for statistics). • Marketing data: until you withdraw consent or 24 months after last interaction. • Payment/financial data: 7 years (statutory retention). Periods may deviate where legally required or for the establishment, exercise or defense of legal claims.

We implement appropriate technical and organizational measures (including access controls, encryption where appropriate, logging, pseudonymization where possible and periodic reviews) to protect your data. In case of a personal data breach, we assess the risks and – where required – notify the Dutch Data Protection Authority within 72 hours and, where necessary, the affected individuals. We will inform you via email, our service or other appropriate channels.

Our services are intended for users aged 16 and over. Where legally required, we obtain (parental) consent for younger users – this may be facilitated via the relevant platform. We do not target personalized advertising to minors where this is not permitted. Access to age‑rated content follows the rules of, among others, Kijkwijzer/NICAM (for platform distribution).

For recommendations and – where permitted – personalized advertising, we may combine, among others, viewing history, interactions, device/app information and (where provided) marketing preferences. • You can object to marketing‑related profiling and change your consent in the settings; for recommendations you can reset preferences or disable profiles where available. • We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

You have the right to access, rectification, erasure, restriction, data portability and objection (including to direct marketing/profiling). Where processing is based on consent, you can withdraw it at any time. We may ask you to verify your identity (e.g. via account login or a verified email address). Requests are free of charge, except where they are manifestly unfounded or excessive. Send your request to legal@mpgmediagroup.com (mailto:legal@mpgmediagroup.com)or by post to the address in §14. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

When distributing via third parties (e.g. smart‑TV platforms or operators), those parties often process viewer data for their own purposes. In such cases they act as independent or – where we jointly determine purposes and means – joint controllers (Art. 26 GDPR). Essence of the joint‑controller arrangements (Art. 26 GDPR): • The platform is the primary contact for data it collects in its own environment (account, device ID, app‑store data); • MPG Media Group is the primary contact for data collected within our own services; • the parties inform each other in time about data subject requests and respond within legal time limits; • for questions you can contact us via §14; where appropriate we will refer you to the relevant platform.

MPG Media Group Oscar Romerolaan 14 1216 TK Hilversum The Netherlands Email: legal@mpgmediagroup.com (mailto:legal@mpgmediagroup.com)– Tel: +31 (0)35 20 33 500

We may update this notice to reflect legal or operational changes. We will publish the new version with an updated date and, where appropriate, actively inform you.