OneSearch International Privacy Notice

1. Overview

About this Privacy Notice
This Privacy Notice describes Yahoo's data processing practices regarding the collection and use of your Personal Data when using our OneSearch Service in Canada, Australia, Brazil, Hong Kong, Indonesia, India, Singapore, the Philippines, Taiwan, Argentina, Chile, Columbia, Mexico, Peru, and Venezuela. The notice also sets out your privacy rights and how to exercise those rights. It applies to our consumer customers that use OneSearch, but doesn’t apply to the information we hold about companies or organizations. 

Please read this Privacy Notice carefully as it applies to the OneSearch Service we provide to you.

Date of last update
This Privacy Notice was last updated in April, 2022.

Changes since the last version
Since the last version, the fraud detection process has been updated, and this notice has been updated to reflect this update. Product functionality added since the launch has not changed our privacy practices.

We may amend this Privacy Notice from time to time (please see Section 12) and where these changes are material we will endeavour to give you reasonable notice of these changes through the OneSearch website, app or browser extension.  

How to read this Privacy Notice
Technology is a fast changing area and can be complicated. To help you understand our policy, we have included a glossary which explains the meaning of any technical terms we use. Throughout this policy we have highlighted in bold font key technical terms which we have included a definition for in the glossary.
Previous version of this privacy notice

Who we are
The offering entity for the OneSearch Service (“Yahoo”, “we”, “our”, or “us”) is defined by jurisdiction in the Terms of Service sections titled “Provider of Services” and “Contracting Party, Choice of Law, and Location for Resolving Disputes and Other Local Region Provisions.” Yahoo provides the OneSearch Service to you and is the Controller of the Personal Data processed when you use the OneSearch Service. 

Which services are covered?
This Privacy Notice applies only to the following services provided by the OneSearch Service: 

This Privacy Notice describes to you, the user, our data processing practices for this Service (also referred to as the “OneSearch Service”). It informs you about the limited collection, transfer, Encryption, storage, and disclosure of your information for the purposes of providing this Service.

Legal jurisdiction
The applicable legal jurisdiction for the OneSearch Service is defined by jurisdiction in the Terms of Service sections titled “Provider of Services” and “Contracting Party, Choice of Law, and Location for Resolving Disputes and Other Local Region Provisions.”

What is not covered/under our control
This Privacy Notice only covers the services provided by the OneSearch Service that we control. This Privacy Notice does not cover any collection and further processing of Personal Data by:

Specific points related to OneSearch Apps 
Please note that the OneSearch Apps provide web browser services along with their search engine services. They can also be used as your default web browser for your mobile device. In relation to these functions it is important for you to realise that:

2. Glossary
This section explains the terms used within this Privacy Notice whose meaning may not be immediately obvious. Wherever we have used these terms in the Privacy Notice we have Bolded and Capitalized them to indicate a definition for them is provided in this section.

3. What Data Do We Collect, How We Use It and Why We Do This
In this section we describe what Personal Data we collect, why we collect it and how we process it. 

In order to test the processes that we use, your search may be completed through one of two different systems (what is sometimes known as "A/B" or "bucket" testing). The systems are similar in many ways but not the same. The decision about which system your search is processed through is random and cannot be manually decided by you. 
The data processing that takes place through the first system ('System A') is explained below in section 3(a) and the data processing that takes place through the second system ('System B') is explained below in section 3(b).

3(a) Data processing through System A
When you make a search no Personal Data will be transferred to any Search Partner unless you identify yourself or anyone else in the Search Query.

When you input characters into the OneSearch search field, the characters you input will be used for the Search Assist functionality. When you confirm a Search Query, your IP Address, the Search Query and User Agent will be securely transferred from your browser to our Search Stack.

We need to process your IP Address, User Agent and Search Query together to fulfill your search. We derive your imprecise Location Data from your IP Address so that we can tailor the search results to you and your location. The provision of this limited data is necessary to provide the OneSearch Service to you, and if it is not provided, we will not be able to perform the OneSearch Service.

We will also process your more specific or different location when you choose to give it to us using the Set Location Functionality. We do this so that we can provide location-specific search results (e.g., if you search "flower shops" then flower shops in the city or area that you select may be provided in the results).

We provide your IP Address and User Agent to our Search Provider so that they can undertake Network Traffic Protection processing with this data for 90 days. This includes producing a Fraud Score.

To fulfil your search, we provide a Token, your Search Query, Location Data, User Agent and Fraud Score to our Search Provider. This means that it should not be possible for the Search Provider to connect your Search Query with your IP Address because the one-time Token is used in place of your IP Address.

After a Search Query has been completed, Yahoo will store your IP Address and User Agent in different servers in such a way that they should not be capable of being connected. From that point, we are not able to tell which IP Address any Search Query has come from.  

If you click on a sponsored search result (identified as an ad), the Search Provider will collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may collect your IP Address.

3(b) Data processing through System B
When you make a search no Personal Data will be transferred to our Search Provider or any Search Partner unless you identify yourself or anyone else in the Search Query.

When you input characters into the OneSearch search field, the characters you input will be used for the Search Assist functionality. When you confirm a Search Query, your IP Address, the Search Query and User Agent will be securely transferred from your browser to our Search Stack.

We need to process your IP Address, User Agent and Search Query together to fulfill your search. We derive your imprecise Location Data from your IP Address so that we can tailor the search results to you and your location. The provision of this limited data is necessary to provide the OneSearch Service to you, and if it is not provided, we will not be able to perform the OneSearch Service.

We will also process your more specific or different location when you choose to give it to us using the Set Location Functionality. We do this so that we can provide location-specific search results (e.g., if you search "flower shops" then flower shops in the city or area that you select may be provided in the results).

When we fulfill a search request we will transfer your Obfuscated IP Address, Search Query, Location Data and User Agent to our Search Provider to process. Our Search Provider is not able to link a Search Query back to you, as your IP Address is Obfuscated before we send it to them.

3(c) Data processing common to both System A and System B
We may also carry out Search Optimisation by including information from Search Partners who, in some cases, receive your Search Query and Location Data. We then provide search results to your browser so that you can see them.

Very shortly (i.e., within seconds) after a Search Query has been completed, we will store your IP Address, Search Query and User Agent in different servers in such a way that they should not be capable of being connected. From that point, we are not able to tell which IP Address any Search Query has come from. The only Personal Data which we then hold about you is your IP Address, unless you have identified yourself in the Search Query or through the Set Location Functionality (e.g., by inputting your name or home address).

When you make a search, we also process your IP Address for the purpose of Network Traffic Protection for a period of 4 days. 

If you click on a sponsored search result (identified as an ad), the Search Provider will collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may collect your IP Address.

4. Legal basis for processing your Personal Data 
To provide the OneSearch Service, Yahoo processes your Personal Data (i.e., the limited Personal Data points mentioned above) to conduct the following processing operations, for the following purposes and associated legal bases.

Please note that in local jurisdictions where your consent is required for all / any of the personal data processing described below (e.g. Indonesia, Singapore, Canada, the Philippines and Peru) then consent is the relevant legal basis for the processing, rather than what is stated in the table below. You can withdraw your consent, with future effect, by contacting us through the details provided in section 12 below, noting that any processing of your personal data will generally not take place after four days in any case.

Purposes and Sets of Processing Operations Legal Bases

To provide you with the OneSearch Service we: 

- Process your Search Queries to provide you with relevant search results; and 

-  Check your IP Address and related location signals to understand where you are located to identify and provide you with relevant search results. 

  • Necessary to perform the contract with the user.
  • Yahoo’s and the User’s legitimate interests in delivering/receiving high quality search results when providing / receiving the service.

For security purposes, including to detect and defend against fraudulent, abusive or unlawful activity we: 

-  Check your IP Address and related location signals, as well as User Agent,  to look for anomalous events which might undermine or threaten our Service (e.g., Network Traffic Protection); and

-  Access, preserve, and share data with government agencies and third parties to protect you and the general public, prevent infringement of our Terms or violations of third parties’ rights and to assist in the prevention, investigation, detection or prosecution of criminal offences, or other unlawful activity.

  • Yahoo’s and User’s legitimate interests in carrying out these activities to keep the services safe and secure.
  • To comply with legal obligations.


5. Encryption and short term storage of browser history
When you click the search button, the URL of the search results page that comes up on your browser, on our browser extension or on the OneSearch Apps will be encrypted so the term(s) you have searched for will not be found in, or identifiable from, the URL. Certain of the information contained in the URL relates to a Where on Earth ID, which is a numerical value that can be associated with a generalised geolocation relating to the target location of your search. This URL expires after an hour if OneSearch Advanced Privacy Mode was enabled when the Search Query was submitted. Further information about this part of the Service, and the Encryption used, can be found here

6. Retention
Yahoo and its Search Provider retain the limited types of data, which we collect stemming from your use of the OneSearch Service, for the periods set out below, except where it is retained in exceptional circumstances to comply with a legal obligation or address a security, fraud, or legal incident (please see sections 4 and 8 for more information on this topic). 

Type Of Data Yahoo Retention Period Search Provider
IP Address 4 days 90 days
Obfuscated IP Address N/A 180 days
Search Query 180 days 180 days
User Agent 180 days 90 days
Location Data 180 days 18 months

 

7. With whom we share your Personal Data
Except as necessary to provide the Service, we never share Personal Data we receive from you unless: (a) we have your separate and explicit permission to share that information; or (b) we have given you prior notice that the information will be shared, and with whom (such as in this Privacy Notice).

We share data with our service providers (sometimes referred to as “processors”) that work on our behalf and process your data solely at our direction. The following service providers help us provide the OneSearch Service: 

 

If you or anyone else enters Personal Data or location information like your or someone else's address in the Search Query or Set Location Functionality, it will be shared with these service providers. 

8.  Legal Obligations and Terms of Service Enforcement
We reserve the right to access, preserve and disclose any Personal Data to investigate, prevent, or take action in connection with legal process and legal requests, and for enforcement of the Terms of Service.

9. How do we protect your data?
We have implemented the appropriate and reasonable technical and organizational measures to ensure a level of security in relation to your Personal Data that is appropriate to any risk associated with it.

Your Personal Data is processed and stored in servers that are located in Ireland, Singapore, Taiwan, and the USA, (please see Section 11 below for information about international transfers).

10. How to exercise your rights
You have certain privacy rights in relation to your use of the OneSearch Service. In particular, you have the right to information, access, restriction or correction of your Personal Data. In addition, you may request data portability, or in certain circumstances, object to the collection, processing or use of your data or request deletion of your data. You may also have additional rights based on your local jurisdiction. If you wish to exercise any of these rights, you can do so at any time by contacting us through the methods described in Section 13 (“Contact us”) below. Given how OneSearch stores and retains data, users can exercise their rights, but because Yahoo do not keep any Personal Data (i.e., IP Addresses) for longer than four days (unless the user enters Personal Data into the Search Query), there may be nothing to return to users and no Personal Data for users to request, delete, or restrict.

For users based in Argentina, if your Personal Data appears in search results displayed on OneSearch you can exercise your right to be forgotten (even if you are not a user of the service.) To exercise your right to be forgotten regarding search results provided via OneSearch then please, click here. Further information about Personal Data processing related to search results can be found here.

User technical support is provided by Yahoo, and any data provided towards receiving customer support is governed by the policy presented to the user during the support request process. 

You have the right to complain about our collection and use of your Personal Data. If you wish to exercise any of these rights, you can do so at any time by contacting us through the methods described in Section 13 (“Contact us”) below.

If you do have any concerns related to processing of Personal Data then please feel free to contact us (see details in Section 13 below) directly to try to resolve your concern. Without prejudice to any other rights you may have, you also have the right to file a complaint against us with your local data protection / privacy authority. These include:

Specific rights in Brazil
If you are a Brazilian resident, under the Brazilian General Data Protection Law (“LGPD”),  you have the right to access, rectify, port, erase or anonymize data, and confirm that we process personal information. In certain circumstances, you may also have the right to object to the processing of your personal data and request certain details about how we share your personal data with third parties. You also have the right to lodge a petition with the Brazilian Data Protection Authority. If you wish to exercise any of these rights, you can do so at any time by contacting us through the methods described in Section 13 (“Contact us”) below.

11. International data processing
Any Personal Data that you provide to us when interacting with our Service will be transferred to our Search Stack in the USA. In the event a user enters Personal Data as a Search Query or through the Set Location Functionality, then this Personal Data may be transferred to another country where we have engaged a Search Provider or Search Partner

12. Changes to this Privacy Notice
We may amend this Privacy Notice from time to time, using the process for modifications set forth in our Terms of Service. Use of any information we collect is subject to the Privacy Notice in effect at the time such information is collected.

13. Contact Us
If you would like to contact us for any reason then please use our contact form which can be found here, or at this address (note that Cookies may be used if you click on this link):

Yahoo
Attention: Member Services
1199 Coleman Ave
San Jose
CA 95110
USA

For a faster response we recommend using our online contact form.

If your query relates to the processing of your Personal Data or you wish to exercise your rights, you can contact our Data Protection Officer by email at dpo-contact@yahooinc.com or by post at:

Yahoo
Attention: Data Protection Officer
1199 Coleman Ave
San Jose
CA 95110
USA
For a faster response we recommend using email.

14. Change in ownership 
If the ownership or control of all or part of Yahoo or the OneSearch Service is proposed to change as a result of a merger, acquisition or sale of assets, we most likely would not transfer Personal Data, as described in Sections 2 and 3 above, to the new (or prospective) owner as part of the transfer of OneSearch. We will notify you of any such changes in advance. 

15. Impact if you choose not to provide personal data
You may choose to provide or not to provide the relevant personal data required for the OneSearch Service to operate. In the case that you refuse to provide the relevant personal data, Yahoo and other entities entrusted by Yahoo may not be able to provide the Service.