OneSearch EMEA Privacy Notice

1. Overview

About this Privacy Notice

This Privacy Notice describes Yahoo EMEA Limited's data processing practices regarding the collection and use of your personal data when using our OneSearch Services. The notice also sets out your privacy rights and how to exercise those rights. It applies to our consumer customers that use OneSearch, but doesn’t apply to the information we hold about companies or organisations. This Privacy Notice applies to individuals using the OneSearch Service who are located in Europe, the Middle East and Africa.

Please read this Privacy Notice carefully as it applies to the OneSearch Services we provide to you from the EMEA region.

Date of last update

This Privacy Notice was last updated on March 24, 2021.

Changes since the last version

We may amend this Privacy Notice from time to time (see Section 10) and where these changes are material we will endeavour to give you reasonable notice of these changes.

How to read this Privacy Notice

Technology is a fast changing area and can be complicated. To help you understand our policy, we have included a glossary which explains the meaning of any technical terms we use. Throughout this policy we have highlighted in bold font key technical terms which we have included a definition for in the glossary.

Links to previous version of this privacy notice

Who we are

The OneSearch Services are operated by Yahoo EMEA Limited (“Yahoo”, “we”, “our”, or “us”), a registered company established under the laws of Ireland and located in 5-7 Point Square, North Wall Quay, Dublin 1, Ireland. Yahoo EMEA Limited provides the OneSearch Service to you and is the Controller of the Personal Data processed when you use the OneSearch Service.

Which services are covered?

This Privacy Notice applies only to the following OneSearch Services:

This Privacy Notice describes to you, the user, our data processing practices for this Service (also referred to as the “OneSearch Service”, “OneSearch Services” or “Services”). It informs you about the limited collection, transfer, Encryption, storage, and disclosure of your information for the purposes of providing this Service.

Yahoo is headquartered in Ireland and as such, the processing will be subject to European and Irish laws.

What is not covered/under our control

This Privacy Notice only covers OneSearch Services that we control. This Privacy Notice does not cover any collection and further processing of Personal Data by:

2. Glossary

This section explains the terms used within this Privacy Notice whose meaning may not be immediately obvious. Wherever we have used these terms in the Privacy Notice we have Bolded and Capitalized them to indicate that a definition for them is provided in this section.

3. What Data Do We Collect, How We Use It and Why We Do This

In this section we describe what Personal Data we collect, why we collect it and how we process it. When you make a search no Personal Data will be transferred to our Search Provider or any Search Partner unless you identify yourself or anyone else in the Search Query.

When you input a Search Query into the OneSearch Service your IP Address, the Search Query and User Agent will be securely transferred from your browser to our Search Stack.

We need to process your IP Address, User Agent and Search Query together to fulfil your search. We derive your imprecise Location Data from your IP Address so that we can tailor the search results to you and your location. The provision of this limited data is necessary to provide the OneSearch Service to you and if it is not provided we will not be able to perform the OneSearch Service.

We will also process your location when you choose to give it to us using the Set Location Functionality. We do this so that we can provide location specific search results (e.g., if you search "flower shops" then flower shops in your city or area may be provided in the results).

When we fulfil a search request we will transfer your Obfuscated IP Address, Search Query and User Agent to our Search Provider to process. Our Search Provider is not able to link a Search Query back to you, as your IP Address is Obfuscated before we send it to them.

We may also carry out Search Optimization, by including information from Search Partners who receive your Search Query and general geolocation. We then provide search results to your browser so that you can see them.

Very shortly (i.e., within seconds) after a Search Query has been completed, we will store your IP Address, Search Query and User Agent in different servers in such a way that they should not be capable of being connected. From that point we are not able to tell what IP Address any Search Query has come from. The only Personal Data which we then hold about you is your IP Address, unless you have identified yourself in the Search Query or through the Set Location Functionality (e.g., by inputting your name or home address).

When you make a search we also process your IP Address for the purpose of Network Traffic Protection. We continue to store and process your IP Address for this purpose for four days. After this we permanently delete your IP Address. Any Personal Data provided through a Search Query or through the Set Location Functionality may be stored for a longer period, in accordance with general retention criteria for those functions.

The Search Provider stores the User Agent, Search Query, and Obfuscated IP Address information we send to them for a period of time. If you click on a sponsored search result (identified as an ad), the Search Provider will collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may collect your IP Address.

4. Legal basis for processing your Personal Data

To provide the OneSearch Service, VME processes your Personal Data (i.e., the limited Personal Data points mentioned above) to conduct the following processing operations, for the following purposes and associated legal bases.

Purposes and Sets of Processing Operations

Legal Bases

  • To provide you with the OneSearch Services we:

    - Process your Search Queries to provide you with matching or relevant search results; and

    -  Check your IP Address and related location signals to understand where you are located to identify and provide you with relevant search results.
  • Necessary to perform the contract with the user.
  • Yahoo’s and the User’s legitimate interests, in delivering/receiving high quality search results when receiving / providing the service.
  • For security purposes, including to detect and defend against fraudulent, abusive or unlawful activity we:

    -  Check your IP Address and related location signals to look for anomalous events which might undermine or threaten our Services (e.g., Network Traffic Protection); and

    -  Access, preserve, and share data with government agencies and third parties to protect you and the general public, prevent infringement of our Terms or violations of third parties’ rights and to assist in the prevention, investigation, detection or prosecution of criminal offences, or other unlawful activity.

 

  • Yahoo’s and User’s legitimate interests in carrying out these activities to keep the services safe and secure.
  • To comply with legal obligations.

 

 

5. Encryption and short term storage of browser history

When you click the search button, the URL of the webpage that comes up on your browser with your search results will be encrypted so the term(s) you have searched for will not be found in, or identifiable from, the URL. Certain of the information contained in the URL relates to a Where on Earth ID which is a numerical value that can be associated with a generalised geolocation relating to the target location of your search. This URL expires after an hour, eliminating your search history. Further information about this part of the Service, and the Encryption used, can be found here.

The retention periods of the limited types of data which we collect stemming from your use of the OneSearch Service are set out below.

Type of Data

OneSearch Retention Period

IP Address

4 days

Search Query

180 days

User Agent

180 days

Location Data

180 days

6. With whom we share your Personal Data

Except as necessary to provide the Services, we never share Personal Data we receive from you unless: (a) we have your separate and explicit permission to share that information; or (b) we have given you prior notice that the information will be shared, and with whom (such as in this Privacy Notice).

Legal Obligations and Terms of Service Enforcement: We reserve the right to access, preserve and disclose any Personal Data to investigate, prevent, or take action in connection with legal process and legal requests, and for enforcement of the Terms of Service.

We share data with our service providers (sometimes referred to as “processors”) that work on our behalf and process your data solely at our direction. The following service providers help us provide the OneSearch Service:

If you enter Personal Data or location information like your address in the Search Query it will be shared with these service providers.

7. How do we protect your data?

We have implemented the appropriate technical and organizational measures to ensure a level of security in relation to your Personal Data that is appropriate to any risk associated with it.

Your Personal Data is processed and stored in servers that are located in Ireland and the USA, (see Section 9 below).

8. How to exercise your rights

Under the General Data Protection Regulation (“GDPR”), you have certain privacy rights. In particular, if you are a resident in the European Union, you have the right to information, access, restriction or correction of your Personal Data. In addition, you may request data portability, or in certain circumstances, object to the processing of your data or request deletion of your data. If you wish to exercise any of these rights, you can do so at any time by contacting us through the methods described in Section 11 (“Contact us”) below.

Given how OneSearch stores and retains data, users can exercise their rights under GDPR, but because VME do not keep any Personal Data (i.e., IP Addresses) for longer than four days, there may be nothing to return to users and no Personal Data for users to request, delete, or restrict.

If your Personal Data appears in search results displayed on OneSearch you can exercise your right to be forgotten (even if you are not a user of the service.) To exercise your right to be forgotten regarding search results provided via OneSearch then please, click here. Further information about Personal Data processing related to search results can be found here.

User technical support is provided by VME, and any data provided towards receiving customer support is governed by the policy presented to the user during the support request process.

You have the right to complain about our collection and use of your Personal Data. If you wish to exercise any of these rights, you can do so at any time by contacting us through the methods described in Section 11 (“Contact us”) below.

If you do have any concerns related to processing of Personal Data then please feel free to contact us (see details in Section 11 below) directly to try to resolve your concern. Without prejudice to any other rights you may have, you also have the right to file a complaint against us with the Irish Data Protection Commission, Yahoo’s lead supervisory authority. You can also complain to your local supervisory authority. Click here to find your local European supervisory authority.

9. International data processing

Any Personal Data that you provide to us when interacting with our Services will be transferred to the USA. In the event a user enters Personal Data as a Search Query or through the Set Location Functionality, then this Personal Data may be transferred to or another country where we have engaged a Search Provider, Search Partner or from which we operate the Service.

Some countries that are not located within the EEA may be recognized by the European Commission to provide an adequate level of data protection. For transfers from the EEA to countries that are not considered as adequate by the European Commission, such as the USA, we have put in place measures and safeguards to protect your personal information. In particular when we transfer information to the USA we rely on Standard Contractual Clauses. The Standard Contractual Clauses are available through the European Commission here and you may request a copy of the Standard Contractual Clauses which we have entered into with the entities processing your data by contacting us (note that certain commercial information may be redacted).

10. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time, using the process for modifications set forth in our Terms of Service. Use of any information we collect is subject to the Privacy Notice in effect at the time such information is collected.

11. Contact Us

If you would like to contact us for any reason then please use our contact form which can be found here, or at this address:

Yahoo EMEA Limited
Attention: Member Services
5-7 Point Square
North Wall Quay
Dublin 1
Ireland

For a faster response we recommend using our online contact form.

If your query relates to the processing of your Personal Data or you wish to exercise your rights, you can contact our Data Protection Officer by email at dpo-contact@yahooinc.com or by post at:

Yahoo EMEA Limited
Attention: Data Protection Officer
5-7 Point Square
North Wall Quay
Dublin 1
Ireland

For a faster response we recommend using email.

12. Change in ownership

If the ownership or control of all or part of Yahoo or the OneSearch Service is proposed to change as a result of a merger, acquisition or sale of assets, as we only store the complete IP Address for four days for Network Traffic Protection, we most likely would not transfer Personal Data as described in Sections 2 and 3 above to the new (or prospective) owner as part of the transfer of OneSearch. We will notify you of any such changes in advance.