Commercial Radio & Audio Master Privacy Policy

Effective date: 21 August 2025

CRA respects your privacy and is committed to protecting your personal information.

At a Glance

Who we are: Commercial Radio & Audio (CRA), the peak industry body for commercial radio broadcasters in Australia.

What this covers: All CRA websites, apps, and digital services, including the CRA Corporate Website, DAB+ (digitalradioplus.com.au), RadioApp (mobile, smart speaker, in-car), and the All Ears Listener Panel.

What we collect: Contact and account details, preferences, survey responses, device/usage and analytics data, and (if you enable it) approximate location.

Why: To run our services, personalise and improve them, conduct audience measurement and research, measure campaigns (with consent), and meet legal obligations.

How: Directly from you, automatically via cookies/SDKs, and from service/measurement partners (often aggregated or de-identified).

Sharing: With service providers, participating broadcasters (for their own stations, usually de-identified/aggregated), measurement partners, and where required by law.

Your choices: Manage cookies/permissions, opt out of marketing, and request access/correction.

Overseas: Some processing occurs outside Australia, including in the United States and Europe.

1. Scope and Who We Are

This Privacy Policy explains how CRA collects, uses, and discloses information across:

• CRA Corporate Website (cra.au and related CRA pages)
• DAB+ Website (digitalradioplus.com.au)
• RadioApp (mobile apps, smart speakers, and in-car integrations)
• All Ears Listener Panel (via RadioApp invitation)
• Other CRA-managed platforms and services linked to this Policy.

We will comply with the requirements of the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the "Act") in the way that we handle, that is collect, store and use any "personal information" that we collect about you.

2. How We Collect Information

We collect information in three ways:

• Directly from you: When you submit forms, create an account, sign up to communications, join All Ears, register for events/webinars, or contact us.
• Automatically when you use our services: Through cookies, SDKs and similar technologies we record device/technical data, usage, and interaction events (e.g., page views, "listen" clicks, stream starts/stops).
• From service/measurement partners: We receive operational, analytics or measurement outputs from trusted partners that help us deliver services and produce aggregate industry insights. Where feasible, these are aggregated, de-identified, or pseudonymised before CRA receives them.

3. What We Collect (by service)

We collect personal information (as defined in the Act), meaning information or an opinion about you that identifies you or could reasonably identify you, whether true or not and whether recorded in a material form or not. Examples include your name, contact details, and demographic information.

We generally do not collect sensitive information (as defined in the Act) such as details about your racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or health—but may do so where permitted by law and reasonably necessary for our functions or activities.

We use categories and examples to stay accurate and future-proof. Where collection changes materially, we'll update this Policy or provide a point-of-collection notice.

A. CRA Corporate Website

Categories collected:

• Contact & account: details you provide in forms (e.g., name, email, organisation, message content); event/webinar registrations.
• Preferences & consents: newsletter choices, cookie preferences.
• Device & usage: IP address, browser/device type, pages viewed, referral URLs, interaction with CRA emails or pages.

CRA displays a cookie banner on this site to manage non-essential cookies. Campaign pixels may run for attribution/retargeting

B. DAB+ Website (digitalradioplus.com.au)

Categories collected:

• Postcode lookup: input is processed to return coverage and is not stored beyond the active session.
• Device & usage: session data, anonymous "listen live" click events, basic analytics (e.g., GA4).
• Cookies: session/functional and analytics cookies.

C. RadioApp (mobile, smart speaker, in-car)

Categories collected:

• Account & profile: email and other account details if you register; marketing preferences/consent; authentication method; a system-generated unique identifier.
• Demographics (optional/where provided): e.g., year of birth band, gender, and region/postcode, or approximate location if you enable location features (you can use postcode instead).
• Usage & preferences: stations and features you interact with (e.g., favourites, recent stations), listening session events (e.g., stream start/stop, duration), search terms and in-app navigation events.
• Device & technical: device type, app version, platform (e.g., iOS/Android/CarPlay/Auto), performance/diagnostic events (including crash logs retained for a limited period).
• In-app integrations: smart speaker or in-car integrations may process the command or selection to deliver the requested station or feature.
• Automatically inferred signals: some demographic/location signals may be inferred automatically (e.g., device language, time zone, IP-derived region).

Notes:

• Audience measurement & broadcaster insights: we generate aggregate or de-identified listening insights for participating broadcasters about their own stations.
• Streaming partners: for certain networks, limited parameters (e.g., a unique identifier, demographic band, approximate location) may be appended to stream requests to deliver ads/analytics for that network.

D. All Ears Listener Panel (via invitation to RadioApp listeners)

All ears is a voluntary listener research program operated by CRA. Invitations are sent by email to RadioApp users who have opted into CRA marketing. Participation is separate from using RadioApp.

Categories collected (vary by study; disclosed at sign-up)

• Registration & contact: details you provide to join and be contacted about surveys.
• Demographics you choose to provide: e.g., age range, region.
• Survey responses & listening feedback: opinions, ratings, and other answers you choose to submit.
• Linkage (where relevant to the study): we may associate survey responses with high-level app usage signals (e.g., station categories or frequency bands) to validate findings—kept aggregate or de-identified in outputs.

If you don't join: nothing changes in your RadioApp experience. You can withdraw from All Ears at any time using the instructions in our emails.

E. CRA Marketing & Campaign Attribution

On CRA sites and pages we manage, we may use pixels/SDKs for attribution and retargeting (where consent exists). These recognise your browser or device to measure campaign performance and show CRA ads.

F. Industry measurement & podcast reporting

CRA receives aggregated analytics/ratings outputs for industry reporting (e.g., podcast rankers, market dashboards). CRA does not receive individual listener identities from these reports.

G. Competitions, Live Events, and Scholarships

We may collect and handle personal information in connection with CRA-run or sponsored competitions, live events, and scholarship programs. This may include:

• Entries and applications – name, contact details (such as email address, phone number, and mailing address), age or date of birth, and other eligibility information (e.g., proof of residency, membership status, or professional credentials).
• Event participation – attendance records, seating or ticket allocation details, photographs, and/or audio or video recordings taken at the event which may feature you. These may be used for event administration, safety and security, and, where consent is obtained, promotional purposes.
• Scholarship administration – completed application forms, referee contact details, supporting documents (such as CVs, academic transcripts, work samples, or proof of enrolment), and information provided by referees or selection panels.
• Other relevant information – any information you choose to include in entry forms, submissions, or event feedback.

Where applicable, CRA will provide a collection notice at the point of entry or registration to explain the specific purposes for which the information will be used, any third parties it will be disclosed to, and whether participation is conditional on providing the information.

4. Why We Use Information (purposes)

We use information to:

• Operate and deliver our websites, apps, streams, and related features.
• Personalise and improve user experience and content relevance.
• Measure and report on listening, including aggregate industry insights and station-level dashboards for participating broadcasters.
• Run research & surveys, including All Ears.
• Market CRA services (with consent) and measure campaigns.
• Maintain security, prevent fraud/abuse, and diagnose service issues.
• Comply with law and manage our business (e.g., governance, auditing).

We may also create aggregated or anonymised datasets that are no longer personal information.

5. Cookies, Tracking, and Analytics

CRA services use cookies, pixels, and similar technologies to:

• Enable core functionality (e.g., remembering preferences).
• Measure usage (e.g., analytics tools such as Google Analytics).
• Attribute marketing activity and retarget ads (where consent exists), using providers like Google Analytics, LinkedIn, Meta, and YouTube.

Some CRA services display cookie banners to meet legal or best-practice requirements; others manage consent through in-app permissions or platform notices. You can adjust browser/app settings to limit certain tracking; some features may not work as intended if you do.

6. Who We Share Information With (by category)

We do not sell your personal information. We disclose only what's necessary:

• Service providers (hosting, cloud, analytics, measurement, customer communications, event/survey platforms) who process information on our instructions.
• Participating broadcasters receive de-identified or aggregated insights for their own stations.
• Streaming/ad partners (by network) may receive limited parameters appended to stream requests to deliver ads/analytics for that network.
• Advertising/analytics platforms (on CRA sites/pages) receive pixel events for attribution/retargeting where consent exists;
• Regulators, law enforcement, and legal advisers where required or authorised by law.
• With your consent: where you ask us to share information or participate in a specific program.

All third parties are required to handle your information in accordance with Australian privacy laws and only for authorised purposes.

7. Retention and Deletion

• We keep personal information only as long as needed for the purposes in this Policy or as required by law, then de-identify or delete it.
• Diagnostic/crash data is retained for a limited period to troubleshoot (then removed from live/backup systems).
• Aggregated measurement and reporting data may be retained to support longitudinal industry analytics (without identifying individuals).

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, misuse, loss, or disclosure. No method is perfect, but we regularly review and improve our controls.

9. Overseas processing and disclosure

Some service providers store or process information outside Australia, including in the United States and locations within Europe. When we transfer your personal information overseas, we take steps to ensure it receives appropriate protection under Australian privacy law.

10. Your choices and rights

• Marketing: opt out anytime using the unsubscribe link or by contacting us.
• Location: enable/disable location services at any time in your device/app settings; you can provide a postcode instead.
• Cookies/SDKs: use cookie banners (where offered) and browser/app settings to manage tracking.
• Access & correction: request access to, or correction of, your personal information (see below). We'll respond within a reasonable period (usually within 30 days). If we refuse access/correction, we'll tell you why and how to complain.

11. Access, Correction, and Complaints

You can request access to, or correction of, your personal information by contacting us. We may need to verify your identity before processing the request.

If you have a privacy concern, contact us and we will respond in a reasonable timeframe. If you're not satisfied, you may contact the OAIC (www.oaic.gov.au).

12. Contact us

Privacy Officer Commercial Radio & Audio (CRA) Email: privacy@cra.au Postal: The Privacy Officer, Commercial Radio & Audio Limited, Level 3, 223 Liverpool Street, Darlinghurst NSW 2010

13. Changes to this Policy

We may update this Policy from time to time. The "Effective date" shows when it was last updated. If changes are material, we'll take reasonable steps to notify you (e.g., via our sites/apps).