Extreme Reach, Inc.; XR Pay, Inc.; Extreme Reach Talent, Inc; Extreme Reach Payroll Solutions, Inc.; ER Vendor Solutions, Inc.; CMC/Forecast, Inc.; and CMC Crew Services, Inc.; and their affiliates worldwide (collectively "XR") are committed to respecting and protecting your privacy.
This Privacy Policy describes how we collect, use, disclose, store and otherwise process information collected for Payroll Services. For information related to other Services, please see the relevant policy posted at https://xr.global/legal.
Information We Collect
In order to process payroll, residuals, and other relevant payments for Talent, Crew, or other payees (collectively "Payees"), XR receives, collects, and creates a variety of information, including tax forms, session reports, timesheets, Payee contracts, payroll stubs, and other wage-related information. The categories of information include name, address, contact information, employment information, tax and payment information, union membership (for instance, if we are making union contributions in association with your payroll), and, potentially, medical information (only if you are injured and make a workers' compensation claim). This information is most often collected by our clients (or their agents), who are your common law employer, and provided to us in order to process payroll, but may also be collected by XR directly from Payees (this mostly only occurs if you contact us directly to update your information). Any emails or other communications addressed to XR may also be collected and retained per our records retention policies.
How Collected Data Is Used
Information collected and created for Payroll Services is used solely to process payments to Payees, to provide required reports to your employer (our client), applicable unions, pension funds, tax authorities, and governmental entities, and to perform associated legally required duties.
We never use your payroll information for marketing purposes, nor do we share such information with any third parties, except those listed below, as required by law or in order to provide the Payroll Services. We do not use your data for any automated decision-making.
Information Disclosed to Outside Parties
We provide information as required to applicable unions and guilds, including their applicable benefits plans, tax authorities, governmental entities, the relevant agencies and advertisers who engage us to process your payroll, and those courts and legal authorities exercising jurisdiction over wage garnishments or other relevant legal proceedings.
XR may also disclose personal information to our third-party vendors and service providers that work with us, solely to the extent necessary to provide the Payroll Services. This would include third-party check printers, mail carriers, etc.
We do not otherwise sell, trade or transfer collected information to outside parties unless we believe release is required to comply with the law, enforce our site policies, protect our or others' rights, property, or safety, or otherwise with your consent. We may also transfer personal information in the event we go through a merger, acquisition, or other restructuring and the successor takes over and continues our operations.
Payroll data is processed in the United States, Canada, the United Kingdom, and the EU.
How We Protect Your Information
Security of all information is of the utmost importance for XR. We use technical and physical safeguards to protect the security of your personal information from unauthorized disclosure. Despite our best efforts, the internet is not 100% secure. If we experience a security incident and believe your personal information has been impacted, we may attempt to contact you where required or permitted by law.
We also make all attempts to ensure that only necessary people and third parties have access to personal and confidential information. We require that our third-party service providers (1) use confidential information only to perform their obligations and (2) otherwise maintain the confidentiality of such information. These third-party service providers are expected to maintain privacy and security protections that are consistent with XR's privacy and information security policies.
Your Rights
You have a variety of rights you may exercise with respect to your personal information. While legislation only requires that we honor certain requests from people who live in certain jurisdictions, we believe in your privacy rights regardless of where you live and, therefore, allow anyone (including agents) from anywhere to exercise any of those same rights, and we will not discriminate in any way against anyone for doing so.
As such, you can exercise the following rights with respect to your personal information that we have although you should be aware that not all rights apply automatically and some may not be available, depending on the circumstances:
- Access your information: you may request that we disclose what categories of personal information we collect, use, disclose or sell; the categories of sources from which we collect personal information; the purposes for which we collected the personal information; the purpose for which we collected and shared personal information; the categories of third parties to whom the personal information is shared; and the categories of third parties to whom the personal information was disclosed or close for a business purpose in the last 12 months preceding your request. In the European Economic Are and UK you are entitled to a copy of your personal information.
- Correct or update your information: you may request that we correct inaccurate information that we have about you.
- Delete your information: you may request that we delete the information we have about you, subject to certain exceptions where we have legal obligations to maintain such data. Note that a deletion request may impact our ability to process your payroll.
- Do Not Sell or Share directive: you may request that we do not "sell" or "share" (for purposes of targeted advertising) your personal information, as those terms are defined by applicable law and to the extent we may conduct those activities. Note, however, that we do not ever sell or share the personal information described in this policy.
- Receive, transfer or port your information to someone else: you may request that we transfer your personal information in a machine-readable format.
- Unsubscribe or opt-out: when you receive certain communications from us, you have the ability to opt out of such communications. Please note we may still contact you with respect to transactional or other information you have requested from XR.
- In the European Economic Area and UK you also have rights to object, where we process your personal information based on legitimate interests, and a right to restrict processing in certain circumstances. You also have a right to complain to the relevant data protection regulator (in the UK this is the Information Commissioner who may be contacted at http://ico.org.uk/concerns/) and, in the UK, you also have a right to complain directly to us.
To exercise any of these rights, please click here. Prior to responding to your request, we will verify your identity by matching any requested identifying information you provide against the information we have about you. We may request certain information to verify your identity before we can respond to your requests to access, correct, or delete. You can also designate an authorized agent to make a request on your behalf. Authorized agents will need to demonstrate that you have authorized them to act on your behalf. We retain the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent's identity.
However, due to the nature of the data (wage payment related), there are some requests we may not be able to comply with due to our legal obligations to maintain records associated with wage payments we have made and in connection with our contractual obligations to our clients.
Compliance with Applicable Laws
We are committed to complying with all applicable laws and regulations concerning data protection and privacy in any jurisdictions in which we operate or collect and process personal data. This includes, but is not limited to, the General Data Protection Regulation (GDPR)and the UK Data Protection Act 2018, the California Privacy Rights Act (CPRA), and any other applicable local, national or international privacy laws. See details regarding GDPR and CPRA compliance below.
Additional Information for California Residents
If you are a California resident, the CCPA provides you with particular rights regarding our use of your personal information, which are described in the Your Rights section of this policy. To learn more about your California privacy rights, you can also visit https://oag.ca.gov/privacy/privacy-laws. To exercise any such rights, please click the link above within the "Your Rights" section.
Additionally, under the California Shine The Light law, residents of California have the right to request information from us regarding other companies to whom we have disclosed certain categories of information during the preceding year for the other companies' direct marketing purposes, if any. If you are a California resident and would like such a list, please contact us at the email address below with the subject line "California Shine The Light."
Legal Basis For Processing Data
Under data protection laws in the European Economic Area and UK, we are required to have a lawful basis for any processing of personal information. Our legal basis for processing personal information will depend on the personal information concerned and the specific context in which we process it. However, we will normally process personal information from you only where: (a) we have your consent to do so, (b) where we have a legal obligation to do so, or (c) where the processing is in fulfillment of a contractual obligation between us and your employer (and not overridden by your data protection interests or fundamental rights and freedoms) in order to pay you money that is owed by our client.
Where we rely on your consent to process the personal information, you have the right to withdraw or decline your consent at any time. Please note that this does not affect the lawfulness of the processing based on consent before its withdrawal. Withdrawing consent may limit, delay, or prevent our ability to process payments owed to you.
Should you have any issues with how we handle your data, we request that you contact us first so that we can make every effort to address your concerns. You also have the right to lodge a complaint with a supervisory authority. We rely on standard contractual clauses to authorize any necessary international data transfers.
International Transfers
We receive data from customers wherever they sign in to our application globally. XR is a global organization, and in the course of providing our services, your personal data may be stored, processed, and transferred to locations outside of your country of log-in. This may involve transfers to countries that may not have the same level of data protection laws as the country where customers logged in from. In such cases, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws, such as the use of Standard Contractual Clauses or other legally recognized mechanisms for international data transfers. By submitting your personal data, you agree to this transfer, storing or processing.
EU-US Data Privacy Framework Compliance
XR complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. XR has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. XR has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/
In compliance with the DPF Principles, XR commits to resolve complaints about our collection or use of your personal information. European individuals with inquiries or complaints regarding our policy or data privacy actions should first contact XR at privacy@extremereach.com.
XR is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) with respect to its use of your data. Under certain conditions, you may have the right to invoke binding arbitration regarding your privacy rights. If XR wrongly transfers your private data to third parties, it may be liable to you for damages.
XR has further committed to refer unresolved privacy complaints under the EU-U.S. DPF Principles to an independent U.S.-based third party dispute resolution provider. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Children
XR recognizes the importance of protecting the privacy and safety of children. Our services are primarily directed toward the advertising industry and are not directed toward children. We may, however, process information about children under the age of 18 for the purposes of paying children who are hired by our clients. We will never use any such information for any purpose other than to provide payroll services.
Data Retention
We retain data we collect for Payroll processing strictly for the purpose of providing Payroll Services. We may be obligated to retain data for contractual or regulatory reasons. Due to our legal obligations related to wage and tax payment, we are not able to delete your wage-related information for seven (7) years following the completion of the applicable payments. We do not retain any category of personal information referred to above for longer than necessary for the purposes for which it was processed.
Changes to This Policy
XR reserves the right to change, modify, add or remove portions of this Privacy Policy at any time without notice (except when legally obligated to provide notice). Any changes to this Privacy Policy will become effective when we post the revised version on our website. We encourage you to check this page frequently for these updates.
Contact Information
If you wish to change any personal information, such as the address where you receive payroll or tax documents, please send an email to performersupport@extremereach.com or call (800) 233-0278.
You can contact privacy@extremereach.com or 1-800-324-5672 if you have questions about this privacy policy, or for requests related to your privacy rights.
Last updated: October 1, 2026 for general updates.