Extreme Reach, Inc.; XR Pay, Inc.; Extreme Reach Talent, Inc; Extreme Reach Payroll Solutions, Inc.; ER Vendor Solutions, Inc.; CMC/Forecast, Inc.; and CMC Crew Services, Inc.; and their affiliates worldwide (collectively "XR") are committed to respecting and protecting your privacy.
This Privacy Policy describes how we collect, use, disclose, store and otherwise process information collected through the XR public websites. For information related to particular Services, please see the relevant policy posted at https://xr.global/legal.
Information We Collect
XR collects IP addresses, aggregate user data, non-precise geolocation, and browser type, (collectively "Technical Usage Data") from users and visitors to the website.
XR also collects personal information about you that you voluntarily supply (e.g., information submitted through the "Contact Us" form). When communicating with XR, all communications may be transmitted and stored by us. By visiting our website or using any of our services, you acknowledge XR's collection, use, and storage of information relating to you as set forth in this privacy policy.
How Collected Data Is Used
When you provide us with your contact information, XR uses your personal information to recommend products and services that might be of interest to you, to send you marketing and advertising messages such as newsletters, announcements, or special offers or to notify you about our upcoming events. We may also use such information to provide you products and services, such as to fulfill your requests for products or to help us personalize our offerings to you. We also use your personal information to support our business functions, such as fraud prevention or legal functions. We do not use your data for any automated decision-making.
Technical Usage Data is used to manage the website, track usage, properly assign sales leads to correct geo-regions, and improve website services.
To the extent we use de-identified information, we will not attempt to re-identify it except to ensure our de-identification methods are satisfactory.
Information Disclosed to Outside Parties
XR may disclose personal information to our affiliates, third-party vendors, and service providers that work with us. We will only share personal information to these vendors and service providers to help us provide a product or service to you or to understand your usage of our website. We utilize Google Analytics to know more about how our websites are used, how much time visitors spend with different web content, what geographies visitors are from, and to understand the different sources of traffic to our websites. For more information on Google Analytics and/or to choose what information Google can utilize, please see the Google Privacy Policy.
We do not otherwise sell, trade, or transfer collected information to outside parties, unless we believe release is required to comply with the law, enforce our site policies, protect ours or others' rights, property, or safety, or otherwise with your consent. We may also transfer personal information in the event we go through a merger, acquisition, or other restructuring.
How We Protect Your Information
Security of all information is of the utmost importance for XR. We use technical and physical safeguards to protect the security of your personal information from unauthorized disclosure. Despite our best efforts, the internet is not 100% secure. If we experience a security incident and believe your personal information has been impacted, we may attempt to contact you where required or permitted by law.
We also make all attempts to ensure that only necessary people and third parties have access to personal and confidential information. We require that our third party service providers (1) use confidential information only to perform their obligations, and (2) otherwise maintain the confidentiality of such information. These third-party service providers are expected to maintain privacy and security protections that are consistent with XR's privacy and information security policies.
Cookie Choice
We honor Do Not Track and cookie preferences, which you can control any time you visit our websites by clicking the "Cookie Preferences" link in the footer below. This link also includes further information about the different types of cookies and similar technologies we use, the partners we work with and your preferences. We also recognize the Global Privacy Control ("GPC") as an opt out request when you have GPC turned on. Please note that GPC is browser and device specific, and you may need to opt out again if you visit our websites from a different browser or device where you are not logged in.
Most web browsers also provide settings that allow you to control or reject cookies or to alert you when a cookie is placed on your computer, tablet or mobile device. For more information, visit the help page for your web browser. Although you are not required to accept cookies, if you block or reject them, some functionality of our websites may be compromised.
Your Rights
You have a variety of rights you may exercise with respect to your personal information. While legislation only requires that we honor certain requests from people who live in certain jurisdictions, we believe in your privacy rights regardless of where you live and, therefore, allow anyone (including agents) from anywhere to exercise any of those same rights, and we will not discriminate in any way against anyone for doing so.
As such, you can exercise the following rights with respect to your personal information that we have although you should be aware that not all rights apply automatically and some may not be available or exemptions may apply depending on the circumstances:
- Access your information: you may request that we disclose what categories of personal information we collect, use, disclose or sell; the categories of sources from which we collect personal information; the purposes for which we collected the personal information; the purpose for which we collected and shared personal information; the categories of third parties to whom the personal information is shared; and the categories of third parties to whom the personal information was disclosed or close for a business purpose in the last 12 months preceding your request. In the European Economic Area and UK you are entitled to a copy of your personal information.
- Correct or update your information: you may request that we correct inaccurate information that we have about you.
- Delete your information: you may request that we delete the information we have about you, subject to certain exceptions. Note that a deletion request may impact our ability to provide you with some or all of the services.
- Do Not Sell or Share directive: you may request that we do not "sell" or "share" (for purposes of targeted advertising) your personal information, as those terms are defined by applicable law and to the extent we may conduct those activities. To opt out of certain selling or sharing activities, click the "Do Not Sell My Information" link in the footer of the website; to opt out of certain selling or sharing activities related to cookies and similar website technologies, please see the Cookie Choice section of this policy.
- Transfer or port your information to someone else: you may request that we transfer your personal information in a machine-readable format.
- Unsubscribe or opt-out: when you receive marketing communications from us, you have the ability to opt out of such communications. You can opt-out of marketing emails by contacting XR at privacy@extremereach.com or by clicking the unsubscribe link from a marketing email, which will remove you from our marketing list. Please note we may still contact you with respect to transactional or other information you have requested.
- In the European Economic Area and UK you also have rights to object, where we process your personal information based on legitimate interests and a right to restrict processing in certain circumstances. You also have a right to complain to the relevant data protection regulator (in the UK this is the Information Commissioner who may be contacted at http://ico.org.uk/concerns/) and, in the UK, you also have a right to complain directly to us.
To exercise any of these rights, please click here. Prior to responding to your request to access, correct, or delete, we will verify your identity by matching any requested identifying information you provide against the information we have about you. We may request certain information to verify your identity before we can respond to your requests to access, correct, or delete. You can also designate an authorized agent to make a request on your behalf. Authorized agents will need to demonstrate that you have authorized them to act on your behalf. We retain the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent's identity.
Compliance with Applicable Laws
We are committed to complying with all applicable laws and regulations concerning data protection and privacy in any jurisdictions in which we operate or collect and process personal data. This includes, but is not limited to, the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, the California Privacy Rights Act (CPRA), and any other applicable local, national or international privacy laws. See details regarding GDPR and CPRA compliance below.
Additional Information for California Residents
If you are a California resident, the CCPA provides you with particular rights regarding our use of your personal information, which are described in the Your Rights section of this policy. To learn more about your California privacy rights, you can also visit https://oag.ca.gov/privacy/privacy-laws. To exercise any such rights, please click the link above within the "Your Rights" section.
Additionally, under the California Shine The Light law, residents of California have the right to request information from us regarding other companies to whom we have disclosed certain categories of information during the preceding year for the other companies' direct marketing purposes, if any. If you are a California resident and would like such a list, please contact us at the email address below with the subject line "California Shine The Light."
International Transfers
We receive data from customers wherever they sign in to our application globally. XR is a global organization, and in the course of providing our services, your personal data may be stored, processed, and transferred to locations outside of your country of log-in/browsing. This may involve transfers to countries that may not have the same level of data protection laws as the country where customers logged in from. In such cases, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws, such as the use of Standard Contractual Clauses or other legally recognized mechanisms for international data transfers.
EU-US Data Privacy Framework Compliance
XR complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. XR has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. XR has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, XR commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.
In compliance with the DPF Principles, XR commits to resolve complaints about our collection or use of your personal information. European individuals with inquiries or complaints regarding our policy or data privacy actions should first contact XR at privacy@extremereach.com.
XR is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) with respect to its use of your data. Under certain conditions, you may have the right to invoke binding arbitration regarding your privacy rights. If XR wrongly transfers your private data to third parties, it may be liable to you for damages.
XR has further committed to refer unresolved privacy complaints under the EU-U.S. DPF Principles to an independent U.S.-based third party dispute resolution provider. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
In compliance with the DPF Principles, XR commits to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our policy or data privacy actions should first contact XR at privacy@extremereach.com.
XR is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) with respect to its use of your data. Under certain conditions, you may have the right to invoke binding arbitration regarding your privacy rights. If XR wrongly transfers your private data to third parties, it may be liable to you for damages.
XR has further committed to refer unresolved privacy complaints under the EU-U.S. DPF Principles to an independent U.S.-based third party dispute resolution provider. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Children
XR recognizes the importance of protecting the privacy and safety of children. Our websites and services are primarily directed towards the advertising industry and are not directed towards children. We do not knowingly collect information about children under the age of 18.
Data Retention
We retain data we collect from the public websites for marketing purposes. To request that we delete your data, please click the link above in the "Your Rights" section. We do not retain any category of personal information referred to above for longer than necessary for the purposes for which it was processed.
Changes to This Policy
XR reserves the right to change, modify, add or remove portions of this Privacy Policy at any time without notice (except when legally obligated to provide notice). Any changes to this Privacy Policy will become effective when we post the revised version on our websites. We encourage you to check this page frequently for these updates.
Legal Basis
Under data protection laws in the European Economic Area and UK, we are required to have a lawful basis for any processing of personal information. We rely on: (i) consent where you have expressly given this to us, for example via our cookie preference banner or direct marketing consents; (ii) contract if we are processing personal information to fulfil or put in place a contract with you; (iii) our legitimate interests in communicating with you, undertaking analytics, record keeping, marketing activities where consent is not required and protecting the business including fraud protection and any legal matters.
Contact Information
You can contact privacy@extremereach.com or 1-800-324-5672 if you have questions about this privacy policy, or for requests related to your privacy rights.
Last updated: October 1, 2026 for general updates.