Platform and Services Privacy Policy

Last Updated and Effective: Apr 10, 2024

Our Commitment

StackAdapt Inc. (“StackAdapt”, “us”, “our”, or “we”) strongly believes that all information deserves protection. We’ve written this Privacy Policy to inform you of our privacy practices with respect to the personal data we process via our platform, which we will refer to as our “Platform”. If you do not agree to the terms of this Privacy Policy, please click here to opt out of inclusion in our Platform. If you do not understand, or if you have questions about this Privacy Policy please contact us using one of the methods we’ve identified below.

We may update this Privacy Policy from time to time and will post the updates here. If we amend this Privacy Policy, we will revise the Last Updated date based on when we posted the updated version. If we make significant updates to this Privacy Policy, we may also provide you with notice by prominently posting on our website, via email or both. We may also highlight those updates at the top of this Privacy Policy and provide a prominent link to it for a reasonable length of time following the update. We encourage you to review this page on a regular basis.

Our Platform

StackAdapt is a programmatic advertising platform. We provide advertising services to our clients, who are typically advertisers or advertising agencies who use these services to buy, track, and manage their digital media to deliver advertisements, including but not limited to, native, display, video, connected tv, audio, and digital out-of-home advertisements. Through our Platform we distribute and promote advertising content, also referred to as creative, using real-time, data-driven audience targeting on behalf of our clients. As a programmatic platform, we also help our clients curate the audiences that are most likely to respond to an interest-based advertising campaign. When requested, we assist our clients in developing creative and when their campaign is ready to launch, we engage in real-time bidding on their behalf. Real-time bidding is a process in which advertisers bid on ad placements across publisher websites in a real-time auction environment. When bids are won, we are able to place our clients’ ads across a range of websites, thereby delivering ads that are relevant and timely to you. After you’ve seen the ad, we enable our clients to use certain information related to the delivery of the ad to measure its effectiveness, whether you clicked on the ad, purchased the product, or scrolled past. Ultimately, we and our clients collect and use information within the Platform in various manners, relative to interest-based advertising, as described herein.

Types of Personal Information We Collect

In this Privacy Policy, we use the term “personal information” to represent various types of identifiable information we collect about you. The terminology of the applicable data protection law in your jurisdiction may use an equivalent term, like personal data, and we use personal information to mean the same thing.

Personal information includes information that directly identifies you, like your name, email address or physical address. You may provide this type of personal information to us in connection with a request to learn more about our company or our Platform. If you request to get in touch with us, this information is never used within our Platform. You may also provide this type of personal information directly to a third-party, who subsequently uses it in our Platform for their own advertising purposes, in accordance with the privacy policy under which it was collected.

In many jurisdictions, personal information can also include information that indirectly identifies you. In other words, a piece of information that could identify you, if it were combined with other information. Indirectly identifiable personal information is often referred to as “pseudonymous personal information” and examples of pseudonymous identifiers include cookie IDs, IP addresses, and device IDs. We collect certain pseudonymous identifiers while delivering advertisements via our Platform, as further described below.

Specific Pieces of Personal Information Collected. We collect the following pieces of personal information related to users, households, devices, and ads for use and processing within our Platform:

• Advertising identifiers (e.g., mobile advertising identifiers)
• Cookie identifiers
• Device identifiers
• IP addresses
• User agent
• Referral page URL and title
• Geolocation information (e.g., latitude/longitude at varying levels of specificity)
• Pseudonymous identifiers we receive or derive internally (e.g., RampID; household or consumer level identifiers)
• Email address
• Demographic data that may be associated with one of the above identifiers

Categories of Personal Information Collected. The above-described personal information collected can be categorically described as follows:

• Online identifiers
• Offline identifiers
• Geolocation data
• Pseudonymous identifiers
• Audience data

Legal Basis for Processing. For personal information subject to the General Data Protection Regulation “GDPR”, we process personal information on the basis of consent provided either directly to us or obtained directly by an advertiser or publisher that uses our Platform or services. If you have provided consent to the processing of your personal information, you can withdraw it at any time by following the opt-out instructions referenced herein. When we process your personal information in the Platform, generally we do so as a controller.

Sensitive and Special Categories of Personal Information. Under the GDPR and the UK GDPR, special categories of personal information include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. We do not knowingly collect or process special categories of data related to individuals residing in the EEA or UK. Our clients are permitted to upload their own personal information to our Platform; however, they are prohibited from uploading special categories of personal information and are contractually obligated to comply with applicable data protection law when doing so.

Under applicable United States data protection law, sensitive personal data may include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, and genetic or biometric data for the purpose of uniquely identifying a natural person. We do not knowingly collect or process these categories of sensitive data related to individuals residing in the United States where an applicable data protection law applies. In some cases, sensitive personal data may also include precise geolocation. We collect and process precise geolocation for reporting, measurement, and to place more relevant advertisements on behalf of our clients. To exercise your rights with respect to this information, click here.

Subject to certain restrictions, our clients are permitted to upload their own personal information to our Platform and in some cases are permitted to serve advertisements based on predetermined geolocations they have provided. In all cases, clients are contractually obligated to comply with applicable data protection law when uploading data and using the Platform.

How We Collect Personal Information

We seek to minimize the amount of personal information we collect from you, and we do so only for the purposes described in this Privacy Policy. We collect personal information from the following sources:

Client-Owned Properties. We often use pixel tags and cookies to collect information about the ads you respond to or the purchases you make when you visit a website of one of our advertiser clients. We only use pixel tags and cookies at the direction of our clients and in each case, indirectly identifiable personal information is shared with us as further described below.

• A pixel is a tiny snippet of code that allows the owner of a website to gather information about visitors to their website. Clients who choose to implement one of our pixels will automatically collect and transfer indirectly identifiable personal information to our Platform that includes IP address, Cookie ID, and contents of cookie, user agent, and referral page URL.
• Our clients can customize their pixels to pass back additional indirectly identifiable personal data to our platform. While clients can use this information to make informed and strategic advertising decisions, they are contractually obligated to comply with applicable data protection laws when customizing their pixels.
• Cookies are small text files that are stored on the browser of a computer that uniquely identify the browser and provide information to the cookie sender.

Our Platform. When we deliver advertisements through our Platform, we collect certain indirectly identifiable pieces of personal information related to the campaigns we serve on behalf of our advertiser clients. This is referred to as “impression data”. Impression data includes, for example, advertising identifiers, identifiers tied to your device, your IP address, imprecise location (e.g., the postal/ZIP code you were located in when you saw the ad), user agent, as well as information related to the context of the web page you were viewing when you saw the ad. We may use impression data to group and categorize consumers based on their interests or preferences. This helps us identify which products and services may be most appealing to consumers and subsequently, which advertisements are most likely to be relevant to a particular group of consumers. Impression data is collected in accordance with the data protection requirements of the jurisdiction in which the campaign was served, and privacy policies of the websites and advertising networks we work with.

Third Parties. We may also collect personal data from third parties with whom you’ve shared your information, in accordance with their privacy policy. Third-party segments are combined pieces of data that are collected by external parties and acquired by StackAdapt for use in advertiser campaigns. Third-party segments do not contain directly identifiable personal data, rather third-party segments are resolved to pseudonymous identifiers that are used to track and manage digital media in an advertising campaign. Often, advertisers will request specific third-party segments so that they can more effectively reach a desired audience. This ensures you receive advertisements that are more relevant to you and your interests.

We may also collect identifiers assigned by third parties to your browser or device, including Google advertising identifiers, that we use as part of our internal processing operations and to serve ads. Please see Google’s Privacy Policy for information about Google’s use of your personal data that it receives from partner sites, and your ability to control the information collected on these sites.

How We Use Personal Information

We primarily process personal information in our Platform to assist our clients in reaching audiences that are most likely to respond to interest-based advertising campaigns. In that regard, we use personal information to do any, or all, of the following business or commercial purposes:

• Display advertisements that may be relevant to you;
• Place a bid for advertising space;
• Marketing automation and email activation;
• Track how many times an ad was shown and to whom (based on a pseudonymous identifier);
• Allow clients to measure the success of their advertising campaigns;
• Develop reports that provide measurement and attribution;
• Process pseudonymous information to prevent malicious ad traffic (i.e., fraud detection and prevention);
• To develop machine learning models and algorithms;
• Create and refine audience segments and profiles; and
• Develop and refine algorithms to understand better how users’ interaction with a website might be of interest to advertisers.

Additionally, we may use personal information on our own behalf to do any, or all, of the following:

• Respond to your requests, communications, suggestions, comments, inquiries, and requests;
• Analyze the accuracy and effectiveness of the services we make available within our Platform;
• Develop new products, features, and services, including analyzing and understanding our clients and their needs;
• Respond to legally binding requests from law enforcement, supervisory or regulatory authorities, or other third parties;
• Defend, protect, or enforce our rights or applicable terms of service or to fulfill our legal or contractual obligations;
• Manage any dispute and accidents, and take legal or other professional advice;
• Comply with, or meet obligations as required by, applicable law (i.e. fraud detection or the recurrence of fraud);
• For internal or external audit purposes; or
• For any other purpose with your consent.

Use of Artificial Intelligence “AI” in the Platform. We use AI technology to align ads with the content users are consuming. This means that, through algorithms, we can match relevant ads to your browsing. You can request to find out what personal information we may have used through our algorithms to send you ads based on your browsing. If you feel the information is inaccurate, you can request to have it corrected.

How We Share Personal Information

We share certain, indirectly identifiable personal information to support our clients’ advertising strategies. In each case; however, we only share personal information for the limited circumstances we describe in this Privacy Policy and in accordance with applicable data protection law.

Sales and Sharing of Personal Information. To better operate our Platform, we may disclose your personal information to third parties and our advertiser clients. Under some applicable data protection laws, this disclosure would constitute a sale, or in some cases, a sharing, of personal information. We may sell or share your personal information for the business and commercial purposes described in the How We Use Personal Information section. You have a right to opt out of the sale of your personal information here. We only share personal data for purposes related to our advertising services or where we are legally required. The following categories of personal information we’ve sold or shared in the last 12 months:

• Pseudonymous identifiers (internally or externally derived)
• Online identifiers
• Geolocation data
• Audience data

In the last 12 months we’ve sold or shared the above categories of personal information to the following categories of third parties for the specified advertising related purposes:

• Clients and their subprocessors (primarily advertising agencies): For the purpose of offering our programmatic advertising services.
• Onboarding and audience partners: For the purpose of identity resolution and audience creation.
• Publisher and supply-side partners: To technically enable the delivery of an advertisement and the measurement of its success.
• Accountants and auditors: In connection with our business operations.
• StackAdapt entities: For the purpose of offering our programmatic advertising services.
• StackAdapt subprocessors: For the purpose of offering our programmatic advertising services and in connection with our business operations.

Our third-party partners, including Tapad, Inc., may set and/or access cookies or other data collection technology which collect personal information (not including your name, address, or telephone number) about your visits to this and other websites, mobile websites and/or mobile applications across various devices, in order to match those devices together by creating a profile revealing likely associations of, or connections between them. That profile is used to determine likely associated devices visiting the websites or applications on different devices, and to provide more tailored advertising, marketing, measurement, analytics, and research about goods and services of interest to you across those various devices. If you would like more information about this practice and to know your choices with respect to it, please refer to the relevant third parties’ privacy policies. See Tapad’s privacy notice here.

We do not knowingly sell or share personal information related to minors under 16 years of age.

In accordance with applicable law, we may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. If we are involved in defending a legal claim, we may disclose personal information about you that is relevant to the claim to third parties as a result of, or in connection with, the associated legal proceedings.

Your Choices

Opt-out Preference Signals. We recognize and ingest the Global Privacy Platform (“GPP”) string developed by the Interactive Advertising Bureau (“IAB”). The GPP string is an encoded string used to signal user privacy consent and choice down the advertising supply chain. When you visit the webpage of a participating publisher, the publisher or their content management platform will store your user consent information, encode it as a string, and send the string in the GPP field within the bid request that StackAdapt subsequently receives. Learn more about the IAB’s GPP here.

Global Privacy Control (GPC) Signals: Some browsers have a Do Not Track (DNT) feature that lets users signal to websites that they do not want their online activities tracked. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers. However, we treat GPC signals as a means of opting out of the sale or sharing of personal information, or of opting out of the processing of personal information for targeted advertising, as applicable.

Targeted Advertising. We enable our advertiser clients to engage in interest-based and targeted advertising via our Platform. To opt out of targeted advertising powered by StackAdapt, click here. If you choose to opt out of targeted advertising, it does not mean you will stop receiving advertisements or that you will receive fewer advertisements. When you choose to opt out of targeted advertising in our Platform, we will add a pseudonymous identifier that represents you to a suppression file that will prevent us from including you in future targeted advertising campaigns. After you opt out, you will still receive the same number of advertisements; they will just be less relevant to your interests.

Additionally, your opt-out with us is only applicable to our Platform. We cannot control how third-party websites or how the online services you visit will process your information or the opt-outs you request from them.

We work with third parties who collect information through the use of cookies and similar methods in order to serve you with relevant advertisements or to determine whether you have seen advertisements. This method of advertising is sometimes called “Interest-Based Advertising.” To learn more about Interest-Based Advertising, your choices with respect to it, and to opt out of advertising programs that track your activities across multiple websites to deliver personalized advertising content to you, please visit:

• For Canada: Digital Advertising Alliance of Canada Opt-Out Page (StackAdapt is a member of the Digital Advertising Alliance of Canada (DAAC) and we abide by their Self-Regulatory Principles for Online Behavioural Advertising.)
• For Canada and U.S.: NAI Opt-Out Page
• For Canada and U.S.: Ad Choices Opt-Out Page
• For European Residents: Your Online Choices | EDAA

StackAdapt participates in the IAB Canada Transparency & Consent Framework and complies with its Specifications and Policies. StackAdapt’s identification number within the framework is 238.

Children’s Privacy. Our Website and Platform are not for children or those under the age of 16. We do not knowingly collect personal information from children or other persons who are under 16 years of age. Individuals who are children or those under the age of 16 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 16, please contact us immediately.

International Transfers of Personal Information

StackAdapt is a global business headquartered in Canada. Within our Platform, our advertiser clients have the capability to serve ads to consumers located in many jurisdictions, all over the world. As such, it is necessary for us to transfer personal information abroad. We also transfer information to a number of companies who provide business applications that enhance our platform features, such as CRM onboarding and marketing applications, as well as marketing service providers. These providers are primarily located in the United States, but may also be located in other jurisdictions. Wherever we transfer personal information, we seek to ensure that it receives a materially similar degree of protection as provided in its country of origin.

Data Originating in the European Economic Area “EEA”. Data originating in the EEA is subject to certain protections under the General Data Protection Regulation “GDPR” and individuals in the EEA are afforded additional privacy rights. The European Commission has the power to determine whether a country outside of the European Union “EU” offers an adequate level of data protection. This is referred to as an “adequacy decision”. In certain cases, there may not be an adequacy decision by the European Commission and/or United Kingdom authorities with respect to a country to which we transfer your personal information.

When transferring personal information from the EEA to a country without an adequacy decision, organizations are required to implement valid transfer mechanisms that may include binding corporate rules, approved codes of conduct, derogations for specific situations, and most commonly, the Standard Contractual Clauses (or any equivalent clauses approved by the authorities in the United Kingdom). You can find a copy of the Standard Contractual Clauses as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 here.

Protection, Storage, and Retention of Personal Information

Protection of Personal Information. We’ve designed industry-standard technical, organizational, and contractual measures to protect against the unauthorized access, disclosure, modification, or destruction of the personal information we collect and process. While we are committed to ensuring the security of the information we collect and process, no protection measure can provide a 100% guarantee of security. Consequently, we do not warrant or guarantee the security of any information we collect or process. If you suspect an unauthorized use or security breach of your personal information, please contact us immediately at privacy@stackadapt.com.

Storage of Personal Information. StackAdapt may process and store personal information anywhere our servers are located. For more information about our servers and storage of personal information, please contact us.

Retention of Personal Information. Except as otherwise permitted or required by applicable law, we only retain your information for as long as necessary or relevant for the listed purposes in this Privacy Policy, including, for legal, regulatory, backup, archival, accounting, and/or audit purposes. Our primary commercial purpose is to assist our clients in tailoring their communications to the most interested audience and to develop rich, online content. Because online content and client campaign life cycles rapidly evolve and deteriorate, most data related to advertising content and communication has a narrow window of relevancy. As a result, personal information collected and used to further this commercial purpose is retained for a relatively short period of time. Additionally, the retention of certain data types is automatically defined at collection. For example, pixel data collected in coordination with our advertiser clients is retained for approximately six months. Similarly, cookies and other related identifiers are retained for approximately one year.

Your Regional Privacy Rights

Depending on the country you are in, you may have rights in relation to the personal information we collect and process about you. If you make a privacy rights request to us, we will ask you a few questions to verify it is really you making the request. This may include asking for your contact information and your location of residence. Because our Platform processes indirectly identifiable information to serve advertisements, we may also collect information related to your browser to verify your identity in connection with a request. We will respond to your request, subject to any applicable exceptions, within 30 days. If we need an extension, we will give you the reasons why.

To exercise your rights, contact us at privacy@stackadapt.com or fill out this web form. Below are a few things to know before you make your request.

• Only you, or a person who can legally represent you, may make these requests. If you use an authorized agent, you must provide the authorized agent written permission to do so, and we may require that you verify your identity directly with us. You may also make a request on behalf of your minor child.
• The request must be in writing and include your contact information and describe your request with sufficient detail that allows us to properly understand and respond to it. In addition, you should provide sufficient information that allows us to reasonably verify that you are the person about whom we collected the personal information or an authorized representative.
• We do not charge a fee to process or respond to individual rights requests unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Your privacy rights will vary depending on the country, province, state, or region in which you reside.

Contact Us

To contact us with questions about this Privacy Policy or to make a request:

Data Protection Officer:
To get in touch with our Data Protection Officer, please email:
privacy@stackadapt.com

Email:
privacy@stackadapt.com

Mail:
StackAdapt Inc.
6D – 7398 Yonge St, Unit # 2161
Thornhill, ON L4J 8J2, Canada

Or fill out our Consumer Rights Web Form.