Canada Privacy Statement

Last Updated and Effective: February 10, 2025

This Canada Supplemental Privacy Policy supplements the Platform and Services Privacy Policy and applies to you and your use of our Platform. 

We encourage you to read our Platform and Services Privacy Policy and this Canada Supplemental Privacy Policy (“Supplemental Privacy Policy”) because we want you to understand what personal information we collect and how we use and share it.

In the Platform and Services Privacy Policy, we describe the personal information that we process via our Platform. This Supplemental Privacy Policy adds to the Platform and Services Privacy Policy by providing additional information under applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

For more details regarding our Website and related privacy practices, please refer to our Website and Platform Privacy Policy.

Personal Information 

Canadian privacy laws generally define “personal information” as any information about an identifiable individual, regardless of whether such information has been recorded, that directly or indirectly allows that individual to be identified.

Internal Practices 

Data Classification. We have established formal data-handling guidelines that serve as our framework to govern the internal access, storage, and destruction of personal information across our organization. Within this framework, we maintain a data classification standard, where personal information is classified according to sensitivity. Our data classification standards apply to all business units within our organization, our employees, temporary employees, as well as subcontractors.

Accountability. We have established controls and mechanisms to protect data at each stage of the data lifecycle, from collection through disposal. We have a formal Change Management Policy that governs the mechanisms for how IT changes are managed across each stage of the software development lifecycle, as well as Responsible, Accountable, Consulted, and Informed (RACI) matrices and procedure descriptions. Aligning our data classification standards with change management methods and techniques allows for efficient and prompt handling of all application changes, permitting us to meet agreed service levels with our clients, and lessens the occurrence of any change-related incidents.

Data Sharing

Data Transfer. We may collect your personal information from, transfer it to, and store and process it, within our organization, and certain third-party service providers to perform functions on our behalf, outside of Canada, including in the United States. Whenever we share personal information outside of Canada, we ensure that the transfer complies with applicable Canadian privacy laws so that your personal information is adequately protected. While such personal information is outside of your jurisdiction of residence, it is subject to the laws of the jurisdiction in which it is held, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other jurisdictions, pursuant to local laws.

Data Storage. We may process and store personal information anywhere our servers are located. We leverage the ’Amazon Web Services’ (AWS) public, cloud-based platform to support the delivery of key services to its customers. Currently, we subscribe to the data centers located in the United States, Germany, and Singapore. For more information about our servers and storage of personal information, please contact us as described below.

Technologies

Profiling. Our Platform is used by client marketing teams to create digital advertising campaigns. To enable our clients to plan and effectuate campaigns that most likely are to be of interest to you, our Platform is underpinned by databases storing user-profile information, including cookie IDs, device IDs, IP addresses, email addresses, and universal IDs. Profiling technologies are therefore used to analyze this data and to tailor advertising content. We also source data from third-party vendors, including providers of data management platform services, to enrich our existing user-profile datasets. Our clients can also track key performance indicators (KPIs) associated with campaigns through the inclusion of pixels within campaigns, which fire in order to track campaign outcomes (e.g., conversion, engagement, etc.), as well as user behavior metrics, such as time on site. The StackAdapt pixel also transfers browser data to us, including IP address, the user agent, when available, the contents of the cookie, and referral page URL.

Location. Within our Platform, our clients can create location-based segments to select audiences for upcoming advertising campaigns. Our clients are encouraged to use radiuses higher than 2.5 km.

Identification. We maintain internal-identity graphs to stitch together universal identifiers that assist our clients in targeting and retargeting specific audiences with relevant advertising campaigns. Many of these universal identifiers are considered personal information and include cookie identifiers, device identifiers, third-party identifiers, our own internal identifiers, and IP addresses. 

Automated Decision Making. If you think your personal information used to match relevant ads to your browsing is inaccurate, you can request to have the personal information used to render the decision corrected. Furthermore, you are also given the opportunity to submit observations to a member of our personnel who can review the decision by contacting us as described below.

To opt out of targeted advertising powered by StackAdapt, click here

Privacy Rights

Depending on your province, as required or permitted by applicable Canadian privacy laws, and subject to appropriate identification, you may be entitled to following rights: 

Access Right. You can access and request a copy of the personal information we may hold about you.

Rectification Right. You can request that we correct any incomplete or inaccurate personal information we hold about you. Because the data in our Platform is pseudonymous and not directly identifiable, we may not have the technical ability to correct your personal information. In that case, we will delete the incomplete or inaccurate personal information instead.

Deindexation Right. You have the right to request that we stop disseminating your personal information or de-index hyperlinks associates to your name, if such dissemination violates the law or a court order. 

Data Portability Right. You have the right to receive personal information that you have provided directly to us, for example, through opening an account, in a commonly used and machine-readable format. You have this right so that you may transmit your information to another organization without hindrance.

Consent Withdrawal. You have the right to withdraw your consent at any time, to the extent we are relying on consent for our data processing. 

Right to Complain. You have a right to lodge a complaint with a competent data protection authority, particularly in the province where you usually reside, where we are based or where an alleged breach of data protection law has occurred, such as the Office of the Privacy Commissioner of Canada.

To exercise these rights, please fill out our Consumer Rights Web Form or contact us as described below.

Updates 

We may update this Supplemental Privacy Policy from time to time. Such changes will be effective immediately upon posting. If we amend this Supplemental Privacy Policy, we will revise the Last Updated date based on when we posted the updated version. Subject to applicable laws, we will notify you of any changes to this Supplemental Privacy Policy by providing notice.

Contact Us

If you have any questions, concerns or comments about your personal information or this Supplemental Privacy Policy, please contact our Privacy Officer by email at privacy@stackadapt.com or by mail at StackAdapt Inc., 200 Bay Street – South Tower, Unit # 2103, PO Box #94 Toronto, Ontario, Canada M5J 2J1.