Privacy Center

This Privacy Policy is designed to describe how we approach your privacy as an Internet user interacting with websites that have implemented our advertising technology.

Please note that this Policy does not pertain to the processing of personal data we collect through the www.rtbhouse.com website. This issue is comprehensively addressed in RTB House Website Privacy Policy.

This Policy includes sections tailored to specific regions. If you are located in one of those regions, the relevant section takes priority over the general provisions and describes how our data practices may differ for you. Please take a moment to review the section that applies to you.

1. General information

We are an advertising technology company that provides online advertisement services to advertisers (e.g., e-shops) in the programmatic advertising environment. Our role is to give advertisers an effective tool to display ads of their products or services on publishers’ websites and mobile applications you visit (e.g., news portals). Our ads are personalized, i.e., based on the information on your previous online activity. We will display to you the ads of those advertisers whose websites or apps you had visited in the past (a service known as retargeting) or ads that we believe otherwise match your current shopping interests.

In order to serve personalized ads, we process certain information related to your online activity that helps us understand what your current shopping interests might be and allows us to display an ad and analyze how it performs. While doing so, we aim at ensuring the highest level of privacy protection and transparency. We have processes in place to comply with all applicable privacy laws, in particular the EU General Data Protection Regulation (GDPR), Directive on Privacy and Electronic Communications (E-Privacy Directive), the California Consumer Privacy Act (CCPA) as well as established best practices on the digital advertising market.

2. How do we collect data

In order to collect your data, we use cookies, which are text files inserted in your web browser when you visit advertisers’ or publishers’ websites or apps, as well as other tracking technologies available on your device, such as mobile advertising ID. They allow us to register certain activities you perform on those websites or apps.

We operate under the creativecdn.com domain while providing our services. We store two cookies under this domain: (a) “u” which contains unique ID established for the browser you use (b) “ts” which stores the timestamp needed to establish cookie lifetime.

3. What data we process

We process the following three main groups of data:

(a) Information related to your browsing activity on advertisers’ websites or apps — it helps us understand what sorts of products and services you are interested in and, consequently, determine which ads should be displayed to you to match your current shopping interests. We process this data specifically for the purpose of creating your user profile.

(b) Information that you are currently entering a publisher’s website or app, where we may display an ad to you — it comes within a so called bid request, which is an offer to buy an advertising space on the publisher’s website or app in order to display an ad (for details, see Section 4 below). We process this information for the purposes of displaying ads, ad measurement, brand safety, product development, and fraud detection.

(c) Information regarding the delivery of our ads, i.e., impressions of an ad (e.g., whether we displayed an ad to you and, if so, which ad we selected) and your interactions with an ad (e.g., whether you clicked on it). We process this information for the purposes of displaying ads (in particular for frequency capping and ad rotation), ad measurement, and product development.

You may find a full list of categories of data we process as a data controller in our GDPR privacy notice see Section 5 below.

While providing our services, we do not collect directly personally identifiable information (PII), such as names, e-mail addresses, postal addresses, telephone numbers, or financial data, such as credit card details.

We do not receive any additional data from advertisers or partners, which, along with the data collected by our technology, would enable us to directly identify you.

4. How we use your data

While you are visiting an advertiser’s website or app (e.g., an e-shop), we collect certain information related to your activity there, such as which items you viewed, put in the basket, and bought. Those browsing patterns on the advertiser’s website or app help us understand what sorts of products and services you are currently interested in and thus display to you, on publishers’ digital properties (e.g., news portals), ads compatible with these interests.

We display our personalized ads with the use of a programmatic instantaneous auction system known as real-time bidding (RTB). Real-time bidding procedure happens at the moment you enter a publisher’s website or app that offers an advertising space for sale. While such website is loading, a bid request is sent to us by the publisher or our business partner cooperating with the publisher (e.g., supply-side platform, SSP) inviting us to buy a certain ad space. After receiving such bid request, our technology uses information about your previous browsing activity on advertisers’ websites or apps to decide whether to buy the auctioned ad space and, if so, which ad to display.

For instance, if you had recently visited our client’s e-shop looking for running shoes, we may display to you an ad of those same running shoes you had viewed there and similar running shoes or complementary products, such as running clothes offered by that advertiser.

We may also use information on the content of the website where the ad is to be displayed for the additional personalization of this particular ad, as well as use such website content to personalize future ads, for example we may this assign information to your user profile in order to categorize you (e.g., by assigning you to a particular population segment) or try to determine your shopping interests on the basis of your browsing history on publishers’ websites or apps.

Moreover, we do not use your browsing data across advertisers, which means that a browsing activity from one advertiser’s website or app does not affect other advertisers’ ads we display. For instance, the fact that you looked for swimming equipment in an e-shop of our client “A” will not result in us displaying you swimming equipment from an e-shop of our client “B” (unless you had previously browsed similar products on “B” e-shop as well).

After we display an ad to you, we collect information regarding ad impressions (e.g., that we indeed displayed an ad to you, which ad was selected, and when and on what type of device it was displayed) and your interactions with the ad (mainly whether you clicked on it or not). We use this information for the analysis of how our ads perform, for the creation of statistical reports for advertisers regarding the delivery of their ads, and subsequently for attribution and billing purposes. We also process this data for the control of the frequency of ads we display to you (frequency capping) and for product development purposes.

Our platform is integrated with the RTB environment through matching of our technical identifiers, e.g., cookie IDs or mobile advertising IDs (“cookie matching”) with those used by our business partners. It enables us to (a) receive a bid request and eventually serve an ad on a publisher’s website or app that uses our business partners’ digital advertising technology and (b) collect information related to our ad serving activities.

Using information provided by such advertisers, publishers, third-party data providers, and other vendors, we may link identifiers and perform cross-device tracking that consists of displaying and measuring relevant categories of ads of products or services on different devices you use (e.g. laptops, smartphones and connected TVs).

We also use your personal data for the detection of frauds and other potential dangers to privacy or security, for the calculation of the usage levels of our technology, and for brand safety purposes, i.e., to analyze whether publishers’ websites are a suitable environment for our ads to be displayed and to develop and improve our products.

Advertisers and publishers whose websites or apps you visit may independently collect and use your data for different purposes. Please consult their privacy policies for more information in this regard.

5. Personal Data Processing (GDPR)

Although, as described above, we do not collect personally identifiable information (PII), the data we do process is tied to unique online identification numbers that, under the GDPR, are considered “online identifiers” that allow us to “single out” a specific user from other users. According to the GDPR, such information may be considered personal data (this type of non-personally identifiable data is referred to as “pseudonymous data”). Consequently, in cases where the GDPR applies to our services, we assure compliance with all the requirements established by this regulation.

We have also appointed a data protection officer, whom you may contact if you have further questions. Please see Section 9 below for the Data Protection Officer contact details.

As a part of the GDPR compliance program, we have joined the IAB Europe Transparency & Consent Framework (TCF) as a registered vendor (ID No.: 16) and comply with the TCF policies. For more information, please visit https://iabeurope.eu/.

As mentioned above, some of data we use for providing services, we process as a data controller, which means we are solely responsible for it, and some – as a data processor i.e. on behalf of advertisers (under certain circumstances, instead of a data processor, we may act as a joint controller with respect to this data). You may access a set of information required by the GDPR pertaining to our data processing activities as a data controller in our GDPR Privacy Notice.

5.1. Data Controllers

RTB HOUSE S.A. - ul. Złota 61/101, 00-819 Warszawa, Poland

RTB HOUSE POLAND Sp. z o.o. - ul. Złota 61/101, 00-819 Warszawa, Poland

RTB HOUSE JAPAN K.K. - 2-15-19 Kamiosaki, Shinagawa-ku, Tokyo, Japan

RTB HOUSE PTE. LTD. - 10 Ubi Crescent, Singapore 408564

RTB HOUSE FZ-LLC - Building 5, Dubai Internet City, Dubai, United Arab Emirates

RTB HOUSE REKLAM TEKNOLOJILERI ANONIM SIRKETI - Bağdat cad. No 320, Kadıköy/Istanbul, Turkey

RTB HOUSE S.R.O. - Vinohradska 2828/151, Praha 3, Czech Republic

RTB HOUSE LIMITED - 128 City Road, London, EC1V 2NX, United Kingdom

RTB HOUSE LATAM LIMITED - 293 Green Lanes, London, N13 4XS, United Kingdom

RTB HOUSE NORDICS AB - World Trade Centre, Klarabergsviadukten 70, Stockholm, Sweden

RTB HOUSE GmbH - Kurfürstendamm 226, 10719 Berlin, Germany

RTB HOUSE FRANCE SAS - 32-34 Avenue Kleber, 75116 Paris, France

RTB HOUSE BENELUX B.V. - Prins Hendrikkade 21-E, 1012 TL Amsterdam, Netherlands

RTB HOUSE INC. - 2 Park Ave, New York, NY 10016, USA

RTB HOUSE BRAZIL SERVICOS DE TECNOLOGIA EM INTERNET LTDA. - Avenida Brigadeiro Faria Lima 1485, São Paulo, 01452-002, Brazil

RTB MARKETING & TECH SERVICES LIMITED - Kyriakou Matsi 18, Egkomi, Nicosia 2408, Cyprus

RTB HOUSE ITALY s.r.l. - Piazza Euclide 47, 00197 Roma, Italy

RTBH RETARGETING SL - Plaza Pablo Ruiz Picasso 11, 28020 Madrid, Spain

RTB HOUSE CEE Sp. z o.o. - ul. Złota 61/101, 00-819 Warszawa, Poland

RTB HOUSE KOREA LTD. - 50 Jong-ro 1-gil, Jongno-gu, Seoul, Korea

RTB HOUSE PTE. LTD. Taiwan Branch - 97 Songren Road, Xinyi District, Taipei 110, Taiwan

RTB HOUSE INDIA PRIVATE LIMITED - DLF Phase 5, Sector 43, Gurugram, Haryana, 122002, India

RTB HOUSE ARABIA FOR ADVERTISING CO. LTD. - Almurjana Tower, Prince Sultan St., Jeddah 21433, Kingdom of Saudi Arabia

RTB HOUSE MEXICO, S. DE R.L. DE C.V. - Vito Alessio Robles 51, Alvaro Obregon, 01050, Ciudad de Mexico

RTB HOUSE SWITZERLAND GMBH - Börsenstrasse 18, 8001 Zürich, Switzerland

RTB HOUSE BRAZIL SERVICES LTDA. - Av. Paulista 352, São Paulo, SP 01310-905, Brazil

ADLOOK LIMITED - 77 Farringdon Rd, London EC1M 3JU, United Kingdom

ADLOOK USA INC. - 641 Lexington Avenue, New York, NY 10022, USA

ADLOOK BRAZIL LTDA - Av. Paulista 352, São Paulo, SP 01310-905, Brazil

ADLOOK FRANCE SAS - 32-34 Avenue Kléber, 75116 Paris, France

ADLOOK POLAND SP. Z O.O. - ul. Złota 61/101, 00-819 Warszawa, Poland

ADLOOK ITALY S.R.L. - Piazza Vetra 17, 20123 Milano, Italy

ADLOOK SPAIN SL - C. de Méndez Álvaro 20, 28045 Madrid, Spain

ADLOOK GMBH - Kurfürstendamm 226, 10719 Berlin, Germany

ADLOOK INTERNATIONAL LIMITED - Kyriakou Matsi 18, Egkomi, 2408 Nicosia, Cyprus

PROMOTONS POLAND SP. Z O.O. - ul. Złota 61/101, 00-819 Warsaw, Poland

PROMOTONS LIMITED - Kyriakou Matsi 18, Egkomi, 2408 Nicosia, Cyprus

PROMOTONS FRANCE SAS - 32-34 avenue Kléber, 75116 Paris, France

acting as Joint Controllers

5.2. The substantial terms of the arrangement between the joint controllers

• RTB House S.A. acts as a Leading controller.

• The processing of personal data of data subjects is carried out via the bidding system, an IT system which is owned and managed by the Leading Controller.

• The Controllers jointly agree and implement all relevant security policies and procedures regarding personal data to achieve a coherent protection system.

• The Leading Controller is obliged to assure that the data subject receives a notification compliant with requirements laid down in Articles 13 or 14 of the GDPR. Each of the Joint Controllers is obliged to reveal to the Leading Controller any recipients to whom it has disclosed personal data.

• Joint Controllers have appointed a single Data Protection Officer who is responsible for handling data subjects’ requests.

• The Controllers jointly make decisions regarding data subject’s rights laid down in the GDPR.

• The lead supervisory authority for the group of undertakings is located in Poland.

5.3. Purpose of the processing

We will process your personal data, which includes storing and accessing certain information on your device (such as cookies or device identifiers) in order to carry out the following:

• use limited data to select advertising,

• create profiles for personalised advertising,

• use profiles to select personalised advertising,

• measure advertising performance,

• understand audiences through statistics or combinations of data from different sources,

• develop and improve services,

• ensure security, prevent and detect fraud, and fix errors,

• deliver and present advertising and content,

• save and communicate privacy choices.

5.4. Categories of personal data

For the above purposes, we will process the following categories of your personal data:

• unique online identifiers (including cookie IDs and mobile advertising IDs);

• URLs of the web pages you visited (“referrer”);

• data related to ad impressions and your interactions with our ads on publishers’ websites or apps;

• technical browser and device information (“user agent”);

• timestamps

• IP addresses indicating your general (non-specific) location.

5.5. Legal basis for the processing

The legal basis for storage and/or access information on your device as well as for the processing of your personal data for the purposes: (1) use limited data to select advertising, (2) create profiles for personalised advertising, (3) use profiles to select personalised advertising, (4) measure advertising performance, (5) understand audiences through statistics or combinations of data from different sources, (6) develop and improve services, is the consent you give on publishers’ websites or apps. You are entitled to withdraw the consent to the processing of your personal data and storing and/or accessing information on your device by us at any moment. You may do so by clicking an opt-out button on our opt-out page: https://optout.rtbhouse.com or by contacting us directly at: dpo@rtbhouse.com.

With respect to (1) ensuring security, preventing fraud, and fixing errors, (2) delivering and presenting advertising, and (3) saving and communicating privacy choices, the legal basis for the processing of your personal data is the legitimate interest of the controller, pursuant to Article 6 Section 1 (f) of the GDPR.

5.6. Sources of the personal data

We obtain your data either from publishers, on whose digital properties we display our advertisements, or from supply-side platforms (SSPs), cooperating with publishers for the purposes of delivering personalized advertisements. An example of an SSP we cooperate with is Google AdX. You can read more about Google's privacy practices and its use of cookies on this website.

We collect some of the information, such as data related to ad impressions and your interactions with ads, ourselves from publishers’ websites or apps.

5.7. Recipients of the personal data

We may transfer your data to our processors (e.g., IT service providers and data centers) where such entities process data on the basis of a contract with us and only in accordance with our instructions.

We may also transfer very limited amounts of data to our business partners (e.g., SSPs) in a response to a bid request in order to be technically able to display an ad.

5.8. Data subject’s rights

You have the following rights with respect to your personal data:

• the right to withdraw your consent to the processing at any time, e.g., by means of an opt-out procedure without affecting the lawfulness of processing based on consent before its withdrawal;

• the right to object to the processing of the personal data for direct marketing purposes or, on grounds relating to your particular situation, whenever the legal basis for processing is controllers’ legitimate interest;

• the right to access to the personal data;

• the right to obtain from the controller restriction of processing as referred to in Article 18 of GDPR;

• the right to request that your personal data be corrected if it is found to be inaccurate or out of date;

• the right to request your personal data be erased where it is no longer necessary for us to retain such data;

• the right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing; and

• the right to request that we provide you with your personal data and where possible to transmit that data directly to another data controller. You are entitled to request a copy of your personal data processed by us.

5.9. Profiling

Within the scope of processing that we undertake as a data controller, we conduct activities that may be deemed “profiling” of your personal data only to a very limited extent (i.e., analysis of data regarding ad impressions and your interactions with our ads for ad measurement purposes).

We do, however, conduct profiling with respect to the data related to your browsing activity on advertisers’ websites or apps (i.e., data we process on behalf of advertisers, as a data processor). We analyze it in order to display to you an ad that we believe you will be most interested in, as described in Section 4 above.

In any case, the profiling does not produce any legal effects toward users or similarly significantly affects them. In particular, it does not result in price discrimination among the users based on their behavioral profile.

5.10. Retention periods

We immediately delete all data received in bid requests, except for a minor fraction needed for statistical and analytical purposes (including brand safety and fraud detection), which is stored for no more than 100 days.

The data regarding ad impressions and your interactions with the ad is kept as long as it is needed for statistical, settlement, and product development purposes. It is stored for no longer than 500 days from its collection, except that the data from ad interactions is stored for additional 65 days on our backup systems, where it is not actively used and is deleted according to the predefined retention schedule.

After the lapse of periods specified above, the data is truncated or effectively anonymized.

In any case, we promptly respond to data subject requests related to the execution of the right to be forgotten by deleting all personal data covered by a given request.

5.11. Transfers to third country and safeguards

We shall not transfer or permit any of your personal data to be transferred to a territory outside of the European Economic Area unless we have taken such measures that are necessary to ensure that the transfer is in compliance with applicable laws. Such measures may include (without limitation) transferring personal data to a recipient in a country that the European Commission has decided provides adequate protection for personal data as referred to in Article 45 of the GDPR.

If you wish to find the list of the countries that the European Commission recognized as providing adequate protection, then click here.

5.12. Further Processing

If we need to use your personal data for a purpose not covered by this notice, then we will provide you with a new notice explaining such new use, prior to commencing the processing, and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing operation.

5.13. Data Protection Officer

We have appointed a data protection officer. It is a person you may contact regarding any issues related to privacy issues at RTB House and the exercise of your rights concerning the processing of your personal data.

You may contact our Data Protection Officer:

• by mail to the following address: Katarzyna Kamińska, RTB House SA, 61/101 Złota St., 00-819 Warsaw, Poland and

• by e-mail: dpo@rtbhouse.com.

5.14. Contact details and lodging a complaint with supervisory authority

To exercise all relevant rights and the queries of complaints, please contact RTB House S.A. via e-mail dpo@rtbhouse.com.

You are also entitled to lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or an alleged infringement of the GDPR. Please find the contact details to supervisory authorities that have jurisdiction over our activity.

POLAND

Prezes Urzędu Ochrony Danych Osobowych

https://www.uodo.gov.pl/pl/p/kontakt

2 Stawki St.

00-193 Warszawa, Poland

T: + 606-950-000

GERMANY

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Friedrichstr. 219

10969 Berlin

Tel.: +49 30 13889-0

Fax: +49 30 2155050

E-Mail: mailbox@datenschutz-berlin.de

CZECH REPUBLIC

Úřad pro ochranu osobních údajů

posta@uoou.cz

Pplk. Sochora 27

170 00 Praha 7

T: +420 234 665 111

UNITED KINGDOM

Information Commissioner’s Office

casework@ico.org.uk

Wycliffe House

Water Lane, Wilmslow

Cheshire, SK9 5AF

T: + 44 0303 123 1113

SWEDEN

Datainspektionen

datainspektionen@datainspektionen.se

Drottninggatan 29, 5th floor

Box 8114

SE-104 20 Stockholm

T: +46-70 736 10 80

FRANCE

Commission Nationale de l’Informatique et des Libertés

3 Place de Fontenoy

TSA 80715

75334 PARIS CEDEX 07, France

T: +33 (0)1 53 73 22 22

NETHERLANDS

Autoriteit Persoonsgegevens

Postbus 93374

2509 AJ DEN HAAG

T: +31 – (0)70 – 888 85 00

HUNGARY

Nemzeti Adatvédelmi És

Információszabadság Hatóság

privacy@naih.hu

H-1125 Budapest

Szilágyi Erzsébet fasor 22/C

T+: +36 -1-391-1400 F

ITALY

Garante per la protezione

dei dati personali,

Piazza Venezia n. 11 – 00187 Roma,

garante@gpdp.it

SPAIN

Agencia Española

de Protección de Datos,

C/ Jorge Juan, 6. 28001 – Madrid

CYPRUS

Office of the Commissioner for Personal Data Protection

Iasonos 1, 1082 Nicosia, Cyprus

P.O.Box 23378, 1682 Nicosia, Cyprus

6. US Laws Privacy Policy

As to personal information collected from Advertisers (e.g. e-shops)

1. Categories of personal information we collect and disclose

• IP addresses, Device identifiers (e.g., cookie IDs, mobile advertising IDs, device IDs), and Authentication-derived identifiers (e.g., hashed email addresses).

• Device characteristics (user agent, browser type, OS), Browsing and interaction data (pages/offers viewed, items added to basket, purchase value), and Privacy choices (opt-out signals).

• Users’ profiles (information from this section under a unique identifier, as well as potentially the inferred consumer interest segments such as “high-spender”) derived from activity across multiple advertiser digital properties.

• Non-precise location data (approximate location derived from IP address, restricted to a radius of 500 meters or more).

2. Our Business or Commercial Purposes for Collecting, Selling, or Sharing data

• Store and/or access information on your device, for example by dropping RTB House’s cookies or using local storage via our tags to assign unique identifier to your browser;

• Create and use profiles for personalised advertising;

• Measure advertising performance, for example by tracking conversions;

• Understand audiences through statistics, for example by pooling multi-advertiser inputs to build common characteristics;

• Develop and improve services;

• Ensure security, prevent and detect fraud.

In support of these purposes, we match and combine data from other sources (in certain cases pooling data across advertisers), link different devices (Identity Graphing), and identify devices based on information transmitted automatically.

3. Disclosure of "Sales" and "Sharing" for Cross-Context Behavioral Advertising

For the purposes of the CCPA:

• Receiving shared/sold data: RTB House acts as a recipient of your personal information shared by Advertisers for cross-context behavioral advertising.

• Downstream sharing/selling: RTB House discloses your Device identifiers to third-party partners (such as Supply-Side Platforms or Identity Providers) to facilitate the delivery of ads and to Identity Solutions Providers to build user profiles. This allows us to recognize your shopping interests as you move between different digital properties.

4. Disclosure of Personal Information for a Business Purpose

In the preceding 12 months, we have disclosed the personal information categories described above to our Service Providers (e.g., IT service providers and data centers) where such entities process data on the basis of a contract with us and only in accordance with our instructions. We do not have knowledge that we sell or share the personal information of consumers under 16 years of age.

5. Your Right to Opt-Out of the Sale or Sharing of Personal Information

You have the right to opt-out of the selling/sharing of your data and its processing for Targeted Advertising. You can opt-out by enabling Global Privacy Control or by visiting our opt-out feature:

6. Rights Under CCPA and Other U.S. State Laws

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Indiana, Kentucky, and other states listed here), you may have the right to confirm whether we process your information, to access specific pieces of data (in a portable format), and request the deletion or correction of your data.

To fulfill all such requests (Access, Delete, Correct, or Appeal a denied request), please email dpo@rtbhouse.com.

We will not discriminate against you for exercising your privacy rights.

7. Authorized Agent

You can designate an authorized agent to make a request under the CCPA on your behalf if:

• The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and

• You sign a written declaration that you authorize the authorized agent to act on your behalf.

If you use an authorized agent to submit a request to exercise your right to know or your right to request deletion, please have the authorized agent take the following steps:

• Mail a certified copy of your written declaration authorizing the authorized agent to act on your behalf to dpo@rtbhouse.com and

• Provide any information we request in our response to your email to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.

If you provide an authorized agent with power of attorney, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.

8. Data Retention Criteria

We retain advertiser-derived data for as long as it is active in a user profile, typically up to 500 days. De-identified or aggregate data may be kept longer for statistical, fraud prevention and marketing purposes.

9. Use of Sensitive Personal Information (Notice of Limitation)

RTB House does not collect or process Sensitive Personal Information. We do not use or disclose such information for any purpose.

10. Contact for More Information

For questions regarding your rights or our processing practices, contact us:

• Via toll-free phone number at +1 (212) 204-1733;

• Via email at at dpo@rtbhouse.com.

11. Accessibility

This notice is designed to be accessible to individuals with disabilities. If you require this notice in an alternative format, please contact us at dpo@rtbhouse.com.

12. Third-party partners’ disclosures

Our third-party partners, including Tapad, Inc., may set and/or access cookies or other data collection technology which collect personal information (not including your name, address, or telephone number) about your visits to this and other websites, mobile websites and/or mobile applications across various devices, in order to match those devices together by creating a profile revealing likely associations of, or connections between them. That profile is used to determine likely associated devices visiting the websites or applications on different devices, and to provide more tailored advertising, marketing, measurement, analytics, and research about goods and services of interest to you across those various devices. If you would like more information about this practice and to know your choices with respect to it, please refer to the relevant third parties' privacy policies. Tapad's privacy notice is available at https://www.tapad.com/global-privacy-notice. Click HERE to opt out from Tapad’s services.

7. LGPD Privacy Policy

7.1. Data controller

Under the Brazilian Personal General Data Protection Law (“LGPD”), RTB House Brazil Serviços de Tecnologia em Internet LTDA, Av. Brigadeiro Faria Lima, 1485, Andar 1, Sala 117, Torre Norte, Jardim Paulistano, São Paulo, (“RTB House” or “We” or “Us”) disclosure information about our data processing practices as required by the LGPD.

7.2. Data Protection Officer

We have appointed a data protection officer. It is a person you may contact regarding any issues related to privacy issues at RTB House and the exercise of your rights concerning the processing of your personal data.

You may contact our Data Protection Officer Katarzyna Kamińska:

• by mail to the following address: RTB House SA, 61/101 Złota St., 00-819 Warsaw, Poland and

• by e-mail: dpo@rtbhouse.com.

7.3. Purpose of the processing

We will process your personal data, which includes storing and accessing certain information on your device (such as cookies or device identifiers) in order to carry out the following:

• use limited data to select advertising,

• create profiles for personalized advertising,

• use profiles to select personalized advertising,

• measure advertising performance,

• understand audiences through statistics or combinations of data from different sources,

• develop and improve services,

• ensure security, prevent and detect fraud, and fix errors,

• deliver and present advertising and content,

• save and communicate privacy choices.

7.4. Categories of personal data

For the above purposes, we will process the following categories of your personal data:

• unique online identifiers (including cookie IDs and mobile advertising IDs);

• URLs of the web pages you visited (“referrer”);

• data related to ad impressions and your interactions with our ads on publishers’ websites or apps;

• technical browser and device information (“user agent”);

• timestamps

• IP addresses indicating your general (non-specific) location.

7.5. Legal basis for the processing

The legal basis for the processing of your personal data for the purposes of (1) using limited data to select advertising, (2) measuring advertising performance, (3) developing and improving services, (4) creating profiles for personalized advertising, (5) using profiles to select personalized advertising, (6) understanding audiences through statistics or combinations of data from different sources, is the consent you give on publishers’ websites or apps. You are entitled to withdraw the consent to the processing of your personal data by us at any moment.

You may do so by clicking an opt-out button on our opt-out page: https://optout.rtbhouse.com or by contacting us directly at: dpo@rtbhouse.com.

With respect to (1) ensuring security, preventing fraud, and fixing errors, (2) delivering and presenting advertising, and (3) saving and communicating privacy choices, the legal basis for the processing of your personal data is the legitimate interest of the controller, pursuant to Article 7 IX of the LGPD.

7.6. Sources of personal data

We obtain your data either from publishers, on whose digital properties we display our advertisements, or from supply-side platforms (SSPs), cooperating with publishers for the purposes of delivering personalized advertisements. An example of an SSP we cooperate with is Google AdX. You can read more about Google's privacy practices and its use of cookies on this website.

We collect some of the information, such as data related to ad impressions and your interactions with ads, from publishers’ websites or apps.

7.7. Recipients of personal data

We may transfer your data to our processors (e.g., IT service providers and data centers), where such entities process data on the basis of a contract with us and only in accordance with our instructions.

We may also transfer very limited amounts of data to our business partners (e.g., SSPs) in response to a bid request in order to be technically able to display an ad.

7.8. Data subject’s rights

You have the following rights with respect to your personal data:

• confirmation of the existence of the processing (article 18, I LGPD);

• access to the data (article 18, II LGPD);

• correction of incomplete, inaccurate, or out-of-date data (article 18, III LGPD);

• anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of the LGPD (article 18, IV LGPD);

• portability of the data to another service or product provider by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the controlling agency (article 18, V LGPD);

• deletion of personal data processed with the consent of the data subject, except in the situations provided in LGPD (article 18, VI LGPD);

• information about public and private entities with which we shared data (article 18, VII LGPD);

• information about the possibility of denying consent and the consequences of such denial (article 18, VIII LGPD);

• revocation of consent, e.g., by means of an opt-out procedure (article 18, IX LGPD);

• the petition, regarding your data, against us before the National Data Protection Authority (“ANPD”) (article 18, §1 LGPD)

• oppose the processing carried out based on one of the situations of waiver of consent if there is noncompliance with the provisions of the LGPD (article 18, §2 LGPD)

7.9. Profiling

Within the scope of processing that we undertake as a data controller, we conduct activities that may be deemed “profiling” of your personal data only to a very limited extent (i.e., analysis of data regarding ad impressions and your interactions with our ads for ad measurement purposes).

We do, however, conduct profiling with respect to the data related to your browsing activity on advertisers’ websites or apps (i.e., data we process on behalf of advertisers as a data processor). We analyze it in order to display to you an ad that we believe you will be most interested in, as described in Section pertaining to the purposes of the processing included above.

In any case, the profiling does not produce any legal effects toward users or similarly significantly affects them. In particular, it does not result in price discrimination among the users based on their behavioral profile.

7.10. Retention periods

We immediately delete all data received in bid requests, except for a minor fraction needed for statistical and analytical purposes (including brand safety and fraud detection), which is stored for no more than 100 days.

The data regarding ad impressions and your interactions with the ad is kept as long as it is needed for statistical, settlement, and product development purposes. It is stored for no longer than 500 days from its collection, except that the data from ad interactions is stored for additional 65 days on our backup systems, where it is not actively used and is deleted according to the predefined retention schedule.

After the lapse of periods specified above, the data is truncated or effectively anonymized.

In any case, we promptly respond to data subject requests related to the execution of the right to delete all personal data covered by a given request.

7.11. Transfers to third countries and safeguards

We shall not transfer or permit any of your personal data to be transferred to a territory outside of Brazil unless we have taken such measures that are necessary to ensure that the transfer is in compliance with applicable laws, especially but not limited to, the provisions of article 33 of the LGPD.

RTB House may transfer personal data to the European Union only for the purposes of the processing indicated above.

7.12. Further Processing

If we need to use your personal data for a purpose not covered by this notice, we will provide you with a new notice explaining such new use and setting out the relevant purposes and processing conditions prior to commencing the processing. Where and whenever necessary, we will seek your prior consent to the new processing operation.

7.13. Contact details and lodging a complaint with supervisory authority

To exercise all relevant rights and the queries of complaints, please contact us via e-mail dpo@rtbhouse.com.

You are also entitled to lodge a complaint with the supervisory authority:

Autoridade Nacional de Proteção de Dados (ANPD)

Praça dos Três Poderes - Brasília (DF) - Planalto Palace, Annex I, Wing B, Room 101.

https://www.gov.br/anpd/pt-br

8. Data Security Measures

We have implemented organizational and technical measures to assure an appropriate level of security of your data. We have deployed procedures regarding every aspect of data processing, and we carefully select technologies used for such processing and any data recipients.

Your data is protected against human interactions, equipment malfunctions, internal or external attacks, losses, or misuses. We store it in top-tier multi-tenant data centers operated by market-leading companies with appropriate data security certifications (in particular ISO 27001). In order to ensure the ongoing confidentiality and availability of your data, we use encryption and a back-up mechanism.

We constantly monitor the implemented security measures and develop the awareness and knowledge about privacy and personal data protection at our company on an ongoing basis.

9. Exercising Your Privacy Rights

If, after having been acquainted with the extent of data collected about your online activity, you have any concerns about your privacy, then you may disallow the collection of data by means of tracking technologies used by us specifically or by all providers in the following ways.

You may disable cookies in your web browser and mobile devices, which will prevent the collection of data by all providers.

For web browsers, please refer to your browser’s settings, as the procedure may depend on the browser you use. Please note that, due to the common use of cookies, turning them off may prevent you from using a variety of websites.

For mobile devices, please use device settings.

• For iOS, select “Privacy” → “Tracking” → disable “Allow Apps to Request to Track”.

• For Android, select “Users Area” → “Google” → “Ads” → “Opt out of Ads Personalization”.

You may also opt out specifically from RTB House tracking technology that will prevent us from collecting information from your browser and result in the deletion or effective anonymization of all data previously collected. In order to opt out from RTB House personalized ads, please use the following link:

Given that cookies are stored in a particular Internet browser, if you use more browsers or more devices, you must opt-out from each of them.

Furthermore, opt-out is conducted by inserting another “opt-out cookie” in your browser. Therefore, if you delete all cookies in your browser’s settings, then you will also delete an opt-out cookie. In those cases, you may need to opt-out again.

Please note that upon an advertiser’s specific request, we may configure and support the ad campaigns of the advertiser’s products of services on Facebook. If you wish to disallow the display of personalized ads on Facebook, then please manage your Facebook Ad Settings.

The GDPR grants you additional rights, such as the right of access, rectification, erasure, or portability of your personal data and the right to object to or restrict the processing and to lodge a complaint with a supervisory authority. Furthermore, where we have collected and processed your personal data subject to your consent, you can withdraw it at any time. Such withdrawal does not affect the lawfulness of the processing we have conducted prior to your withdrawal. To learn more, see our GDPR notice, or contact our Data Protection Officer.

10. Privacy Policy Changes

In order to develop the privacy protection, we may deem it fit or necessary to update this Privacy Policy at any time. Please follow our website where we will inform you about any material changes to our Privacy Policy.

11. Contact

If you have any further questions related to your privacy, please do not hesitate to contact our Data Protection Officer at the following:

Data Protection Officer

RTB House S.A.

61/101 Złota Street

00-819 Warsaw, Poland

dpo@rtbhouse.com

Last updated: February, 2026, v.1.2