PRODUCT AND SERVICES PRIVACY POLICY

zeotap GmbH (“Zeotap,” “us,” “we,” or “our”) is a company that offers the next-generation Customer Data Platform. It empowers brands to unify, enhance and activate customer data in a cookieless future, all while putting consumer privacy and compliance front-and-centre. Our services either solely use Zeotap’s proprietary technology or use its proprietary technology in combination with customer data (“User Data”) received from third parties (“Data Partners”), including but not limited to, customer data unification, identity extension, data onboarding, data matching, data insights, custom audience building, analytics/modelling, audience targeting in web and mobile advertising, and transfer of data into activation systems (including marketing ecosystem partners) (“Services”). Please note that, as mentioned above, our Services are comprised of two types: (i) software products (“Software Products”), as part of which we are using solely Zeotap’s proprietary technology to process and arrange the customer data shared by our Clients (as defined below), and (ii) data products (“Data Products”), as part of which we use User Data either alone or in combination with the customer data shared by our Clients (as defined below). You can learn more about our Products and Services on our website.

Zeotap participates in the IAB Europe Transparency & Consent Framework and complies with its Specifications and Policies. Zeotap’s identification number within the framework is 301.

Our Data Partners are mobile network operators, mobile application providers, media, technology platform providers, owners of media properties (“Publishers”), brands, agencies and others that have access to certain User Data that they wish to monetize by using our Services.

Our clients (“Clients”) are businesses, including brands and agencies (“Advertisers”), Publishers, and other companies that send digital targeted advertising to  consumers. By using our Services, our Clients can address a particular audience and tailor advertisements to the likely interests and preferences of such audience.

We work to ensure that our Services respect users’ privacy rights. To accomplish this goal, we adhere to privacy-by-design and privacy-by-default principles throughout the process of designing, building, and delivering our Services.

By law, we are required to provide you with information regarding:

• how and on what legal basis we use and disclose your personal data;
• how we take care of your privacy rights specific to your personal data;
• how you can reach us in case you have any concerns regarding this privacy policy (“Policy”) or the way we are handling your personal data.

The terms of this Policy apply to all User Data to the extent it contains your personal data as defined in the applicable laws and regulations.

This Policy does not apply to personal data collected by our website zeotap.com. To access our website privacy policy, click here.

This Policy also does not apply to information collected by our Data Partners, Clients or other third parties who may provide personal data to us, as their personal data handling practices are covered by their own privacy policies.

This Policy may change from time to time, so please check back periodically to ensure that you are aware of any changes in our processing of your personal data.

Data categories we receive and use

As part of the Data Products, we receive the following categories of User Data from our Data Partners:

• mobile advertising device IDs such as Apple’s Identifier For Advertisers (IDFA) and Google Android Advertising ID (“Ad IDs”);
• cookie IDs;
• hashed email addresses and hashed telephone numbers;
• demographic information like age, gender, city/region, income, language and mobile contract data such as prepaid/postpaid (“Demographic Data”);
• mobile app usage data about apps installed/accessed on a user’s device and app events and browsing data such as browsing URLs (Uniform Resource Locators) (“App Usage and Browsing Data”);
• purchase data, such as interest in and intent to purchase certain products or services;
• geolocation data
• TC String

We do not receive any ‘special categories of personal data’ (i.e., information about your race, ethnicity, religious or philosophical beliefs, sexual orientation, sex life, political opinions, health, trade union membership, or genetic/biometric data) or, knowingly, any personal data about children under the age of 16.

Our Data Partners may collect data directly from users (both online and offline) or receive data from third parties.

We request that our Data Partners provide users with all required information about the use of their personal data and allow users to exercise their rights according to applicable laws and regulations.

We may also use cookies, pixels and similar tools to collect users’ Ad IDs or cookie IDs ourselves. These tools also automatically collect and send us information such as referral URLs, user agent string, and IP addresses. This information is a normal part of the log file information that is routinely exchanged as part of communication between operating systems.

When we obtain different User Data pertaining to the same device from multiple Data Partners, we aggregate such User Data and store it against the same Ad ID (advertising identifier, associated with a device) or Cookie ID (a string of characters that websites and servers associate with the browser on which the cookie is stored). Zeotap also maintains a separate ID inventory, which connects the User Data into a common ID (“zeoID”) and is an internal pseudonymous identifier.

We enhance User Data to create de-identified data segments and aggregate such segments into segment lists or Ad ID / Cookie ID lists based on our Clients’ preferences. We then share such lists with our Clients to enable them to effectively target the relevant users.

We do not process information that directly identifies a particular individual such as an unencrypted name, address or government-issued ID number. However, whether or not User Data we receive are considered personal or personally identifiable data depends on, among other factors, the definition that applies in a user’s physical location. For example, in some locations, a user’s IP address may be deemed to be personal data, while in others it is not.

We do not interact directly with users or their devices, unless a user sends us a deletion request, as described below under “YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA (INCLUDING OPT-OUT OPTIONS)”

Please note that as part of our Software Products we may receive various additional categories of User Data from our Clients (including directly identifiable data).

Below we describe the User Data categories in more detail.

A. Online identifiers

Advertising IDs

Ad IDs are user-resettable, unique, anonymized identifiers for advertising. Ad IDs identify a specific device and are implemented both on IDFA and Google Android Advertising ID.

We obtain Ad IDs associated with de-identified User Data from our Data Partners. Ad IDs are then used by our Clients to identify advertising requests and to deliver relevant advertisements. We may also use Ad IDs to establish a relationship between different User Data attributes pertaining to the same user. For example, if we obtain User Data that indicates a certain user is between 25 and 30 years old, and later learn from another Data Partner that the user of the same device is interested in a healthy lifestyle, we combine this information against the same Ad IDs or cookie ID.

Cookie IDs

An HTTP cookie (also called web cookie, Internet cookie, browser cookie or simply a cookie) is a small piece of data sent from a website and is stored in the user’s web browser while the user is browsing.

We set third party cookies on behalf of Publishers who provide space for the display of advertising within websites. We may use cookies to establish a relationship between devices or data pertaining to the same user. If we already have information about a device’s user, we may link the information stored in cookies to the device’s Ad ID. We call this activity of linking information “mapping.” We use this information to facilitate the delivery of our Clients’ targeted Ads.

B. Browsing data

Log file information

In the course of the mapping activity described in the above paragraph, we receive such information as referral URLs, user agent string, and IP addresses.

When you come to the website where Zeotap cookies are set, the log file we automatically receive includes the referral URL, which is the address of the website that you came from. We do not use and discard referral URLs within a reasonable time in compliance with our data retention period.

We use IP addresses to derive information such as country and carrier. Afterwards, we discard IP addresses within a reasonable time in compliance with our data retention period.

We use user agent string information contained in the log file to determine your device operating system and device model. Afterwards, we discard user agent string within a reasonable time in compliance with our data retention period.

C. Offline identifiers

Hashed email addresses and hashed phone numbers

Some Data Partners or Clients may provide their offline data, such as hashed email addresses and hashed phone numbers. We require that such data are hashed using secure hashing algorithms prior to sharing with Zeotap.

We use hashed emails or hashed phone numbers to establish a relationship between offline and online user profiles pertaining to a certain user and enrich the profiles pertaining to those online users. For example, our Client would like to run an advertising campaign on mobile devices targeting users whose hashed email addresses and/or hashed phone numbers the Client already has. However, without respective Ad IDs, the Client cannot target the desired audience. By comparing hashed email addresses and hashed phone numbers provided by the Client with the User Data we have from our Data Partners, we can match hashed email addresses or hashed phone numbers to Ad IDs corresponding to the same user. As a result, we have a list of Ad IDs corresponding to the list of users the Client would like to target. Additionally, we can also enrich those lists with additional profile data, such as the ones described below.

Hashed emails would also serve as a basis for the creation of ID+, our tokenized individual pseudonymous identifier and specific to a user. You can learn more about ID+ here.

D. Profile data

Demographic data

We may obtain demographic User Data from our Data Partners, such as:

• user demographics (e.g., age or age range and gender);
• general geographic area of the user address and zip code;
• predicted or actual income tier;
• other demographic information that was received or collected by our Data Partners.

Zeotap uses this information to create demographic segments about users, for example, users who are “males, 30 to 34, living in Brooklyn.” We connect segments with Ad IDs so that our Clients can reach their target audiences on mobile devices.

App usage data

We may obtain App Usage and Browsing Data from our Data Partners, such as:

• apps installed/accessed on a user’s device;
• app events such as purchases or sign-ins;
• browsing data such as URLs.

URLs are web addresses, a specific character string that constitutes a reference to a resource. Most web browsers display the URL of a web page above the page in an address bar.

We transform App Usage and Browsing Data into aggregated segments based on interests or purchase intent (such as Sports Enthusiast, Health & Fitness Buffs) which are of interest to our Clients.

Purchase data

We may obtain purchase data from our Data Partners, such as:

• items you have bought in stores;
• items you have bought online;
• items you have put in a shopping basket online.

E. Geolocation data

We may receive data from Data Partners about the physical location of a specific device, including latitude-longitude coordinates obtained through GPS tools, Wi-Fi or cell tower triangulation techniques.

The location data we receive from Data Partners may be generalized, non-precise location data, or we may render the location data non-precise, in order to provide generalized location data to our Clients. Our Clients may use inferences from this information to send localized ads or targeted ads. We do not process precise location EU and UK data.

F. TC String

A TC String’s primary purpose is to encapsulate and encode all the information disclosed to a user and the expression of their preferences for their personal data processing under the GDPR. Using a Consent Management Platform (CMP), the information is captured into an encoded and compact HTTP-transferable string. This string enables communication of transparency and consent information to entities, or “vendors”, that process a user’s personal data. Vendors decode a TC String to determine whether they have the necessary legal bases to process a user’s personal data for their purposes. The concise string data format enables a CMP to persist and retrieve a user’s preferences any time they’re needed as well as transfer that information to any vendors who need it.

For further details, please refer to the IAB Europe policies. 

Legal basis for processing personal data

Our Services enable our Clients to among other things tailor advertising you see on your internet browser or mobile device to your interests and preferences. As a result, the number of ads that are not relevant or of interest to you will be reduced. To achieve this goal, we need to process your personal data. Such processing operations including the use of cookies or other tracking technologies, are covered by your consent, which especially enables our Clients to use customized audience segments to improve and enhance their marketing activities and marketing reach.

Under Data Products, our Data Partners who provide User Data to us collect users’ consent to process their personal data and share it with us according to their respective privacy policies. The consent collected by our Data Partners complies with the applicable laws requirements and enables Zeotap and its Clients processing activities. Any processing of your personal data by Zeotap is subject to your rights of choice and control as explained below. In accordance with the IAB Europe policies, we may process TC Strings. As TCF Vendor, we have conducted and documented a legitimate interest assessment for the processing of TC String. This assessment has shown that data subjects’ interests and fundamental rights do not override the legitimate interests pursued. 

Under Software Products, our Clients are acting as data controllers and are responsible for ensuring that an appropriate legal basis is in place.

Please note that under Data Products, in case we combine our Client data with User Data, our Clients and us act as joint data controllers. With respect to the joint process, we and our Clients jointly determine the purposes and means of processing of User Data. In an agreement on joint controllership pursuant to Article 26 GDPR, we and our Clients have determined how the respective tasks and responsibilities in the processing of personal data are structured and who fulfils which data protection obligations. In particular, it was determined how an appropriate level of security and your rights as a data subject can be ensured, how the information duties under the applicable laws can be fulfilled jointly and how potential data protection incidents can be monitored. This also includes ensuring that reporting and notification obligations are fulfilled.