Services Privacy Policy

Information We Collect, Process, or Store.

In the course of providing services our clients may process some personal information, which may come from our clients’ websites and may be processed through our technology.

Please note, that we may work with third party data platforms or applications that may be directly integrated into our technology or used separately, supplementing our technology by us or our clients. It helps us to deliver targeted advertisements using our advertising technology more efficiently or it allows our clients to use multiple interfaces and manage data more efficiently.

Information that we process will be categorized as follows:

• SSP Data
• DSP Data
• Ad Exchange Data
• Cookie Sync Data

Registration Data.

To start using our services, you must register your account. Please note that our services are primarily designed for businesses (i.e., legal entities), so you will only be able to register with a corporate email address. However, your corporate email typically contains your personal data, such as your first or last name.

To register an account we will ask you to provide the following information: First name, Last name, Email (only corporate), Country, Password, Name of the Company, Phone number, Skype, Captcha. We need this information to perform a contact with you (i.e. register your account). Please note that optional fields such as Skype, Phone Number are processed based on your consent and may be left blank. We will typically store this data until you terminate your relationship with SmartyAds or send a data subject request asking for rectification or deletion.

Please note that without this information we will not be able to register your account and provide you with further assistance with its maintenance.

Customer Support Data.

When you request assistance from our customer support team, we may collect the following information related to such a request: Email, Subject, Message. This information is processed based on our legitimate interest to address you properly with your issue. Information in the Message section is provided by you voluntarily and will be processed based on your consent. We will typically store this data for one year.

Please note that without this information, we will be unable to effectively address your concern, respond to your request, communicate with you, or properly identify you, as applicable, based on the type of personal data provided.

Billing Data.

In order to carry out digital media purchases and release payments to our supply partners, we may need to collect certain billing information, which could include your personal data. Billing information that we process include:

• if via PayPal: PayPal email, W-9 Form (for US residents), W-8BEN, W-8BEN-E Form (fon non-US residents), confirmation on correctness of the information;
• if via Payoneer: Payoneer email, W-9 Form (for US residents), W-8BEN, W-8BEN-E Form (fon non-US residents), confirmation on correctness of the information;
• if Wire Transfer: personal account (first name, last name, email, country, state, city, beneficiary address, zip code, IBAN or Account number, Bank Name, Bank Address, Swift (BIC) Code, W-9 form if you are US resident, W-8BEN, W-8BEN-E, confirmation of information correctness), business account (company name, email, country, state, city, beneficiary address, zip code, IBAN or Account number, Bank Name, Bank Address, Swift (BIC) Code, W-9 form if you are US resident, W-8BEN, W-8BEN-E, confirmation of information correctness)
• if via ACH (USA Payment): personal account (first name, last name, email, country, state, city, beneficiary address, zip code, IBAN or Account number, Bank Name, Bank Address, Bank code format, Swift, W-9 form if you are US resident, W-8BEN, W-8BEN-E, confirmation of information correctness), business account (company name, email, country, state, city, beneficiary address, zip code, IBAN or Account number, Bank Name, Bank Address, Bank code format, Swift, W-9 form if you are US resident, W-8BEN, W-8BEN-E, confirmation of information correctness.)

We will typically store data related to financial transactions for 3 years. Billing data is processed to perform the contract or obey the legal obligations imposed on us. Please note that without this information we will not be able to withdraw money from your account.

Impression Data.

In the course of our SSP operation we may either collect or transmit certain personal data. This data typically include: device id (IFA, GAID, IDFA), IP, country, region, city, connectiontype, zip, lat/lon, carrier, UA, devicetype, os, osv, devicemake, devicemodel; user ID (in the course of cookie sync operation, see Section 4 below).

Moreover, we may also store data that under certain jurisdiction may be treated as personal in our databases. Such data as: devicetype, carrier, country, region, city, device model, browser, connectiontype, language, os. This data will be processed based on the consent provided by the end user at the time of data collection. We will store this data for 5 years.

Please note that without this information we will not be able to operate our technology.

Registration Data.

To start using our services, you must register your account. Please note that our services are primarily designed for businesses (i.e., legal entities), so you will only be able to register with a corporate email address. However, your corporate email typically contains your personal data, such as your first or last name.

To register an account we will ask you to provide the following information: First name, Last name, Email (only corporate), Country, Password, Name of the Company, Phone number, Skype, Captcha. We need this information to perform a contact with you (i.e. register your account). Please note that optional fields such as Skype, Phone Number are processed based on your consent and may be left blank. Please also note that access to the platform will not be granted immediately, our dedicated Manager will first reach out to confirm your access needs before enabling it. This process is essential to mitigate fraudulent activity and safeguard services security.

We will typically store this data until you terminate your relationship with SmartyAds or send a data subject request asking for rectification or deletion.

Please note that without this information we will not be able to register your account and provide you with further assistance with its maintenance.

Customer Support Data.

When you request assistance from our customer support team, we may collect the following information related to such a request: User ID, Email and content of the request. This information is processed based on our legitimate interest to address you properly with your issue. Information in the Message section is provided by you voluntarily and will be processed based on your consent. We will typically store this data for one year.

Please note that without this information, we will be unable to effectively address your concern, respond to your request, communicate with you, or properly identify you, as applicable, based on the type of personal data provided.

Billing Data.

Prior to fully enjoying our advertising services we will evaluate whether we may satisfy your requirements and provide you with the advertising services.

As part of our advertising review process, we request that you provide information regarding the content you intend to advertise, the target geographical regions, and the required ad formats. This information will be used to assess the availability of suitable traffic for the specified regions and formats. Additionally, it may be necessary to submit a formal request for approval from internal teams to ensure compliance with applicable advertising guidelines and to determine the feasibility of running the proposed advertisements.

To request a review process and further place a deposit you will be required to contact our Sales Representative. To do so you will need to provide your email address, account ID, company name and targeting requirements. These data may contain personal information, despite the fact that we work exclusively with legal entities and not end users.

Further, you may use either Stripe, Wire Transfer, or PayPal to make a deposit.

• If via Stripe: card number, card expiration date, CVV.
• If via Wire Transfer: date and time of the payment, sum, and account ID.
• If via PayPal: PayPal email or phone number.

We will typically store data related to financial transactions for 3 years. Other Billing Data will be stored until you terminate your relationship with SmartyAds or send a data subject request asking for deletion.

Please note that without billing data we will not be able to provide you with advertising services.

Impression Data.

In the course of our DSP operation we may either collect or transmit certain personal data. This data typically include: device id (IFA, GAID, IDFA), IP, country, region, city, connectiontype, zip, lat/lon, carrier, UA, devicetype, os, osv, devicemake, devicemodel; user ID (in the course of cookie sync operation, see Section 4 below).

Moreover, we may also store data that under certain jurisdiction may be treated as personal in our databases. Such data as: devicetype, carrier, country, region, city, device model, browser, connectiontype, language, os. This data will be processed based on the consent provided by the end user at the time of data collection. We will store this data for 5 years.

Please note that without this information we will not be able to operate our technology.

Access Data.

Our AdExchange platform does not offer user registration. Access to the dashboard is granted exclusively by us, and no direct user registration is required. The only information we collect for this purpose is the email address, company name and the role of the company (ssp, dsp or both). Please also note that we will use your email address to send you various statistical reports related to the provided services.

Access data will be processed based on the performance of the contract. We will typically retain this data for up to 5 years or until it is no longer necessary for the purposes for which it was collected.

Impression Data.

In the course of our AdExchange operation we may either collect or transmit certain personal data. This data typically include: device id (IFA, GAID, IDFA), IP, country, region, city, connectiontype, zip, lat/lon, carrier, UA, devicetype, os, osv, devicemake, devicemodel; user ID (in the course of cookie sync operation, see Section 4 below).

Moreover, we may also store data that under certain jurisdiction may be treated as personal in our databases. Such data as: devicetype, carrier, country, region, city, device model, browser, connectiontype, language, os. This data will be processed based on the consent provided by the end user at the time of data collection. We will store this data for 5 years.

Please note that without this information we will not be able to operate our technology.

WE STRONGLY ADVISE YOU TO REVIEW THE PRIVACY POLICY AND TERMS OF USE FOR ANY SITE OR APPLICATION YOU VISIT OR INSTALL TO LEARN ABOUT WHAT INFORMATION THOSE SITES COLLECT FROM YOU, AND HOW THEY USE AND SHARE SUCH INFORMATION.

Cookies are a technology that is based on small-size data files containing a string of alphanumeric characters that usually include a unique identifier and are placed on a visitor’s device or computer. Cookies are usually stored at the user's web browser permanently (persistent cookies) or temporarily.

Cookie Matching, also known as Cookie Syncing, is a process that allows different advertising technologies to align user identifiers stored in their cookies across various domains. Since each platform (like SSPs, DSPs, and AdExchanges) can only access cookies set on its own domain, syncing ensures these identifiers can be matched, enabling better ad targeting. This process involves each partner storing a unique user ID, which is then linked with other platforms to create a more cohesive user profile. Importantly, this process is only possible with your clear and explicit consent. Below, we outline the specific cookies we set and their purpose to ensure transparency in our data practices.

Types of Cookies Used and Data Collected:

We process the collected cookie sync data based on your consent in accordance with data protection laws before processing personal data.

Your Rights and Applicability of the EU Laws

Our Data Protection Officer can be reached via email: dpo@smartyads.com or via CMP that is always available in the bottom left corner (we have provided this information in Section I as well)

Data Subject Rights of The Residents of The European Economic Area

If you are a resident of the EEA, you have certain data protection rights. SmartyAds endeavours to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal information, thus to enforce all rights provided to you under the GDPR.

The GDPR gives certain rights to individuals in relation to their personal data. Accordingly, SmartyAds are happy to offer transparency and access controls to help users take advantage of those rights.

You (as a ‘data subject’) may send requests to us regarding your personal data via email to the following address: dpo@smartyads.com or via our CMP solution.

At any time, you have the following rights:

END OF SUBSECTION FOR EEA USERS ONLY.

After Brexit, the UK is no longer regulated domestically by the EU's General Data Protection Regulation (GDPR), which governs processing of personal data from individuals inside the EU. Instead, the UK now has its own version known as the UK-GDPR (United Kingdom General Data Protection Regulation). The new UK-GDPR took effect on January 31, 2020.

Under the UK-GDPR, individuals can exercise: the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to data portability; the right to object to processing; the rights in relation to automated decision making and profiling

If you would like to exercise any of these rights (as a resident of the UK), please contact us at dpo@smartyads.com or use our CMP solution that is always available in the bottom left corner.

SmartyAds strives to maintain compliance with the principles and requirements of data processing under the Lei Geral de Proteção de Dados Pessoais (LGPD), including, but not limited to, age-gating requirements.

We hereby inform You about the following rights You have under the LGPD:

• Confirmation: confirmation of the existence of processing;
• Access: access to the data;
• Rectification: correction of incomplete, inaccurate or outdated data; anonymization, blocking or elimination of unnecessary or excessive data or of data processed in noncompliance with the provisions of LGPD;
• Data portability: portability of the data to other service providers or suppliers of product, at the express request;
• Anonymization: anonymization, blocking or elimination of the personal data processed with the consent of the data subjects, except in the events set forth in article 16 of LGPD;
• Deletion: You have the right to have their personal data deleted if the processing of that data was based on consent;
• Information: You have the right to be informed about sub-processors and other third parties that access or process their personal data. You also have the right to be informed about Your consent choices and the consequences of refusing consent;
• Revocation: revocation of the consent, pursuant to the provisions of paragraph 5 of article 8 of LGPD;
• Bring complaint: lodging a complaint with the Data Protection Authority;
• Opposing the processing of personal data where there is non-compliance with the provisions of LGPD;
• Request review: You have the right to request the review of decisions made solely on the basis of automated processing of personal data which affect Your interests. This includes decisions used to define Your personal, professional, consumer and credit profile, or the aspects of Your personality.

If You would like to exercise any of these rights, please contact us via: dpo@smartyads.com or use our CMP solution that is always available in the bottom left corner.

SmartyAds endeavors to uphold conformity with the principles and stipulations of data processing as per the Personal Information Protection Law (PIPL). These principles encompass accuracy, accountability, security, purpose limitation, collection limitation, openness, transparency, lawfulness, and necessity, among others.

The following rights you have under the PIPL:

• You have the right to know, decide, refuse, and limit the handling of their personal information by others unless laws or regulations stipulate otherwise;
• You have the right to access and copy Your personal information in a timely manner, except when the laws and regulations require confidentiality;
• You have the right to correct or complete inaccurate personal information in a timely manner;
• You have the right to request Us to explain Our personal information handling rules;
• You have the right to deletion of Your personal information if (i) the agreed retention period has expired, or the handling purpose has been achieved; (ii) We as a personal information handler cease the provision of Our services; (iii) You rescind consent where the processing of personal information was based on Your consent; (iv) the information is handled in violation of laws, regulations or agreements;
• You have the right to request Us to transfer Your personal information to another personal information handler.

If You would like to exercise any of these rights, please contact us via: dpo@smartyads.com or use our CMP solution that is always available in the bottom left corner.

We share user information that we collect as follows:

We share information with our clients. It is done to help them identify, buy advertising, and target particular publishers. Clients may use this information in conjunction with other information they have independently collected to provide you targeted advertising materials. They also evaluate and analyze particular advertisement campaigns, inventory, etc.

Compliance with laws and regulations. We may share user information with law enforcement, regulatory authorities, courts with competent jurisdictions, emergency services or other necessary third parties for legal, protection, security, and safety purposes, including but not limited to the purpose of compliance with laws or regulatory requirements and to responses to lawful requests including requests of governmental entities, enforcement of our own policies and agreements, protection of our clients, agents, employees, directors, officers and alike.

Other service providers. SSP, DSP, and AdExchange services are based on specific platforms that actively communicate with other platforms, including but not limited to other SSP, DSP, and AdExchange platforms. Additionally, we use services of various third parties in order to analyze data, prevent fraud, host data, maintain, and support our client’s platforms, and for such other and further related services that are necessary to provide our services.

Data storage facilities. We will use third-party solutions that provide us with data storage facilities that are physically located in the United States like ClickHouse ( Privacy Policy available at https://clickhouse.com/legal/privacy-policy) and MySQL ( Privacy Policy available at https://www.oracle.com/legal/privacy/).

Please be aware that we and the mentioned recipients are located in regions that might not offer the same level of data protection as your home country. We will strive to safeguard your personal data during processing, storage, or transfer.

Standard Contractual Clauses:

• If we are governed by the General Data Protection Regulation (GDPR) and transfer personal data to a country with different data protection standards than your own, we will implement additional safeguards, such as Standard Contractual Clauses (SCC). These clauses are considered suitable data protection measures under the GDPR and aim to provide a comparable level of data protection by data recipients. This involves, for instance, robust encryption before transmission, stringent encryption key requirements, and encryption of data-at-rest.

Transfer Impact Assessment:

• Beyond the SCC, we conduct regular assessments of the recipient country’s laws and practices. This ensures that the security measures and protections implemented by that country and the data recipients are verified.

Security Measures (Technical and Organizational Measures):

• We may use various measures such as data pseudonymization, encryption, anti-virus software, and strict access/transfer controls. This is not an exhaustive list but provides an overview of some of the technical and organizational measures we might employ.

Notice on OBA and opt-outs

Please be aware that although we believe that targeted advertisement is beneficial for all parties involved, we do not circumvent any devices, and there are many ways and technologies to stop receiving targeted advertising that our clients may apply using our technology. Note that different platforms and devices use different identifiers and different technologies, and also that each browser and each device has its own applicable settings. Please be advised that should you delete your cookies the information of your withdrawal from a targeted advertisement may also be deleted. Same may be applicable to cookie-blocks. Please note that you will continue to receive advertising after you opt-out, but it may not be tailored to your interests. Please also note that our opt-out mechanism is browser or device specific. Therefore, if you use multiple browsers / devices you will need to perform the opt-out operation for each browser or device. Certain devices and device configurations may prevent our opt-out from operating correctly. Persons located in the European Economic Area have the right to object to our processing of their personal data and/or revoke their consent as described below. We respond to and honor “do not track” (a/k/a DNT) signals transmitted by web browsers as required by applicable law.

In-ad opt-out.

You may opt-out of OBA advertisements within a mobile website by clicking on the enhanced notice included within that advertisement, and then selecting “opt-out” within the page to which you are redirected through the following link when advertisement materials and/or inventory are shown from SmartyAds. To "Opt-out" click this link

In-app opt-out.

If your consent to the targeted advertisement was granted through the application, please withdraw your consent directly from that application. In addition, your device setting likely allows you to generally withdraw or block personalized advertising: for instance, For Apple Devices: Go to Settings, Select Privacy, Select Advertising, and enable the “Limit Ad Tracking” setting. For Android Devices: Open the Google Settings App, Select Ads, and enable the “Opt out of interest based advertising” setting. Note: The actual opt-out instructions for each device may differ slightly depending on the operating system and updates. Also, after choosing to opt-out via any of the mechanisms described, if you use a different device or a different browser, or if you delete browser cookies, you may need to repeat the opt-out steps for that particular device or browser. Please be advised that this Provision is not intended to serve as your user manual for your device, and you should always contact the manufacturer to obtain all relevant information on how to withdraw your consent.

Our services are not intended for children (those under the age of 18 or older if the country of your residence determines higher age restrictions). We do not knowingly collect or use personal data from children.

If you become aware that your child has provided us with personal information without your consent, please contact us at dpo@smartyads.com or via our CMP solution.

If we discover that we have gathered the personal information of a child, we will promptly take appropriate measures to remove such personal data.