What Xandr is doing in response to COVID-19. Learn More.
xandr

Platform Privacy Policy

Política de privacidade da plataforma do RGPD/LGPD

Last modified: June 17, 2020 

Xandr, an AT&T company (“Xandr”), provides an advertising technology that allows websites, apps and other internet-connected properties to generate revenue by showing advertisements to their users, and allows marketers and other advertisers to show advertisements to individuals online who may be interested in their products or services. This policy explains how we collect, use, and disclose information through our digital advertising technology platform (the “Platform”). If you are interested in learning how we collect, use, and disclose information through other corporate activities, such as on our corporate website, Xandr.com, and learning how to exercise applicable privacy rights related to such information, please click here.

Our goal is to be transparent about our business by describing our technology and services in simple terms so that you can understand our practices. We know this is complicated, so if you have any questions about this information, please contact us here.  We also created an Online Advertising and Ad Tech Glossary if you want to learn more about our technology, our services and more generally about the advertising technology ecosystem.

Overview

Below we provide an overview of our practices and where you can find more information.

What information do we collect and use? The Platform is designed to collect and use primarily Platform Data and in some instances use it together with Other Information (both as defined below) as described in this document. Details.
How do we collect information? The Platform uses cookies, beacons, pixels, tags, mobile SDKs, and other non-cookie technologies to collect and store Platform Data about web browsers and devices across web sites and apps and over time. Details.
For what purposes do we use the collected information? Xandr uses the information collected on the Platform to provide, operate, manage, maintain, and enhance the Platform and allow our clients to use our Platform. This means facilitating: serving of ads, including interest-based advertising by our clients and partners; facilitating serving of ads based on precise geographic location information; reporting on ad delivery and conversions; providing frequency capping and recency measurement; using information for fraud detection and the prevention and detection of malicious behavior and maintaining and enhancing our services including through the use of information for machine learning, optimization and statistical analysis. Details.
What information do we share with third parties? Where permitted, we provide clients and their third-party providers access to their Platform Data that they collect, acquire, or use on the Platform, and typically they may remove it from the Platform for their own use. For a current list of third-party providers who may, subject to our clients’ permission, receive your data, see here. Xandr may also provide Platform Data and Other Information to partners and service providers for the purpose of operating, managing, maintaining, or enhancing our services, including for the safety and security of the Platform and the online industry, or as required by law. Xandr may share Platform Data with other AT&T affiliates for those companies’ business purposes. Xandr does not share the information collected on the Platform with other third parties, unless legally required. Details.
How is the information stored and how long is it kept? Platform Data and Other Information that we process is stored using generally accepted security standards. Platform Data is usually aggregated or deleted within 3-60 days but may be retained in the Platform for up to 18 months from the date of collection before aggregation or deletion. Details.
What are your choices and rights? If you are a resident of certain jurisdictions, you may have certain rights and protections under a particular jurisdiction’s law regarding the collection, processing, and use of information about you. This policy describes the rights that may be available to you, and how you can exercise them. Details.

Regardless of where you live, Xandr provides several options for you to choose how you want to interact with the Platform and respects user choices provided by certain apps and device-system software. Specifically, you may be able to: (i) opt out of having the Platform used to select ads for your browser based on your online web browsing behavior, (ii) opt out of the use of information about your usage of mobile apps for targeted advertising purposes, based on choices made available to you by those apps and your mobile device, and (iii) opt out of the collection of certain forms of location information, based on preferences available to you on your mobile device.  Details.

If you have questions about privacy on the Platform, you can send us a message here.

What are your California Privacy Rights? If you are a California resident as defined by the CCPA (as defined below), you may have the right to: (i) request access to your personal information and request additional details about our information practices, (ii) request deletion of your personal information, (iii) opt out of the “sale” of your personal information (as that term is defined by the CCPA), and (iv) to not be discriminated against for exercising any of your rights under the CCPA. Details.
What are your rights and protections in European Countries? If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “European Countries”), you have certain rights and protections under applicable law regarding the processing of your “personal data” as defined under applicable law. Some of the Platform Data that Xandr maintains in its Platform may constitute “personal data” under these laws. Details.
Where do we operate? Xandr is a global company headquartered in the United States with data centers located in the United States, Europe and Asia. If you access any of the Digital Properties  (as defined below) that use our technology, please be aware that your information may be transferred to, stored and processed by us and our affiliates in our facilities in the United States and other countries (including in Singapore, Japan, Australia and Brazil where our global affiliates have offices) and by those third parties with whom we may share your information. Details.
What happens if this privacy policy is changed? Check this page for changes. We may change this privacy policy at any time. If we make changes that, in our sole discretion, are material, those changes will not be applied to information collected prior to the date the changes went into effect.
Questions? If you have questions about privacy on the Platform, you can send us a message here.

 

Introduction to the Xandr Platform

Xandr provides a digital advertising technology Platform . Websites, mobile apps and publishers of other internet-connected digital media properties such as internet-connected TVs (each a “Digital Property” and collectively “Digital Properties”) use the Platform to sell ad space on those properties. Advertisers or companies on the advertiser’s behalf, use the Platform to purchase that ad space in the most efficient way possible. The Platform also allows Digital Properties and advertisers to do other things, like measure the effectiveness of their ads, to help prevent malware or other bad activity, and similar functions designed to make the buying and selling of ad space seamless, efficient, and effective.


Information Xandr Collects

When you (an internet user) visit a Digital Property that has integrated our Platform or that uses technology that integrates with our Platform, we collect certain information about your visit. This policy refers this information as “Platform Data”, and includes the following:

  • Information about your browser including: the type of browser you use, browser language, browser settings, and cookie information. This may include data about you related to bid requests an ad impressions, collected when we decide to show you an ad on a Digital Property and when we deliver an ad.
  • Information about your device including device operating system version, connection type, device make, device model, device Identifiers such as your IDFA or AAID, and the IP address from which the device accesses a client’s Digital Property.
  • Location information, including precise location information when location services have been enabled for an app on your device that has integrated our technology or that sends that information to our Platform.
  • Information about your activity on a Digital Property such as browsing history, viewing history, search history and information regarding an individual’s interaction with an internet website, app, or advertisement, including the time web pages or apps were visited or used, including in-game or online viewing activity (e.g., videos viewed, pages viewed).
  • Inferences or audience segmentation derived from Platform Data, such as individual profiles, preferences, characteristics, and behaviors.
  • Information about ads served, viewed or clicked on, including the type of ad, where the ad was served, whether you clicked on it and whether you visited the advertiser’s website or downloaded the advertiser’s app.
  • Information about your internet service including information about which internet service provider is used by you.

The information we collect about you does not reflect your name, email address, or Other Information that directly identifies you, and we take care to ensure that we do not collect any information that tells us who you are. However, the information listed above could be combined with Other Information to identify or reveal information about you, so it may qualify as personal information or personal data under applicable law.

As described in further detail below, we may collect the categories of personal information listed above from other sources, such as our affiliates.

Xandr’s Platform allows Digital Properties, advertisers, and others to buy and sell data to help make the ads that you see more relevant. Advertisers may share with us information about your interests or demographic information (your age or gender) that they have collected directly from you and from third parties, and they may use that information on our Platform to help make the ads served to you more relevant or for other purposes.


The Sources from which Xandr Collects Platform Data and Other Information, and the Process for that Collection

Cookies and other online tracking technology. When you first visit a Digital Property, we assign a random unique identifier (an “AppNexus ID”, or “Xandr ID”) to your browser or device, which allows the Platform to automatically recognize your browser or device the next time it visits another Digital Property that has integrated our technology.  This allows our clients and partners to sync their own unique identifiers against this ID so that they can use their own data on the Platform that they may have associated with you (collectively “Digital Identifiers”).

The Platform uses cookies, beacons, pixels, tags, mobile SDKs, and similar technologies to collect this information. For a detailed description of cookies and similar technologies set by the Platform, see the Xandr Digital Platform Cookie Policy.


Other Information
We collect other information, including without limitation personal information, from our affiliates and other companies as further described below (collectively “Other Information”).

Our affiliates. We collect information from other AT&T affiliates, such as information generated or derived by your use of AT&T companies’ services – such as technical and usage information.

Other companies. We collect information from other companies such as analytics providers, advertising and marketing firms, information suppliers, and other promotional and strategic partners.


How We Use the Information We Collect

We use, and allow our clients to use, the information we collect for the following purposes:

  • For our legitimate business interests to provide services to advertisers and owners of Digital Properties, including providing and operating our services which includes:
    • Compiling statistics about the advertising transactions occurring through our Platform and conducting research and development for our own internal business purposes, such as analyzing campaign forecasts and conducting machine learning to help our clients improve their sales of ad space and delivery of ads to you
    • Analyzing and reporting on campaign and ad performance, such as reporting to advertisers about when and how you have been exposed to ads or clicked on ads, and reporting to Digital Properties information about when and how ads were shown on their Digital Properties and whether they were clicked on
    • Investigating, protecting against and deterring malicious activity, fake traffic or fraudulent, unauthorized or illegal activity on the Platform and on the internet
    • Debugging errors in systems
  • Hands on help: The Platform enables Xandr’s clients to collect, buy, and sell data and to use Platform Data and Other Information to buy and sell online advertising. Sometimes, Xandr staff gives hands-on help to clients use the Platform for these purposes, for example by configuring advertising campaigns for clients to best meet their objectives.
  • Allowing our clients to use Platform Data for the following advertising-related purposes:
    • Interest-Based Advertising: Using Platform Data to infer what you may be interested in and to serve ads to you based on these inferred interests.  Our clients may use their Platform Data to create interest profiles about you.
    • Frequency Capping: Limiting the number of times you see an ad so you don’t see the same ad or type of ad too many times
    • Showing Ads in Sequence: Showing you ads in a particular order to provide a better user experience
    • Geo-Targeting: Customizing ads shown to you based on your current or prior location
    • Contextual Ads: Showing ads to you based on the content you are viewing
    • Ad Measurement: Understanding how users respond to ads (e.g., clicking on the ad)
    • Aggregated Statistics: Reporting aggregated statistics regarding, for example, the effectiveness of online advertising campaigns
    • Cross-Device Mapping: Enabling Cross-Device Mapping (grouping the devices that are owned by an individual or household) in order to serve or measure advertising on related devices on behalf of our clients.

 

Typically, companies using the Platform own the data that they provide to and get from the Platform. While we take care to obtain assurances from our clients and partners that their use of Platform Data will comply with applicable laws, when clients remove data from the Platform, their use of that data is governed by their own privacy policies and applicable laws, rules, or regulations.


How and Why We Share the Information We Collect

We shared Platform Data, in some instances together with Other Information, with third parties as follows:

  • Clients and Third-Party Providers: When you visit a Digital Property and that Digital Property wants to show you ads, and, in order to show you those ads, the Digital Property may allow certain third parties to access your device or receive and use the information noted above under “What Information do we collect and use.”
    • When our clients integrate our technology in order to show you ads and enable us to collect your data, other than for the reasons noted in this section below, such sharing of that data is determined by the Digital Property.
    • We share information with advertisers and third-party providers in accordance with the Digital Property’s instructions so that they can decide whether to bid on ad inventory or serve an advertisement and choose the best ad for you using their data and our and our partners’ technology.
    • This shared information may also be used to create demographic and interest profiles to help our clients choose the best ad for you
    • These advertisers and third-party providers may use the information we provide to improve their products and services for use by us and others across the broader online advertising ecosystem (e.g. your Device Identifier may be used to improve fraud detection services).
  • Service Providers (including data centers, hosting providers, anti-fraud, technology and security providers): We share with Service Providers (or enable their collection of) Platform Data so that they can perform functions and provide services to us including for purposes of protecting the safety and security of the online ecosystem, including to detect and prevent malicious activity or fake traffic. Our Service Providers are subject to obligations consistent with this Privacy Policy and appropriate confidentiality and security measures. More detail about this sharing is listed in the “Disclosures of Information to Service Providers” section below.
  • Legal Rights and Compliance with Law: We may also disclose Platform Data in the event that we reasonably suspect malicious activity or fake traffic or when we reasonably believe it is required by law, subpoena or other legal process, including to meet security or law enforcement requirements.
  • Affiliates: We share Platform Data with other companies in the Xandr and AT&T Inc. group of companies, including WarnerMedia, Warner Bros. and Xandr’s parent company AT&T for use in accordance with this Privacy Policy. Xandr receives data from our affiliates for use in accordance with this Privacy Policy.
  • Business Transfers: We may transfer Platform Data and Other Information that we collect to a successor entity in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change.
  • Aggregated Data: We may also share aggregated data derived from the Platform, including, for example, statistics about Platform activity.


Your Choices and Rights

If you reside or are located in certain jurisdictions, you may have rights and protections regarding the collection, processing, sharing, and use of your data under a particular jurisdiction’s law. This may mean that you may have the right to:

  • Request access and obtain a copy of your data;
  • To request rectification of your data;
  • In certain circumstances, and subject to some specific legal reasons where we may need to retain data, to request that your data be deleted or erased;
  • To opt out of the sale of your data to third parties;
  • If applicable, to enforce your right to data portability;
  • To object to the processing of your data in certain circumstances;
  • Not be discriminated against for exercising your rights with respect to your data.

Find more details below.

We do not sell personal information pertaining to any individual that Xandr knows is under 16 years of age.


Opt Out of Interest-Based Advertising

Web Browsers

You can visit privacycenter.xandr.com to opt out of having the Platform used to select ads for your browser based on your online web browsing behavior. When you opt out, an opt out cookie (from adnxs.com) will be stored in your web browser. The Platform will know the choice you have made when it sees your opt out cookie, and will apply your choice to all companies using the Platform. If you block or delete the opt out cookie, you will not be opted out and will need to allow cookies from Xandr and renew your opt out choice.

To review your opt in status or learn more about interest-based advertising, please visit the Network Advertising Initiative opt out page, the DAA’s WebChoice tool or the DAAC’s WebChoices tool.

Important things to note about the web browser opt out:

  • Blocked cookies: The opt out cookie may not work if your browser is configured to block third-party cookies.
  • Deleting or protecting opt outs: If you delete your cookies, you will need to opt out again. There are browser plugins to help you preserve your opt out cookies. For more information, please visit http://www.aboutads.info/PMC.
  • Only this browser: The opt out only applies to the browser profile in which you set it. For example, if you set the opt out while using Firefox, but then use Chrome, the opt out will not be active in Chrome. To opt out in Chrome, you will need to repeat the opt out process. This is because the cookies cannot be read between different browsers or browser profiles.
  • The opt out does not block or delete cookies: It also does not prevent the use of cookies or other technologies for purposes other than selecting ads based on your interests as inferred by your online behavior. If you opt out, data may still be collected about your web browsing activities and you will still see advertising. Ads may be selected, for example, based on the content of the web page in which they are shown. If you wish to block or delete cookies altogether, you can use web browser settings to do so.

Mobile Apps

Mobile device system software such as Apple iOS or Google Play Services provide mechanisms that allow users to opt out of the use of information about their usage of mobile apps to deliver targeted ads to their mobile device. For more information, or to opt out using these mechanisms, consult your device settings (“Opt out of Personalized Ads” on Android devices and “Limit Ad Tracking” on iOS devices). When Xandr’s technology encounters “Limit Ad Tracking” signals they are respected. Devices vary in where they include the setting to adjust, you can use the Network Advertising Initiative’s mobile optout guide here.

Location Data

Most mobile devices offer you the ability to stop the collection of location information at any time by changing the preferences on your device.  You may also be able to stop the collection of location information by particular apps by adjusting the settings for individual apps or following the standard uninstall process to remove specific mobile apps from your device.  Note when location services have not been enabled in any of your apps, we will still infer data about your location based on your IP address.

Televisions

Your internet connected device (e.g. a smart TV or a set- top box) may give you the ability to opt-out of the use of information for advertising purposes.  To determine if your Internet connected device has these options, please visit your device’s settings menu. Xandr reads and applies industry opt out signals for connected televisions.

AT&T Customers

If you are an AT&T subscriber, you have the choice to opt out of the use of information about your use of AT&T services for advertising purposes. In order to exercise these choices, visit AT&T’s privacy page.

Access Rights

If you reside in certain jurisdictions, you may have the right to access the data we hold about your devices. If you are interested in exercising any of these rights, please click here. Note that because we do not collect information that directly identifies an individual (and prohibit clients from storing this information) on the Platform, it is generally not feasible for us to verify individuals’ identities to provide information that is tied to their identities, so we facilitate access rights on a browser or device level basis.

Deletion Rights

If you reside in certain jurisdictions, you may have the right to delete the data we hold about your devices. If you are interested in exercising any of these rights, please click here. Note that you can delete your cookies at any time by using your browser settings. You can also reset the advertising identifier in your mobile device at any time by using your platform setting referenced in Mobile Apps above.

Industry Self-Regulation

Xandr supports industry self-regulation, and endorses best practices and self-regulatory requirements that apply to the Platform. Xandr/AppNexus is a member in good standing of the Network Advertising Initiative (“NAI”) and adheres to the NAI Code of Conduct. Xandr/AppNexus also follows the industry self-regulatory guidelines of the Digital Advertising Alliance (“DAA”) and the Digital Advertising Alliance of Canada (“DAAC”). The following links are lists of the Xandr-provided interest segments that are available on the Platform for use by Xandr’s clients in creating tailored advertising based on health related information or interests and political information or interests.

Additionally, the following industry sites provide useful information about industry self-regulation of interest-based advertising:


Our Global Operations

Xandr is a global company headquartered in the United States with data centers located in the United States, Europe and Asia. If you access any of the Digital Properties that use our technology, please be aware that your information may be transferred to, stored and processed by us and our affiliates in our facilities in the United States and other countries (including in Singapore, Japan, Australia and Brazil where our global affiliates have offices) and by those third parties with whom we may share your information.

These countries (including the United States) may not provide an adequate level of data protection for your information (as determined by the European Commission for personal data in its jurisdiction) or have data protection or other laws as comprehensive as those in your country. Please see “Information for Residents of European Countries” below for information on how we protect information that is transferred out of the European Economic Area, United Kingdom, and Switzerland.


California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act or “CCPA” (California Civil Code Section 1798.100 et seq.) applies to the collection, use, and disclosure of “personal information” collected from California residents (as those terms are defined by the CCPA). CCPA Personal Information (CCPA PI) is defined by California law as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with California consumers or households. The CCPA requires us to disclose to California consumers the categories of personal information (as defined in the CCPA) we collect, our business and commercial purposes for collecting, using, or selling such personal information, the categories of sources from which we collect personal information, the categories of personal information we have disclosed or sold for a business or commercial purpose in the preceding 12 months, and the categories third parties with whom we share personal information. We have provided these disclosures below.

If you are a California consumer as defined by the CCPA, you may have the right to: (i) request access to your personal information and request additional details about our information practices, (ii) request deletion of your personal information, (iii) opt out of the “sale” of your personal information (as that term is defined by the CCPA), and (iv) to not be discriminated against for exercising any of your rights under the CCPA.  Your options regarding the personal information we collect or receive about you are described below.

Please note that if you wish to exercise any of your rights with any of Xandr’s clients, you must make your request directly to those Xandr clients, based on information and procedures that they supply.  Xandr clients own the Platform Data that they maintain in the Platform.  Xandr does not control how those clients use Platform Data.

Information We Collected From Consumers
The CCPA identifies a number of categories of CCPA PI. In the year before the date this policy was issued, we collected these categories of CCPA PI:

  • Information about your browser including: the type of browser you use, browser language, browser settings, and cookie information. This may include data about you related to bid requests an ad impressions, collected when we decide to show you an ad on a Digital Property and when we deliver an ad.
  • Information about your device including device operating system version, connection type, device make, device model, device Identifiers such as your IDFA or AAID, and the IP address from which the device accesses a client’s Digital Property.
  • Location information, including precise location information when location services have been enabled for an app on your device that has integrated our technology or that sends that information to our Platform.
  • Information about your activity on a Digital Property such as browsing history, viewing history, search history and information regarding an individual’s interaction with an internet website, app, or advertisement, including the time web pages or apps were visited or used, including in-game or online viewing activity (e.g., videos viewed, pages viewed).
  • Inferences or audience segmentation drawn from CCPA PI, such as individual profiles, preferences, characteristics, and behaviors.
  • Information about ads served, viewed or clicked on, including the type of ad, where the ad was served, whether you clicked on it and whether you visited the advertiser’s website or downloaded the advertiser’s app.
  • Information about your internet service including information about which internet service provider is used by you.

We collected the above categories of CCPA PI for the following purposes:

  • Performing services on behalf of the business, such as customer service, processing or fulfilling orders, and processing payments.
  • Auditing customer transactions.
  • Fraud and crime prevention.
  • Debugging errors in systems.
  • Marketing and advertising.
  • Internal research, analytics and development – e.g., user-preference analytics.
  • Developing, maintaining, provisioning or upgrading networks, services or devices.

We collected the above categories of CCPA PI from the following sources:

  • Directly from you – such as contact and billing info and customer service interactions.
  • Generated by your use of our services – such as technical and usage information.
  • Social media sites and other online platforms.
  • Other companies – such as vendors, marketing firms and other AT&T companies.
  • Publicly available sources – such as public records.

Information We Shared About Consumers

In the year before the date this policy was issued, we shared these categories of CCPA PI with entities that provide services for us:

  • Unique and online identifiers – IP address, device IDs, or other similar identifiers.
  • Internet, gaming or other electronic network activity information – such as browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement.
  • Location Information (see above).
  • In Game or Online Viewing Activities (e.g., videos viewed, pages viewed).
  • Inferences drawn from CCPA PI, such as individual profiles, preferences, characteristics, behaviors.

We may have shared each of the above categories of CCPA PI with the following categories of third parties who perform services on our behalf:

  • Product and services delivery companies.
  • Marketing services companies.
  • Cloud storage companies.
  • Billing and payment processing companies.
  • Credit reporting agencies.
  • Fraud prevention entities.
  • Analytics companies.

The CCPA defines “sale” very broadly and includes the sharing of CCPA PI for anything of value. According to this broad definition, in the year before the date this policy was issued, a ‘sale’ of the following categories of CCPA PI may have occurred:

  • Unique and online identifiers – IP address, device IDs associated with television viewing, or other similar identifiers.
  • Internet, gaming or other electronic network activity information – such as browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement.
  • Location Information (see above).
  • Inferences drawn from CCPA PI, such as individual profiles, preferences, characteristics, behaviors.

We may have sold each of the above categories of CCPA PI to the following categories of third parties:

  • Analytics and measurement providers.
  • Companies involved in marketing and advertising.
  • Other AT&T companies.

Your Right To Request Disclosure Of Information We Collect And Share About You

We are committed to ensuring that you know what information we collect. You can ask us for the following information:

  • The categories and specific pieces of your CCPA PI that we’ve collected.
  • The categories of sources from which your CCPA PI was collected.
  • The purposes for collecting or selling your CCPA PI.
  • The categories of third parties with whom we shared your CCPA PI.

We are also committed to ensuring that you know what information we share about you. You can submit a request to us for the following additional information:

  • The categories of CCPA PI we’ve sold about you, the categories of third parties to whom we’ve sold that CCPA PI, and the category or categories of CCPA PI sold to each third party.
  • The categories of CCPA PI that we’ve shared with service providers who provide services for us; the categories of third parties to whom we’ve disclosed that CCPA PI; and the category or categories of CCPA PI disclosed to each third party.

To exercise your right to request the disclosure of your CCPA PI that we collect or share, either click here or contact us at 866-385-3193. These requests for disclosure are reviewed and handled by AT&T and are generally free.

Your Right To Request The Deletion Of CCPA PI

Upon your request, we will delete the CCPA PI we have collected about you, except for situations when that information is necessary for us to: provide you with a good or service that you requested; maintain the functionality or security of our systems; comply with or exercise rights provided by the law; or use the information internally in ways that are compatible with the context in which you provided the information to us, or that are reasonably aligned with your expectations based on your relationship with us.

To exercise your right to request the deletion of your CCPA PI, either click here or contact us at 866-385-3193. Requests for deletion of your CCPA PI are reviewed and handled by AT&T and are generally free.

Your Right to Ask Us Not to Sell Your CCPA PI
You can always tell us not to sell your CCPA PI by clicking here or contact us at 866-385-3193. Requests to not sell your CCPA PI are reviewed and handled by AT&T.

Once we receive your request, we will not sell your CCPA PI unless you later allow us to do so. We may ask for your permission to resume sale of your CCPA PI at a later date, but we will wait at least 12 months before doing so.

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. Your agent will need a valid power of attorney or written permission signed by you. If the agent relies on written permission, we’ll need to verify the agent’s identity. We may also contact you directly to confirm the permission. Your authorized agent can submit your requests by calling us at 866-385-3193.

We Don’t Mind If You Exercise Your Data Rights

We are committed to providing you control over your CCPA PI. If you exercise any of these rights explained in this section of the Privacy Policy, we will not disadvantage you. You will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services.

Consumers Under 16 Years Old

As of the effective date of this policy, we do not have actual knowledge that we sell CCPA PI of consumers under 16 years of age. If we collect CCPA PI that we know is from a child under 16 years old in the future, we will not sell that information unless we receive affirmative permission to do so. If a child is between 13 and 16 years of age, the child may provide that permission.

Any customer who wishes to request further information about our compliance with these requirements, or who has questions or concerns about our privacy practices and policies, please use the Contact Us information provided below.


Information for Residents of European Countries

If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “European Countries”), you have certain rights and protections under applicable law regarding the processing of your “personal data” as defined under applicable law. Some of the Platform Data that Xandr maintains in its Platform may constitute “personal data” under these laws.

 

Role of Xandr as a Controller or Processor

 

If you are located in one of the European Countries, Xandr may act a “controller” as defined under applicable law when processing your personal data. Xandr may also act as a “processor” as defined under applicable law to the extent that it processes your personal data on behalf of and at the instruction of another party, for example a Xandr client.

 

Legal Basis for Processing

Xandr’s legal basis for processing your personal data depends upon the specific context in which we collect or use it. We normally rely on our legitimate interests to collect and use personal data, except where our interests are overridden by your data-protection interests or your fundamental rights and freedoms. Our legitimate interests are described in greater detail in the “How We Use the Information We Collect” section of this policy. These legitimate interests include the operation of our Platform and business and the provision of our online advertising technology services to our clients as required by our agreements with them. In some cases, we may rely on your consent which is obtained for us by the operator of the Digital Properties that use our technology or use technology that interacts with our Platform. If we rely on consent to process your data, we will obtain such consent in compliance with applicable laws. Additionally, we may have a legal obligation to process personal data.

Your Rights

If you are located in one of the European Countries, you may be entitled to exercise certain data-subject rights available under applicable laws. These rights may include the right to request access to personal data we hold about you. You may also have the right to object to, or request that we restrict, processing of your personal data. You may also have the right to ask that your personal data be corrected, erased, or transferred to another party. If you would like to exercise any of these rights, you may do so as explained in the Your Choices and Rights section above.

Data Transfers and Privacy Shield

When Xandr transfers your personal data to group companies or third-party service providers outside of the European Countries, we ensure that appropriate protections are in place under European data protection legislation (which includes either Model Clauses or Privacy Shield compliance).  For example, in order to ensure that your personal data is adequately protected when transferred outside of the European Countries, Xandr has entered into inter-company “model clause” agreements and other adequacy arrangements with other various entities located outside the European Countries with whom we share your information. A copy of such agreements is available on request.

Additionally, if we transfer personal data from the European Union to the United States or Switzerland to the United States, we comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union and Switzerland to the United States, respectively. Xandr (under AppNexus) has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

For any questions or complaints regarding our compliance with either the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework, please contact us here. If Xandr does not resolve your complaint, you may submit your complaint free of charge to ICDR/AAA, Xandr’s designated independent dispute resolution provider based in the United States. Under certain conditions specified by the principles of the EU-U.S. and the Swiss-US Privacy Shield Frameworks, respectively, you may also be able to invoke binding arbitration to resolve your complaint. Xandr is subject to the investigatory and enforcement powers of the United States Federal Trade Commission (“FTC”). If Xandr shares the personal data of an individual located in the EU or Switzerland with a third-party service provider that processes the data solely on Xandr’s behalf, then Xandr will be liable for that third-party’s processing of that data in violation of the Principles, unless Xandr can prove that it is not responsible for the event giving rise to the damage.

IAB Europe Transparency and Consent Framework

If you are located in one of the European Countries and visiting a Digital Property, we are registered as a vendor with, support and encourage our clients to use the IAB Europe Transparency and Consent Framework (the “Industry Framework”) to provide you with dynamic transparency into and choice about the various third parties our clients use to serve you ads, including ourselves. When you visit a Digital Property, the Industry Framework is designed to allow a Digital Property the means to choose which vendors they wish to allow to access your device and process your personal data and provide dynamic transparency and choice to you about each of these vendors (either an opportunity for you to consent to the vendor or opt out of data processing by the vendor depending on that vendor’s legal basis and processing activities).

 

Questions or Complaints

 

If you are in one of the European Countries and have a question or concern about how we process personal data you can contact our Data Protection Officer here. If we are not able to resolve your issue, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see here.

Information Our Clients and Vendors Collect

Our clients, our Service Providers (as defined above), and our clients’ Service Providers who use our technology, may use their own tags, pixels, cookies, or other similar technology (or those of their other affiliates) within their advertisements and on certain Digital Properties. Except as provided elsewhere in this Privacy Policy, we are not responsible for our clients, vendors and/or our clients’ vendors use of such tracking technologies or for their privacy practices.


Retention

We never store any information longer than we need it. Platform Data is usually aggregated or deleted within 3-60 days but may be retained in the Platform for up to 18 months for specific clients and for security and the detection and prevention of fraud and invalid traffic from the date of collection before aggregation or deletion.  When we no longer need the information we collect, it is deleted or aggregated. Aggregated information is used for reporting and analysis and may be stored in the Platform for up to 2 additional years.

When partners receive information through us or clients remove their information from the Platform, their storage and retention of the removed information is governed by their own privacy policies and applicable laws, rules, or regulations.

Changes to this Privacy Policy

Check this page for changes. We may change this Privacy Policy at any time. If we make changes that, in our sole discretion, are material, those changes will not be applied to information collected prior to the date the changes went into effect.

Contact Us

If you have questions about privacy on the Xandr Platform, you can send us a message here.

If you are located in the European Countries, you can contact our Data Protection Officer here.

You can also contact us by post using the details provided below:

Xandr Inc.
Attn: Privacy Office
28 West 23rd Street, Fl 4
New York, NY 10010
USA