Data Subject Rights Policy

 

Effective Date: May 25, 2018

Revision History: Original publication: May 24, 2018

AppNexus is committed to respecting the data protection rights you may have under applicable privacy laws (often referred to as "data subject rights").

Personal Data We Collect

As stated in our Platform Privacy Policy, our advertising technology does not collect information that directly identifies you as an individual, and instead only collects certain digital identifiers that may identify your device or your Internet browser (each, a "Digital Identifier"). These Digital Identifiers may be considered personal data in some jurisdictions including the European Union.

Your Rights Explained

Residents of some countries (for example the European Economic Area ("EEA")), can exercise certain data subject rights available to them under applicable data protection laws.

These rights may include the right to request access to, or to request erasure or portability of, your personal information. You may also have a right to object to, or request that we restrict, processing of your personal information. Where such rights apply, we will comply with requests to exercise these rights in accordance with applicable data protection laws.

Access Request and the Information we will Provide

If you make a request to access personal data we hold about you (also known as an "access request"), we will provide you with the following information (of which we are the controller):

  • Data about Advertising Transactions: We will provide you with the categories of personal information associated with your Digital Identifier residing in our systems about advertising transactions conducted using our advertising technology

As authorized by our clients and third party providers operating through our Platform, if you make an access request, we will provide you with the following information (of which we are the processor on behalf of our clients or third party providers, as applicable):

  • Inferences about a user's interest or a user's interests (known as "Segment Information"): We will provide you with the Segment Information associated with your Digital Identifier(s) residing in our systems

Data about Advertising Transactions

  • Other than Segment Information (see below), we do not store data about advertising transactions conducted using our advertising technology at a Digital Identifier level in our systems
  • Prior to storing impression-level data about each advertising transaction conducted using our advertising technology (see below), we logically separate and store Digital Identifiers separate from the remainder of our impression level data in a separate storage system (known as our "Data Hive")
  • Data Hive
    • the Data Hive where the Digital Identifiers are stored is strictly access controlled technically and is subject to policies such that the Digital Identifiers are only able to be accessed internally for, and only by teams working on, the detection and prevention of invalid traffic and for security purposes
    • this means that the Digital Identifiers used by these internal are not used in a way that impacts or affects the users in question and the teams are (by access controls and strict internal policies) prohibited from using data in any way that impacts or affects individuals
    • as a result of this logical separation, other than those teams that are specifically given access, teams within AppNexus are only able to use Digital Identifiers in an encrypted (i.e., hashed) format
  • As such, providing impression level data associated with Digital Identifiers would jeopardize the privacy by design work undertaken by us to logically separate, access control and prevent use of the Digital Identifiers held within our data pipeline from other Platform Data collected, received and used by AppNexus

What data resides outside of the Data Hive that may be associated with Digital Identifiers?

  • If a decision is made to sell ad space (a request to sell ad space is known as an impression) using our advertising technology, once the sale (or attempted sale) is conducted, certain data about every impression received (whether sold or not using our advertising technology) is logged to our data pipeline on a per-impression basis (against a unique identifier that identifies each sale or attempted sale)
  • That information includes the personal information described in our Platform Privacy Policy and other information about each impression including information about the seller, settings set by a seller for that impression (e.g., types of brands and types of creatives the seller is willing to accept, price floors set by the seller), information about the bids we received for the impression (bids made by buyers using our technology and third party buyers, such as demand side platforms), whether a user clicked on the creative, the extent to which some or all of the creative delivered was viewable on the page and the amount of time the creative was viewable
  • Additionally, we log certain events that occur outside of a real-time request to fill ad space including user conversions (e.g., when a user shown an ad takes an action in relation to that ad (this is enabled by way of a conversion pixel placed on a site) and other pixel fires)

Segment Information associated with Digital Identifiers

Segments and AppNexus

What is Segment Information?

  • Segments are categories of inferences or information about Internet users' interests (e.g., "dog lovers" or "men between the age of 25-40")
  • When Digital Identifiers are placed into segments by our clients, this creates what is known as "Segment Information"
  • Segments allow our clients to use their inferences about a Digital Identifier or an Internet user to create or enhance a profile about that Digital Identifier (i.e., build an audience profile, for example by distinguishing a "dog person" from a "cat person" and showing users in each category correspondingly appropriate ads)
  • A Digital Identifier can be a member of any number of segments depending on our clients' inferences about that Digital Identifier's personal preferences (determined by the Digital Identifier's online usage and the clients' proprietary offline data that they can match to our cookies or match to mobile advertising identifiers)

Does AppNexus create segments?

  • AppNexus does not independently create segments or decide which segments Digital Identifiers are assigned to
  • Segments and Digital Identifiers associated with a segment are stored and enabled by AppNexus for the specific client or third party on whose behalf a segment is created
  • AppNexus only allows access to segments created by a client, third party data management platform or data provider as directed by the client that created or controls a segment

How do Clients Create Segments or Share them with us?

Methods for Creating Segments

Clients and third parties can create segments using our UI or API. For more information, see Creating and Managing Segments.

Methods for passing Segment Information to AppNexus

AppNexus clients, third party data management providers or third party data providers pass Segment Information to AppNexus:

  • for their own use in targeting, or
  • for their own use in targeting, or
  • to share with AppNexus clients to support the buying and selling of ad inventory when the client or third party creating the segment in our Platform directs us to do so

Segment Information is passed to AppNexus in a number of ways.

  • Segment pixels: Data may be passed by means of segment pixels placed on a client or third party provider's site, which then sends a message to our Platform when Internet users visit those sites
  • Offline process: Segment Information may also be passed from AppNexus clients to AppNexus by means of an offline process:
    • Clients or partners use the batch segment or instant audience service, each of which accepts a list of user IDs and the corresponding segments that clients or partners have associated with those user IDs. NOTE: Clients or partners may use AppNexus user IDs or their own user IDs (if they have provided AppNexus with a user ID mapping using the mapUID service).

How to Make a Data Subject Rights Request to Access the Segments associated with your Digital Identifier

If you wish to exercise a data subject rights request to access the Segments associated with your Digital Identifier on the AppNexus Platform, please follow the steps described below:

Step 1: Allow us to Locate or You Locate Your Digital Identifiers

In order for us to locate relevant records, we will need you to provide us with your Digital Identifiers. We or you can find your Digital Identifiers as follows:

  • Web Browsing

As described in our Platform Privacy Policy, our advertising technology operates by using text files called "cookies" that are placed on your device. Some of these cookies include a Digital Identifier. By visiting this website with your device, our domain is able to read your "uuid2" and "uids" cookies (which are set from the adnxs.com domain controlled by us). The text in each of these cookies is a separate Digital Identifier.

Please keep in mind that different cookies are placed on each browser that you use to access the Internet. As a result, if you use multiple browsers (for example, Mozilla Firefox and Google Chrome), you will need to visit this website from each of those browsers so that we can read your "uuid2" and "uids" cookie for each browser.

  • Mobile Devices

Additionally, certain mobile devices (for example, mobile phones or tablets using the iOS or Android operating systems) generate a persistent "Advertising Identifier" per device, which, among other things, can be used by third parties for purposes of providing you with targeted advertising. On iOS devices, your Advertising Identifier may be referred to as an "IDFA," "IFA," or an "ID for Advertising." On Android devices, your Advertising Identifier may be referred to as an "Advertising ID." Please follow instructions from your mobile device manufacturer on how to locate your specific Advertising Identifier.

Step 2: Verify Your Digital Identifiers

In order to make sure that we are responding to the correct person, we also will need you to confirm you are indeed the owner and controllers of the Digital Identifiers you allowed us to locate or you located in Step 1.

To complete Steps 1 and 2, visit here.