Effective Date: May 25, 2018
Revision History: Original publication: May 24, 2018
AppNexus is committed to respecting the data protection rights you may have under applicable privacy laws (often referred to as "data subject rights").
Personal Data We Collect
Your Rights Explained
Residents of some countries (for example the European Economic Area ("EEA")), can exercise certain data subject rights available to them under applicable data protection laws.
These rights may include the right to request access to, or to request erasure or portability of, your personal information. You may also have a right to object to, or request that we restrict, processing of your personal information. Where such rights apply, we will comply with requests to exercise these rights in accordance with applicable data protection laws.
Access Request and the Information we will Provide
If you make a request to access personal data we hold about you (also known as an "access request"), we will provide you with the following information (of which we are the controller):
- Data about Advertising Transactions: We will provide you with the categories of personal information associated with your Digital Identifier residing in our systems about advertising transactions conducted using our advertising technology
As authorized by our clients and third party providers operating through our Platform, if you make an access request, we will provide you with the following information (of which we are the processor on behalf of our clients or third party providers, as applicable):
- Inferences about a user's interest or a user's interests (known as "Segment Information"): We will provide you with the Segment Information associated with your Digital Identifier(s) residing in our systems
Data about Advertising Transactions
- Other than Segment Information (see below), we do not store data about advertising transactions conducted using our advertising technology at a Digital Identifier level in our systems
- Prior to storing impression-level data about each advertising transaction conducted using our advertising technology (see below), we logically separate and store Digital Identifiers separate from the remainder of our impression level data in a separate storage system (known as our "Data Hive")
- Data Hive
- the Data Hive where the Digital Identifiers are stored is strictly access controlled technically and is subject to policies such that the Digital Identifiers are only able to be accessed internally for, and only by teams working on, the detection and prevention of invalid traffic and for security purposes
- this means that the Digital Identifiers used by these internal are not used in a way that impacts or affects the users in question and the teams are (by access controls and strict internal policies) prohibited from using data in any way that impacts or affects individuals
- as a result of this logical separation, other than those teams that are specifically given access, teams within AppNexus are only able to use Digital Identifiers in an encrypted (i.e., hashed) format
- As such, providing impression level data associated with Digital Identifiers would jeopardize the privacy by design work undertaken by us to logically separate, access control and prevent use of the Digital Identifiers held within our data pipeline from other Platform Data collected, received and used by AppNexus
What data resides outside of the Data Hive that may be associated with Digital Identifiers?
- If a decision is made to sell ad space (a request to sell ad space is known as an impression) using our advertising technology, once the sale (or attempted sale) is conducted, certain data about every impression received (whether sold or not using our advertising technology) is logged to our data pipeline on a per-impression basis (against a unique identifier that identifies each sale or attempted sale)
- Additionally, we log certain events that occur outside of a real-time request to fill ad space including user conversions (e.g., when a user shown an ad takes an action in relation to that ad (this is enabled by way of a conversion pixel placed on a site) and other pixel fires)
Segment Information associated with Digital Identifiers
Segments and AppNexus
What is Segment Information?
- Segments are categories of inferences or information about Internet users' interests (e.g., "dog lovers" or "men between the age of 25-40")
- When Digital Identifiers are placed into segments by our clients, this creates what is known as "Segment Information"
- Segments allow our clients to use their inferences about a Digital Identifier or an Internet user to create or enhance a profile about that Digital Identifier (i.e., build an audience profile, for example by distinguishing a "dog person" from a "cat person" and showing users in each category correspondingly appropriate ads)
- A Digital Identifier can be a member of any number of segments depending on our clients' inferences about that Digital Identifier's personal preferences (determined by the Digital Identifier's online usage and the clients' proprietary offline data that they can match to our cookies or match to mobile advertising identifiers)
Does AppNexus create segments?
- AppNexus does not independently create segments or decide which segments Digital Identifiers are assigned to
- Segments and Digital Identifiers associated with a segment are stored and enabled by AppNexus for the specific client or third party on whose behalf a segment is created
- AppNexus only allows access to segments created by a client, third party data management platform or data provider as directed by the client that created or controls a segment
How do Clients Create Segments or Share them with us?
Methods for Creating Segments
Clients and third parties can create segments using our UI or API. For more information, see Creating and Managing Segments.
Methods for passing Segment Information to AppNexus
AppNexus clients, third party data management providers or third party data providers pass Segment Information to AppNexus:
- for their own use in targeting, or
- for their own use in targeting, or
- to share with AppNexus clients to support the buying and selling of ad inventory when the client or third party creating the segment in our Platform directs us to do so
Segment Information is passed to AppNexus in a number of ways.
- Segment pixels: Data may be passed by means of segment pixels placed on a client or third party provider's site, which then sends a message to our Platform when Internet users visit those sites
- Offline process: Segment Information may also be passed from AppNexus clients to AppNexus by means of an offline process:
- Clients or partners use the batch segment or instant audience service, each of which accepts a list of user IDs and the corresponding segments that clients or partners have associated with those user IDs. NOTE: Clients or partners may use AppNexus user IDs or their own user IDs (if they have provided AppNexus with a user ID mapping using the mapUID service).
How to Make a Data Subject Rights Request to Access the Segments associated with your Digital Identifier
If you wish to exercise a data subject rights request to access the Segments associated with your Digital Identifier on the AppNexus Platform, please follow the steps described below:
Step 1: Allow us to Locate or You Locate Your Digital Identifiers
In order for us to locate relevant records, we will need you to provide us with your Digital Identifiers. We or you can find your Digital Identifiers as follows:
- Web Browsing
Please keep in mind that different cookies are placed on each browser that you use to access the Internet. As a result, if you use multiple browsers (for example, Mozilla Firefox and Google Chrome), you will need to visit this website from each of those browsers so that we can read your "uuid2" and "uids" cookie for each browser.
- Mobile Devices
Additionally, certain mobile devices (for example, mobile phones or tablets using the iOS or Android operating systems) generate a persistent "Advertising Identifier" per device, which, among other things, can be used by third parties for purposes of providing you with targeted advertising. On iOS devices, your Advertising Identifier may be referred to as an "IDFA," "IFA," or an "ID for Advertising." On Android devices, your Advertising Identifier may be referred to as an "Advertising ID." Please follow instructions from your mobile device manufacturer on how to locate your specific Advertising Identifier.
Step 2: Verify Your Digital Identifiers
In order to make sure that we are responding to the correct person, we also will need you to confirm you are indeed the owner and controllers of the Digital Identifiers you allowed us to locate or you located in Step 1.
To complete Steps 1 and 2, visit here.