User Rights Policy Notice

Contents

1. Introduction
2. About Us
3. The Information We Collect About You
4. Why We Collect Your Information
5. Lawful Basis for Processing Your Personal Data
6. Special Categories of Information
7. Children’s Privacy
8. Disclosure of Your Information
9. Automated Decision Making
10. Industry Self-Regulation &  Ad Choices
11. Your Rights
12. Data Security
13. Data Retention Periods
14. International Data Transfers
15. Changes to Our Privacy Notice
16. Contact Information
17. Addendum: Sharethrough Consumer Privacy Notice Addendum for California Residents

1. Introduction

Sharethrough, Inc., its affiliates, and subsidiaries (“Sharethrough” or “we” or “us” “our”) respect your privacy and are committed to protecting your information.

This User Privacy Notice (“Privacy Notice”) outlines our practices for collecting, using, maintaining, protecting, and disclosing (“Processing” or “Process”) your Personal Data. Sharethrough may Process your Personal Data when you visit third-party websites, mobile applications and over-the-top (“OTT”) devices (such as SmartTVs or applications on your Smart TV)  (“Partner Sites”), that use our advertising platform (the “Advertising Platform”) to serve targeted advertisements to you based on your personal interests (“Advertisements”).                          

As you navigate through and interact with Advertisements served by our Advertising Platform on Partner Sites, we may use automatic data collection technologies to collect certain information about your equipment and also details of your interaction with Advertisements. This information includes “personal information” or “personal data” as defined under applicable law, including the laws of Canada, Quebec, Europe, the United Kingdom, the United States, including California and Virginia and more. “Personal Data” as referred to in this Privacy Notice is any information, whether combined or on its own, that directly or indirectly identifies or could reasonably identify you.

Please read this Privacy Notice carefully to understand our policies and practices regarding your Personal Data and how we treat it. We recommend that you read this Privacy Notice  in full; however, the links at the top of the page are intended to help you navigate to sections that are relevant to the information in which you may be interested.  

This Privacy Notice applies to information we collect when you interact with Advertisements on Partner Sites. It does not apply to:

• Information collected by Buyers, other providers, or any third parties with whom we conduct business;
• Information related to your employment or potential employment with us. This can be found on our Candidate Privacy Notice; 
• Information collected by our website. This can be found on our Website Privacy Notice; or 
• Information we collect in our business relationship with you. This can be found on our Corporate Privacy Notice. 

We recommend that you also consult the privacy policies of the third-party digital properties you use to become familiar with their privacy and data collection uses and practices.

2. About Us

Sharethrough is a supply-side platform (“SSP”) and advertising exchange. Our technology enables us to conduct online auctions for advertising space on Partner Sites. These third-party partners are collectively referred to as “Partners” in this Privacy Notice.

Through the Advertising Platform, Sharethrough connects Partner Sites to buyers of advertising space that wish to bid on Partner ad space inventory. Buyers include advertisers and intermediary demand-side partners (collectively, “Buyers”). Buyers work with Sharethrough based on contractual relationships to deliver ads based on your personal interests and to reach their target audiences. 

3. The Information We Collect

Information Sharethrough and our Partners collect

Sharethrough and our partners (Partners, Buyers, and any other type of business involved in the ad tech ecosystem) operate on an open-source protocol to provide our services, known as Open RTB. This open-source protocol allows the collection of information such as:

• Cookie identifiers – A cookie is a small file placed on the browser of your computer. 
  • Sharethrough cookies
    • Our Advertising Platform uses persistent cookies (which stay on your computer until you delete them) to provide our services. These cookies are used to display promotions or advertisements on Partner Sites based on your interests. They collect information about your activities on our Partner Sites and other sites to provide you with Advertisements that match your interests.      
    • We may collect and store cookie identifiers from a variety of domains, and store such identifiers at either our domain or our partners’ domains. We also engage in cookie syncing, which is the matching of our cookie identifiers with those of our clients and other partners.

• Third party cookies 
  • In addition to Sharethrough cookies, Buyers may also drop persistent cookies on your browser. Buyers include companies such as Google to deliver the best advertising opportunities to its clients. Traffic Clients and other data subjects can consult Google’s policies to learn more about Google’s processing policies. In particular, Google may use remarketing tags (please visit https://policies.google.com/technologies/partner-sites to learn more about the third parties Google works with) and other advertising cookies.

• Web Beacons – These are small electronic files on Partner Sites (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit our Advertising Platform, to perform activities, such as counting users who interacted with certain Advertisements and understanding the scope of that interaction. 

• Clickstream data – This includes the Advertisements you have clicked or that have otherwise been viewable to you, the amount of Advertisements displayed and the amount of time the Advertisement was viewable to you.
  

• Device information – As applicable, general information such as device type (e.g., laptop, mobile, TV), model, manufacturer, operating system, time zone, telephone carrier information, network information (e.g., WIFI), and mobile application information. Mobile device information includes standard mobile advertising identifiers located on every mobile device. These are:
  • IDFA – advertising identifier used on Apple’s iOS devices; and
  • Google Advertising ID (AAID or GAID) – advertising identifier used on Android devices, to track your use of mobile apps on your device(s).

• Geolocation data – Location information such as city, country, zip code/postal code, and/or longitude/latitude. 
• Date and time of your visit to a Partner Site
• IP address 
• User agent – A short bit of text that attempts to describe the software/browser (the “Agent“) that is making the request to a website. The user agent often includes descriptions of the operating system and device type that the Agent is running on.
• Information about your internet connection and, and other communication data and the resources that may be a result of your access to Advertisements on Partner Sites.     

The above is a comprehensive but non-exhaustive list of the personal data we may collect and or receive about you. The full list can be found on the Open RTB protocol spec, as amended from time to time.

4. Why We Collect Your Personal Data

Sharethrough may Process your Personal Data to:

• Engage in real time transactions for the sale of Advertisements and deliver such ads to you on our Partner Sites;
• Show you Advertisements on the Partner Sites that are more relevant to your interests (for example, Advertisements based on other websites and online platforms that you have visited); 
• View and enforce user opt-out choices; to access your opt-out choices for us and other third-party advertisers, click here;
• Detect and stop click fraud on the Partner Sites;
• Audit your interactions with Advertisements, including, but not limited to: counting advertising impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with any applicable specification and other standards;
• Help maintain the safety, security, and integrity of Sharethrough’s Advertising Platform, detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity related to the use of the Advertising Platform;
• Identify and repair errors that impair existing intended functionality in the Advertising Platform;
• Carry out our obligations and enforce our rights arising from any contracts entered into between the operators of our Partner Sites and Buyers; 
• Conduct internal testing, research, analysis, reporting, and product development, including to develop and improve our Advertising Platform; and
• Process your Personal Data for any other purpose with your consent.

Kindly note, Sharethrough does not measure your browser history, or engage in retargeting, reidentification, or audience segmentation; however, some of our partners may engage in these practices. They may also Process your Personal Data. In addition, Sharethrough does not participate in cross-device linking. Cross device linking is the process of tracking a user across multiple devices, for example, across a SmartTV, mobile, and/or website; some of our partners may engage in cross device linking.

5. Lawful Basis for Processing Your Personal Data

Sharethrough will always Process your Personal Data if it has a legal reason to do so. Below are the lawful bases under which we may Process your Personal Data. 

• Consent. As we do not have a direct relationship with you, we require Partner Sites to obtain any consents from you with respect to our Processing of your Personal Data, as required by applicable law, and particularly under European data privacy law. Please contact the websites and mobile and Smart TV applications you visit regarding any methods that they provide to obtain consent. If you do not consent to our Processing of Personal Data as set forth in this Privacy Notice, please review the choices that the operators of the Partner Sites may provide you or do not use the applicable Partner Sites; 

• Legitimate Interests. In limited circumstances, we may Process your Personal Data as necessary for our legitimate interests in accordance with this Privacy Notice. We do not Process your Personal Data if your interests or rights and freedoms outweigh our legitimate interests. Our legitimate interests may include measuring ad performance‍.

• As Required by Law. We may also Process your Personal Data when we are required or permitted to by law; to comply with government inspections, audits, and other valid requests from government or other public authorities; to respond to legal requests such as subpoenas; or as necessary for us to protect our interests or otherwise pursue our legal rights and remedies (for instance, when necessary to prevent or detect fraud, attacks against our network, or other criminal and tortious activities), defend litigation, and manage complaints or claims. We use every effort to protect your privacy in such circumstances. 

6. Special Categories of Information

Sharethrough does not ask you to provide, and we do not knowingly collect, any “special categories” of Personal Data, or sensitive data, including Personal Data that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade unions membership, or Personal Data concerning your health or data concerning your sex life or sexual orientation or history of criminal convictions. We also do not collect information that directly identifies you, such as your identification or financial information.

7. Children Under the Age of 13

Our Advertising Platform may collect information from a child (as defined by applicable law) because of a child’s interaction with some Partner Sites. We do not control these Partner Sites, and the operators of those Partner Sites are solely responsible for obtaining any required parental consents and for all other compliance requirements related to the collection and use of information from children. If you believe we might have any information directly from a child without required consents, please contact us.

8. Disclosure of Your Information

We may disclose Personal Data that we collect, or that you provide, as described in this Privacy Notice as follows:

• To Buyers for real time transactions for the sale of Advertisements using the Open Real Time Bidding protocol;
• With other Buyers, through the synchronization of our cookie identifiers with the identifiers of other third parties; these partners are intermediaries that source advertisements related to your personal interest. 
• With our identity partners (independent companies that qualify you into broad interest-based categories in order to serve you Advertisements based on your personal interests such as LiveRamp or Unified ID 2.0);
• Fraud prevention vendors – third-party vendors that help maintain the integrity of our services, for example, by preventing malicious software (e.g., viruses, trojans) or traffic from non-humans (i.e., robots) from loading on the websites you browse;
• For any other purpose disclosed by the operators of the Partner Sites when you navigate on their website;
• To our subsidiaries and affiliates;
• To contractors, service providers, and other third parties we use to support our business  and who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which we disclose it to them. These entities provide IT and infrastructure support services along with payment processing and collection services;
• To a potential or actual buyer or other successor in the event of a planned or actual merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Sharethrough’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Sharethrough about the users of our Advertising Platform is among the assets transferred;
• To comply with any lawful requests, court order, legal process, or response to any government or public authority request; including to meet national security or law enforcement requirements.
• To enforce or apply our agreements with Buyers and publishers, including for billing, collection, and revenue sharing purposes; and
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Sharethrough, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

We do not control the collection and use of your information by third parties. Third parties we work with are under contractual obligations to use this data only for providing the services to us, and to maintain      the confidentiality of such information, as applicable. Additionally, each third party Processes your Personal Data in accordance with their own privacy policies. For more information about third parties that may collect your data, please visit https://youradchoices.ca/choices.

9. Automated Decision Making

Sharethrough does not use your Personal Data with any automated decision-making process, including profiling, which may produce a legal effect concerning you or similarly significantly affect you.

10. Industry Self-Regulation &  Ad Choices

Sharethrough believes in industry self-regulation and supports multiple self-industry efforts to protect your personal data, including:

• Digital Advertising Alliance (DAA): Sharethrough adheres to the DAA Self-Regulatory Principles for Online Behavioral Advertising. Under these principles, you have the choice to opt-out of third-party behavioural advertising preventing further collection from your browser and/or mobile device. For more information, please visit https://youradchoices.com/control.*
• Digital Advertising Alliance of Canada (DAAC): Sharethrough adheres to the DAAC’s Self-Regulatory Principles for Online Behavioral Advertising. 
• The Interactive Advertising Bureau (IAB): Sharethrough strictly enforces the IAB’s Consent Framework for managing GDPR consent for data collection and processing in the European Economic Area. This means we do not Process any Personal Data unless we receive a consent string, meaning a code that signals consent status shows that you consented to receive personalized advertising or allow us to process your Personal Data on the basis of legitimate interest. Sharethrough’s identification number within the framework is 80. Sharethrough also strictly enforces the IAB CCPA Compliance Framework for technology companies to manage data collection and processing in California. 
• Trustworthy Accountability Group (TAG): Sharethrough is a member in good standing of TAG.    

*Please note, while this section is intended to demonstrate the self-regulatory initiatives that Sharethrough adheres to, we added information relating to the DAA’s opt-out per request from the BBB National Programs; an independent, non-profit organization that provides third-party accountability and dispute resolution services for the DAA. 

11. Your Rights

Applicable data protection laws may provide you with certain rights with regards to our Processing of your Personal Data.      

1. Access. You can review and access your Personal Data by visiting Sharethrough’s User Rights Page. 
2. Deletion. You can review and request to delete your Personal Data by visiting Sharethrough’s User Rights Page.  

You may also remove the Personal Data collected by us and stored in cookies by removing our cookies on your devices.         

Please note, in limited circumstances, we may not be able to accommodate a request to delete information if we believe the deletion would violate any law or legal requirement or cause the information to be incorrect in which case we will notify you if we cannot accommodate your request.

3. Portability. The Personal Data you access by visiting Sharethrough’s User Rights Page will be provided to you in a portable format. If you have any questions, please Contact Us.     

4. Correction. Due to the technical nature of the data we collect (i.e., cookies and online technical identifiers), it may be impossible/impractical for us to correct or change your Personal Data. If you believe the Personal Data we have about you is incorrect and would like us to rectify it, please Contact Us and we will do our best to accommodate.

5. Restrictions / Right to be Forgotten/Opt-Out of Processing. You have the right to restrict our Processing of your Personal Data under certain circumstances. For example, you can request for Sharethrough to restrict the use of your Personal Data if you contest its accuracy, if the Processing of your Personal Data is determined to be unlawful, or if we no longer need your Personal Data for Processing but we have retained it as permitted by law.You can restrict processing by setting your browser to refuse all or some browser cookies, or to alert you when cookies are being sent to facilitate the restriction of processing. If you restrict such processing, please note, you will still see Advertisements on Partner Sites, they just may not be relevant to your interests. You can find more information about cookies at http://www.allaboutcookies.org and http://youronlinechoices.eu.  Please Contact Us if you require additional information.

Opt-outing out of browser, mobile, CTV. In addition, we also provide you the ability to opt-out for the use of the information that we collect to deliver Advertisements on the Partner Sites. If you wish to opt-out of the use of your Personal Data for displaying Advertisements served through our Advertising Platform please visit our Opt-out/Do Not Sell My Personal Information  Page. Kindly note, opting-out of personalized advertising does not mean you will no longer see online ads, it simply means you will not see ads tailored to your personal interests.

Partner Sites may also provide you regarding the use of cookies and the collection and use of Personal Data. Please consult with their websites for more information.

6. Right to Lodge a Complaint – Europe

Under certain data privacy laws, you have the right to lodge a complaint with the applicable regulator in the jurisdiction you live in, the jurisdiction you work in, or the jurisdiction where you believe your rights under applicable data protection laws have been violated. Please see the contact details of supervisory authorities below:

• EU Data Protection Authorities
• The Swiss Data Protection Authority
• UK Information Commissioner’s Office

However, before doing so, we kindly request that you Contact us directly in order to give us an opportunity to work directly with you to resolve any concerns about your privacy.

In addition to the above, you may exercise any of the above rights by contacting us through any of the methods listed under Contact Information below. If you contact us to exercise any of the foregoing rights, we may ask you for additional information to verify your identity. We reserve the right to limit or deny your request if you have failed to provide sufficient information to verify your identity or to satisfy our legal and business requirements. Please note that if you make unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access your Personal Data, you may be charged a fee subject to a maximum set by applicable law. 

7. Right to Lodge a Complaint – United States 

DATA PRIVACY PROTECTION FRAMEWORK 

The Data Privacy Protection Framework (DPF) (and the UK and Swiss extensions) were developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.

In compliance with the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF, (please refer to more information under the data transfers section), Sharethrough commits to resolve DPF Principles-related complaints about our collection and use of your personal information.  

As part of the the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Sharethrough is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Sharethrough may also be liable in cases of onward transfers to third parties in the event such transfers violate the requirements under applicable law. Under certain conditions, you may have the power to invoke binding arbitration under these above noted programs.

EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF should first contact Sharethrough as noted in the Contact Us section below. 

12. Data Security

We have implemented measures designed to secure your Personal Data from accidental loss and from unauthorized access, use, alteration, and disclosure. This includes the use of encryption and role-based access controls using secure protocols. 

Although we use our best efforts to protect your Personal Data, we cannot guarantee the security of your Personal Data transmitted to our Advertising Platform, as the transmission of information via the internet carries risk. We are not responsible for the circumvention of any privacy settings or security measures by a third party deployed on the Advertising Platform. 

13. Data Retention Periods

Sharethrough maintains a database of synchronized cookie identifiers with our Buyers for up to thirty (30) days upon every cookie refresh, unless you opt-out of our use of your Personal Data as described above. Sharethrough participates in cookie refresh; this means cookies containing your Personal Data may be retained on your device permanently, unless and until you remove them.      

We generally do not store any Personal Data in transaction logs, unless required for troubleshooting. In such case, raw data from logs may be extracted, analyzed, and destroyed within 30 days.                   

In addition to the above, we may retain Personal Data for any of the reasons listed below:

• For as long as necessary to comply with any legal requirement; 
• On our backup and disaster recovery systems in accordance with our backup and disaster recovery policies and procedures;
• For as long as necessary to protect our legal interests or otherwise pursue our legal rights and remedies; and
• For data that has been aggregated or otherwise rendered anonymous in such a manner that you are no longer identifiable, indefinitely.

14. Data Transfers

To provide our services, Sharethrough may transfer your personal data internationally to any of our cloud storage locations (in the United States, Germany, or Singapore), or to any advertiser’s international data center locations. 

Quebec

Please note, if you are a resident of Quebec, your Personal Data may be transferred outside of Quebec externally to the rest of Canada, or globally to our cloud storage locations or our advertiser’s data center locations. We respect the security and confidentiality of your data while effecting these international transfers as described under Section 13 above. Moreover, such data is only Processed for the purposes as described in this Privacy Notice, and you have privacy rights under the data protection regimes of the jurisdictions where your data is transferred.

European Data Protection Regulations

In order to provide you with Advertisements that are relevant to your interests, we may send and store your Personal Data outside of the country where you reside or are located. Your information may be processed and stored in the United States and in Canada. By not opting out of our use of your Personal Data as described above, you represent that you have read and understood the above and hereby consent to the storage and processing of Personal Data outside the country where you reside or are located, including in the United States and Canada.  

Your Personal Data is transferred by Sharethrough to another country only if it is required or permitted under applicable data protection law and provided that there are appropriate safeguards in place to protect your Personal Data. To ensure your Personal Data is treated in accordance with this Privacy Notice when we transfer it to a third party, Sharethrough relies on Standard Contractual Clauses adopted by the European Commission (the “Standard Contractual Clauses”). The European Commission has determined that the transfer of Personal Data pursuant to the Standard Contractual Clauses provides for an adequate level of protection of your Personal Data, but may need to be supplemented with additional measures on a case-by-case basis after an analysis that such supplemental measures can provide you with an essentially equivalent level of protection as afforded in the EU. When, as a result of this analysis, we believe this to be appropriate and necessary, these Standard Contractual Clauses have been supplemented in this way. Under these Standard Contractual Clauses, you have the same rights as if your data was not transferred to such third country. When applicable, you may request a copy of the Data Protection Agreement by contacting us through the Contact Information below.  

EU-U.S. DATA PRIVACY FRAMEWORK, the UK extension, and SWISS-US Data Privacy Framework

Sharethrough complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Sharethrough certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.  Sharethrough certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Sharethrough commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF,the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to either of the following: the United States Council for International Business, an alternative dispute resolution provider based in the United States or JAMS. 

 If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit  https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint.  The services of the United States Council for International Business or JAMS are provided at no cost to you.

15. Changes to Our Privacy Notice

We may change this Privacy Notice to accommodate new technologies, industry practices, regulatory requirements or for other purposes. The date at the top of this Policy reflects the most recent changes made. If we make material changes to this Policy, we will post the revised Policy on our website and may take additional measures to inform you, as required by applicable data protection and privacy laws.

16. Contact Information

If you have any questions, please contact us at the information below. 

To Contact the Data Protection Team at Sharethrough (Controller)

Sharethrough
5455 Gaspe Avenue, Suite 730
Montreal, Quebec,
Canada H2T 3B3
Attn: Legal Department
Email: dataprotection@sharethrough.com

To Contact Our EU Representative

Legal Army c/o Sharethrough Inc.

Enrique Extremera Maestro

C. de la Princesa, 31,

Moncloa – Aravaca,

Madrid, Spain, 28008

Email: dpo@sharethrough.com

To Contact Our Data Protection Officer/ Privacy officer under Quebec’s Law 25

Chantal Bernier
99 Bank Street
Suite 1420
Ottawa, Ontario K1P 1H4
Canada
+1 (613) 783-9600
Email: chantal.bernier@dentons.com

18. Sharethrough Consumer Privacy Notice Addendum for California Residents

This notice to California residents (“California Notice”) is provided under California law, including the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code 1798.100, et seq. This notice supplements our Privacy Notice by explaining your privacy rights if you are a California resident, providing our “notice at collection,” and providing certain mandated disclosures about our treatment of California residents’ information, both online and offline.

We recommend you review the Privacy Notice in full, along with the California Notice to have a complete overview of Sharethrough’s privacy practices. 

Sharethrough Platform
Our Advertising Platform collects information that could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“Personal information”).      

Categories of Personal Information Collected
Please find below the categories of Personal Information Sharethrough collects, and has collected, over the prior twelve (12) months through our Advertising Platform: