TripleLift Platform Privacy Notice

Effective: 28 October 2024

This Privacy Notice describes how TripleLift collects, uses and discloses personal data when it provides its advertising Platform services to publishers, advertisers and other advertising related clients.

* Service providers and ‘processors’ used by TripleLift (i.e. entities operating under our instructions and for our benefit), TripleLift affiliate companies, and new owners of the data asset in the event of a merger or acquisition are not considered a third party for the purpose of this table.

** Legal basis relied on by TripleLift under applicable European law.

✝ For the purposes of applicable Canadian law, references to “consent” should be construed as meaning implied consent or express consent. References to “legitimate interest” should be construed as meaning implied consent, unless the processing is exempted from the requirement for consent under applicable Canadian law, in which case such reference should be ignored.

Further information about the content of this table is available in the remainder of the privacy notice.

Further information on processing 

What information do we process?

Online identifiers

• Online identifiers are unique identifiers that TripleLift uses to single out your device without directly identifying you. TripleLift processes different kinds of online identifiers in order to uniquely identify specific devices or a specific user or household. But importantly, TripleLift uses these identifiers in ways that do not reveal your real world identity (such as your name or your phone number) to TripleLift.
• Online identifiers include:
  • Device identifiers. These are alphanumeric identifiers – or in other words, unique combinations of random numbers and letters – stored on or made available by a device. They include:
    • Cookie identifiers. Cookie identifiers are small text files stored in a browser that contains a unique combination of random numbers and letters.
    • Advertising Identifiers. Advertising Identifiers are unique and usually user-resettable identifiers that are provided by operating systems, such as the Android Advertising Identifier provided by Google Play services, the Identifier for Advertisers (or IDFA) provided by Apple iOS, or other similar identifiers provided by operating systems of connected TVs, or other connected devices. 
  • Cryptographically obfuscated contact information. Identifiers based on contact information like emails and mobile phone numbers that have been cryptographically obfuscated (or ‘hashed’). Hashing means these IDs are no longer human readable and cannot be used by TripleLift to contact you or otherwise directly identify you.
  • Statistical identifiers. Statistical identifiers are generated by analyzing network and connection data (like IP addresses), as well as device characteristics (like make and model) to calculate the likelihood that a connection originates from a specific device. 
  • Supply or demand partner-provided identifiers. These identifiers that are provided to TripleLift by a supply partner or demand partner could be any of the previously described identifiers, but TripleLift would not necessarily be in a position to know which.
• TripleLift obtains online identifiers in a number of different ways:
  • It collects device identifiers itself where our technology is implemented on the digital service of a supply partner or demand partner and your device interacts with that digital service.
  • It receives online identifiers from supply partners whose content you access, or whose services you use. For example when you visit their website or use their app. 
  • It receives online identifiers from demand partners whose content you access, or whose goods or services you purchase or show an interest in purchasing.
  • It receives online identifiers from partners and vendors that provide data products or services to TripleLift, supply partners or demand partners. For more information see our List of of Processors, Partners and Other Third Parties.

Content consumption data

• Content consumption data is information about activity on digital content you consume, such as pages loaded, searches you make, videos you watch, or links you click. 
• TripleLift collects or receives content consumption data from the digital service of a supply partner or demand partner when your device interacts with that digital service.

Ad consumption data

• Ad consumption data is information about which ad was served to you, the type of ad, where on the page the ad was served, and whether you interacted with the ad (such as by clicking on it). 
• TripleLift collects or receives ad consumption data from ads you are served on the digital service of a supply partner when your device interacts with that digital service. TripleLift may also receive ad consumption data from demand partners.

Inferred personal aspects data

• Inferred personal aspects data is information TripleLift has inferred about you based on content consumption data, including your interests and demographics (like age and gender). For example, if you consume content related to motorsports, we might infer that you are interested in cars.
• TripleLift creates inferred personal aspects data from content consumption data that it collects.

Ground-truth data

• Ground-truth data is information that we either know or believe to be true about you, for example because it is behavior we observed ourselves (e.g. you visited a specific website), or because we obtained it from a reliable source (e.g. a research company who conducted a survey in which you stated your gender).
• TripleLift collects or receives ground-truth data from partners and vendors that provide data products or services to TripleLift, demand partners, and supply partners.

Network and connection data

• Network and connection data is sent by your device when it accesses services via the internet. This is data like IP address and other technical information (such as operating system or device type) required in order for any device to be able to access internet enabled services. 
• TripleLift collects or receives network and connection data from the digital service of a supply partner or demand partner when your device interacts with that digital service.

Precise location data

• Precise location data is information related to the current or past location of your device, for example Global Positioning Service (GPS) coordinates or other longitude and latitude information, with a level of accuracy that can, for example, indicate specific streets, addresses or points of interest like shopping malls. It involves data that provides accuracy of approximately 500 meters or greater accuracy. Precise location data may be considered sensitive personal information in some jurisdictions.
• TripleLift receives precise location data when it is sent from the digital service of a supply partner or demand partner when your device interacts with that digital service – or in other words, when the partner chooses to share it with TripleLift. 

Consumer privacy preference data

• Consumer privacy preference data is collected by, or shared with, us when you set your privacy preferences, for example on a supply or demand partner’s digital service, or the settings of your browser or device. For example, a supply or demand partner might ask for your consent to use your data in certain ways, or give you the option to object to certain data uses. Consumer privacy preference data contains details of consents or objections you have expressed.
• TripleLift collects or receives consumer privacy preference data from the digital service of a supply partner’s or demand partner’s digital services when your device interacts with that digital service, e.g. when you access a website on your internet connected device.

What is the purpose and the legal basis**✝ of the processing?

**Legal basis relied on by TripleLift under applicable European law.

✝ For the purposes of applicable Canadian law, references to “consent” should be construed as meaning implied consent or express consent. References to “legitimate interest” should be construed as meaning implied consent, unless the processing is exempted from the requirement for consent under applicable Canadian law, in which case such reference should be ignored. 

Online identifiers

• TripleLift processes online identifiers to:
  • Identify your device as a unique device.  
  • Synchronize IDs with partners in order to solicit bids from demand partners, which we do to sell the advertising space of our supply partners
    • When you visit a supply partner’s site or app, the identifier for your device that TripleLift receives may differ from the identifier for your device that a demand partner has. So that both TripleLift and a demand partner can understand that the two different identifiers relate to the same device, we share data with one another. This is often referred to as ‘cookie synching’ or ‘ID synching’. 
    • This ultimately assists us to sell advertising space on a supply partner’s site or app, as we can help demand partners find devices that they are interested in serving advertisements to.   
  • Solicit bids from demand partners to purchase advertising space to advertise to you. Including an online identifier with an opportunity to buy an ad influences whether a demand partner bids, and if so how much they bid. So we use this data to ultimately help the supply partner sell their ad space. 
• Online identifiers help us record contentconsumption data and ad consumption data that is used to infer and record personal aspects, such as users’ interests and characteristics. The resulting records are often referred to as advertising or interest ‘profiles’ or ‘segments’, which are used to help our demand partners better target their ads.
  • Interest segments can contain:
    • Content consumption data;
    • Ad consumption data;
    • Inferred personal aspects.
• TripleLift processes online identifiers with your consent.**
• The processing of your online identifiers is required for certain aspects of TripleLift’s service to function, such as the personalization of ads. If access or permission is not granted to TripleLift, we will be unable to uniquely identify your device, or to synchronize IDs with partners. In that case TripleLift may still solicit bids from demand partners without sharing an identifier, which may result in you seeing less relevant advertisements.

Content consumption data

• TripleLift collects content consumption data:
  • to measure and report on the content you consume and how you interact with it;
  • to combine this information with other information previously collected about you, including from websites and apps you use; 
  • to infer personal aspects data;
  • to deliver personalized ads to you and people who we think are similar to you. By way of example, TripleLift uses content consumption data and our technology to predict products and services that we think will be of particular interest to you based on the websites and apps you use – and also to predict which other people may be interested in similar products and services to you.
• TripleLift processes content consumption data for the above purposes with your consent.** For the purpose of measuring and reporting on advertising, TripleLift may alternatively rely on its legitimate interests and the legitimate interests of our partners.**  The specific legitimate interest relied upon is the legitimate interest to measure the effectiveness of advertising.
• The processing of content consumption data is required for certain aspects of TripleLift’s service to function, such as the personalization of ads. If access or permission is not granted to TripleLift, TripleLift’s ability to pursue the above-mentioned purposes is limited.

Ad consumption data

• TripleLift collects ad consumption data:
  • to measure and report on the ads that were shown and how you interact with them;
  • to combine this information with other information previously collected about you, including from websites and apps you use; 
  • to infer personal aspects data;
  • to advertise to you and people who we think are similar to you. By way of example, TripleLift uses ad consumption data and our technology to predict products and services that we think will be of particular interest to you based on ads you’ve shown an interest in, such as by clicking on an ad – and also to predict which other people may be interested in similar products and services to you.
• TripleLift processes ad consumption data with your consent for the above purposes.** For the purpose of measuring reporting on advertising, TripleLift may alternatively rely on its legitimate interests or the legitimate interests of our partners.*
• The processing of ad consumption data is required for certain aspects of TripleLift’s service to function. If TripleLift does not have access to or does not have permission to process your ad consumption data, TripleLift’s ability to pursue the above-mentioned purposes is limited.

Inferred personal aspects data

• TripleLift processes inferred personal aspects data:
  • to personalize and serve advertisements to you and people who we think are similar to you. Please see the examples immediately above under ad consumption data and content consumption data.
• TripleLift processes inferred personal aspects data with your consent.** 
• The processing of inferred personal aspects data is required for certain aspects of TripleLift’s service to function. If TripleLift does not have access to or does not have permission to process your inferred personal aspects data, TripleLift’s ability to pursue the above-mentioned purposes is limited.

Ground-truth data

• We use ground-truth data:
  • to combine this information with other information collected about you; and
  • to advertise to you and people who we think are similar to you. Please see the examples immediately above under ad consumption data and content consumption data.
• TripleLift processes ground-truth data with your consent.**
• The processing of ground-truth data is required for certain aspects of TripleLift’s service to function. If TripleLift does not have access to or does not have permission to process your ground-truth data, TripleLift’s ability to pursue the above-mentioned purposes is limited.

Network and connection data

• We use network and connection data to communicate with your device over the internet using standard internet communications protocols such as TCP/IP and HTTP. This is necessary to pursue our legitimate interests of providing TripleLift’s service over the internet.**
• We also use network and connection data to provide our services in compliance with applicable law. For example, if we infer from your IP address that you are located in the European Union, we know to process your personal data in accordance with EU law, and that for example California law is not applicable. This is necessary for compliance with legal obligations to which we are subject.**
• We use network and connection data for basic ads personalization, for example, if we infer from your IP address that you are  located in Spain we might select ads designed for the Spanish market or ads in Spanish. We do this basic ads personalization either with your consent, or because it is necessary to pursue our legitimate interest in basic ads personalization.**
• The processing of your network and connection data is required for TripleLift’s service to function, because we need it to send information to you over the internet to show you ads. It is also required because we need to infer your country or state-level location to comply with applicable laws. If you do not make your network and connection data available to us, TripleLift cannot provide its services.

Precise location data

• TripleLift processes precise location data to:
  • solicit bids from demand partners to purchase advertising space to advertise to you. By way of example, where a supply partner has your consent, they may choose to send location data to TripleLift in order to help sell ads on their app that has location functionality, and in turn TripleLift may pass that to demand partners as intended by the supply partner. 
• TripleLift processes precise location data with your consent.**
• The processing of precise location data is optional. If TripleLift does not have access to or does not have permission to process your precise location data, TripleLift’s ability to pursue the above-mentioned purposes is limited. In other words, TripleLift would not use your precise location data nor share it with demand partners).  

Consumer privacy preference data

• We use your consumer privacy preference data to create a record of your privacy preferences, including where and how you expressed your privacy preferences. A record is used to inform how we use and share your data, and to inform demand partners of your privacy preferences. 
• In addition, we will use our record of your privacy preferences to enable us to demonstrate compliance with applicable law. This is necessary for us to comply with legal obligations to which we are subject.** 
• The processing of your consumer privacy preference data is required in order for us to honor your preferences.  

Secondary purposes of personal data processed

• We use any of the data described above for the secondary purposes:
  • of detecting, preventing or otherwise addressing fraud, security, or technical issues, as well as to protect against harm to our rights, property, or safety, or that of the public. This is necessary for us to pursue our, our partners’, legitimate interest in preventing fraud.**
  • of innovating, for example by creating new or improving existing features, functionalities, products, or services. This is necessary for us to pursue our, and our partners’ legitimate interests in creating new or improving existing features, functionalities, products, or services.
  • in connection with legal claims. This is necessary for us to pursue our legitimate interests in defending or pursuing legal claims.**
  • in connection with compliance, regulatory, or investigative purposes. This is necessary for us to comply with legal obligations to which we are subject.** 

How is this information disclosed? 

TripleLift discloses personal data it processes to the following categories of third parties: 

• Our affiliates: We share information with our affiliated companies, which means companies within our corporate family, and they are also subject to this policy.
• New owners: We may transfer information in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change.
• Our vendors and service providers: We use a variety of vendors and service providers as part of, and for the purposes of, providing our Platform. These include cloud storage and cloud computing services such as Amazon’s AWS on which the personal data we process is stored, or anti-fraud and security vendors. These vendors and service providers are subject to contractual, including security and confidentiality, restrictions to ensure their processing of the data is consistent with this notice.
• Supply partners (and their service providers): We sometimes give our supply partners records and reports related to their use of our Platform.
• Demand partners (and their service providers): Demand partners are advertisers, their agencies, and other buyers of ads that use our Platform in order to purchase ad space from supply partners working with us. To facilitate these ad transactions, we transmit personal data to demand partners as described in this privacy notice so that they have information about the ad unit to be filled, can choose whether to bid for the ad space and how much, and can analyze their advertising spending on our Platform.
• Recipients designated by law: We may also disclose Platform Data in the event that we reasonably suspect malicious or fraudulent activity, or when we reasonably believe it is required by law, subpoena or other legal process (including to meet security or law enforcement requirements, as well as to honor user access rights, as applicable).
• Aggregated or anonymized data: We may share, even publicly, Platform Data that has been aggregated, anonymized, or otherwise obfuscated such that it cannot reasonably be linked to you, or your browser or device. 

Also note that in the ads we help deliver there may be tags, pixels, cookies, or other technology that enables other parties to collect data. Often, these are vendors working on behalf of the demand partner to measure ad performance or prevent ad fraud or other purposes. This policy does not apply to those parties, and TripleLift is not responsible for their collection or use of information.

For more information see our List of of Processors, Partners and Other Third Parties. Supply partners and demand partners that work with TripleLift may use Google’s services, as described in Google’s Privacy & Terms website on how it uses information from sites or apps that use its services.

How long do we retain information?

Online identifiers

• TripleLift retains online identifiers for up to 90 days calculated from the last time it collected data associated with the online identifier. For information about cookie identifiers also see TripleLift’s cookie notice.

Content consumption data

• TripleLift retains content consumption data for up to 45 days.

Ad consumption data

• TripleLift retains ad consumption data for up to 45 days.

Inferred personal aspects data

• TripleLift retains inferred personal aspects data for up to 52 days.

Ground-truth data

• TripleLift retains ground-truth data for as long as it retains the online identifier associated with it.

Network and Connection Data

• TripleLift retains network and connection data for up to 45 days.

Precise location data

• TripleLift retains precise location data for up to 24 hours.

Consumer Privacy Preference Data

• We retain consumer privacy preference data for as long as we process personal information related to which you expressed your privacy preferences.

Exceptions

• We may retain personal data for longer than the general retention periods described above if necessary for detecting, preventing or otherwise addressing fraud, or security, as well as to protect against harm to our rights, property, or safety, that of our users, or the public, and defending or pursuing legal claims, in litigation, or if we have a legal obligation to retain the data longer.

Your rights

You have the rights to review, update, correct, access, obtain a copy of, port or delete the information TripleLift processes related to you . You also have a right to restrict or limit the ways in which your information is processed, and the right to object to the processing of your personal data in certain circumstances. Depending on where you reside, you have the right to designate someone to submit a request on your behalf as your authorized agent and appeal a decision denying your request by contacting us using the information provided below. You can find information regarding submitting a request and details regarding our process for responding to requests on the user rights and opt out page. 

If we process your information based on our legitimate interests or those of a third party you have the right to object to this processing, and we will cease processing your information, unless the processing is based on overriding legitimate grounds. 

When we process personal data based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw your consent, return to the place where you granted your consent to change your privacy preferences.

If you are in the European Economic Area, the United Kingdom, Switzerland, or Canada you have the right to lodge a complaint with your local supervisory authority.

If you are in Australia, you have the right to complain to TripleLift about a breach of the Australian Privacy Principles by using the contact details provided in the “Contact” section of this privacy notice. TripleLift will review your complaint and respond to you.

TripleLift gives you the option to opt out of TripleLift processing of your personal data. When you opt out TripleLift stores an opt out cookie in your browser or otherwise attempts to remember your choice, and we will not collect and share personal information related to you for targeted behavioral advertising purposes. 

Targeted Behavioral Advertising

TripeLift allows our supply partners and demand partners to use our Platform and personal data as explained in the section ‘What does TripleLift do?’ for activities that may be considered targeted advertising or cross-context behavioral advertising under certain US privacy laws. You have the option to opt out of receiving ads that are personalized by our clients and partners using our technology by using the opt-out tool below. When you opt out TripleLift stores an opt out cookie in your browser or otherwise attempts to remember your choice, and we will not collect and share personal information related to you for targeted behavioral advertising purposes 

TripleLift Cookie Opt-out

You can find additional information in the user rights and opt out page.

International Transfers

We operate a global business. All of your personal data described in this Privacy Notice is transferred internationally between our affiliate companies and our service providers to jurisdictions around the world including the European Union, the United States, the United Kingdom, Canada, and Singapore, where the privacy and data protection laws may be different than those in your jurisdiction. Similarly, our Platform services require us to transfer your personal data to demand partners in those jurisdictions. We use standard contractual clauses approved by the European Commission for data transfers from the European Economic Area and Switzerland –  and the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office for transfers from the UK – to jurisdictions for which there is not a decision by the European Commission finding that their privacy and data protection laws provide an adequate level of protection of personal data. If you have any questions regarding our Standard Contractual Clauses, you can contact us using the contact information below. 

Data Privacy Framework

TripleLift complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. TripleLift has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. TripleLift has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

TripleLift is accountable for information that it receives under the Data Privacy Framework and subsequently transfers to a third party. Triple Lift may transfer personal information collected as described in this Privacy Notice. TripleLift may also transfer other information that meets the definition of “personal data” in the Data Privacy Framework to service providers and to its customers and partners, as described above. If we share personal data covered by the Data Privacy Framework with a third-party service provider that processes the data solely on our behalf, then we will be liable for that third party’s processing of such data in violation of the Data Privacy Framework Principles, unless we can prove that we are not responsible for the event giving rise to the damage.

Additionally, TripleLift may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. 

TripleLift commits to resolve complaints about our collection or use of your personal information under the Data Privacy Framework. Individuals who have inquiries or complaints under Data Privacy Framework should first contact TripleLift using a method described under “contact” below.

TripleLift has further committed to refer unresolved the Data Privacy Framework complaints to the EU Data Protection Authorities. If you do not receive timely acknowledgment of your complaint from us, or if we have not resolved your complaint, please visit the International Centre for Dispute Resolution by the American Arbitration Association for more information or to file a complaint. 

Under certain conditions, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. Click here to review your rights under the Data Privacy Framework.

The Federal Trade Commission has jurisdiction over TripleLift’s compliance with the Data Privacy Framework.

Consumers in California

The California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”) applies to the collection, use, and disclosure of “personal information” collected from California residents (as those terms are defined by the CCPA).

If you are a California resident, the CCPA requires us to disclose to you the following details regarding our collection, use, disclosure, sale, sharing, and retention of personal information:

• the categories of personal information we collected in the preceding 12 months
• the categories of sources from which we collect personal information
• our business and commercial purposes for collecting personal information
• the categories of personal information we shared or sold in the preceding 12 months
• the categories of third parties to whom personal information was shared or sold
• the specific business and commercial purposes for sharing or selling personal information
• whether we have actual knowledge that we sell or share personal information of consumers under the age of 16
• the categories of personal information disclosed for a business purpose to third parties in the preceding 12 months
• the categories of third parties to whom personal information was disclosed for a business purpose; and
• whether we use or disclose sensitive personal information for purposes that require an opt out under the CCPA

We have provided these disclosures in this Privacy Notice, and below are additional details.

Collection, use, and disclosure of Personal Information

In the preceding twelve (12) months, the personal information that TripleLift has collected, which we describe in more detail above in the section ‘What information do we process?’, fall into the following categories under the CCPA:

• identifiers
• internet or other similar network activity
• geolocation data
• inferences drawn from other personal information
• the following potentially sensitive information
  • personal information that reveals a consumer’s precise geolocation

TripleLift collects the personal information listed above from a variety of sources including:

• collected directly by TripleLift when you access a digital service that uses our technology
• created by TripleLift using other available information
• received by TripleLift from supply partners or demand partners whose digital service you have accessed or whose ad you have been served
• received by TripleLift from data partners

Please see the ‘What information do we process?’ section of the Privacy Notice for more information about the sources of personal information we collect.

TripleLift collects the personal information listed above for the business and commercial purposes described above in section ‘What is the purpose and the legal basis of the processing?’.

In the preceding twelve (12) months, TripleLift has disclosed the following categories of personal information in a way that may be considered sharing or selling under the CCPA:  

• internet or other similar network activity
• geolocation data
• inferences drawn from other personal information
• the following potentially sensitive information
  • personal information that reveals a consumers precise geolocation

TripleLift may sell or share personal information to the following categories of third parties:

• demand partners
• supply partners
• measurement providers
• ID providers

TripleLift may sell or share the personal information listed above for the following business and commercial purposes :

• to uniquely identify your device
• ID syncing
• soliciting bids for advertising
• combining online identifiers with other data
• inferring personal aspects of data
• serving personalized ads to you or allowing others to serve personalized ads to you and people similar to you
• delivering information over the internet to serve ads to you

TripleLift does not knowingly sell or share personal information of consumers under the age of 16.

In the preceding 12 months, TripleLift disclosed for a business purpose the following categories of personal information to third parties:

• internet or other similar network activity
• geolocation data
• inferences drawn from other personal information
• the following potentially sensitive information
  • personal information that reveals a consumers precise geolocation

TripleLift has disclosed personal information for a business purpose to the following categories of third parties:

• demand partners
• supply partners
• measurement providers
• ID providers

TripleLift allows you to limit the use of the sensitive personal information we collect.

Your rights and choices under the CCPA

Under the CCPA, you may have the following rights:

• The right to know what personal information we collect about you, including the categories of personal information, the categories of sources from which the personal information is collected, our business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we discloses personal information, and the specific pieces of personal information we have collected about you.
• The right to delete personal information that we have collected from you, subject to certain exceptions.
• The right to correct inaccurate personal information that we maintain about you.
• When we allow the selling or sharing of personal information, the right to opt-out of the sale or sharing of your personal information.
• If we use or disclose sensitive personal information for reasons other than those permitted by the CCPA, the right to limit our use or disclosure of sensitive personal information.
• The right not to receive discriminatory treatment from us if you exercise privacy rights conferred by the CCPA, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their CCPA rights. 

If you want to exercise your right to know, delete, or correct your personal information that we collect, share, or sell, you or an authorized agent can submit a request using our US privacy request webform, or call TripleLift’s consumer hotline at 1-800-760-9122. To allow us to verify your identity, you may need to provide us with your online identifier and supporting proof. For more information regarding our process for responding to requests to know, delete, or correct your personal information, you can visit the user rights and opt out page.

If you want to request that we do not sell or share your personal information or to limit the way we process your sensitive information related to your web browser, you can do so by using the opt-out tool below. When you use our opt-out tool, we store an opt out cookie in your browser or otherwise attempt to remember your choice, and we will not sell or share your personal information or disclose your sensitive information except as permitted by the CCPA.

TripleLift Cookie Opt-out

You can exercise these rights related to your mobile device and internet connected device (e.g. a smart TV or a set-top box) by using the mechanisms available through the mobile device system software such as Apple iOS or Google Play Services or, if available, the internet connected device.  

If we receive an opt-out preference signal such as the Global Privacy Control, our systems will apply it based on the relevant interaction (e.g., if we receive it in the browser, it will be applied to your browser), and we will not disclose your personal information For additional information regarding how we process requests to opt out of sale and sharing or limit the use of sensitive personal information, visit the user rights and opt out page.

Authorized Agent 

You may designate someone else to submit a request on your behalf as your authorized agent. Your agent may need to provide supporting documentation to make the request on your behalf. For your protection, we may require you to verify your identity directly with us and confirm the request before we process it.

For information regarding our metrics related to consumer requests please visit the user rights and opt out page. 

Users below the age of 16

As of the effective date of this policy, we do not have actual knowledge of the ages of users of digital properties using our technology. We are not able to identify users that are under 16 years of age.

Changes to the Privacy Notice

Any information that we collect is subject to the Privacy Notice in effect at the time that information is collected. We may revise this Privacy Notice from time to time, so please check this page regularly for updates. If we make any material changes to this Privacy Notice, we’ll notify you of those changes by posting them clearly on our website and/or by sending you an email or other notification, where feasible, and we’ll indicate when such changes will become effective.

Contact

If you have any questions about this Privacy Notice, please let us know.

Persons in the United States, please contact:

Triple Lift, Inc.
53 W. 23rd Street, 12th Floor, New York, NY 10010 
Attn: Chief Privacy Officer
platformprivacy((at))triplelift((dot))com

Persons in the European Economic Area or Switzerland, please contact:

TripleLift (IRE) Limited
22 Northumberland Road, Ballsbridge, Dublin 4, Ireland D04ED73
Attn: Data Protection Officer
platformprivacy((at))triplelift((dot))com

Persons in the United Kingdom, please contact:

TripleLift UK Limited
5 The Crescent, Ashcombe House, Leatherhead, Surrey, United Kingdom KT22 8DY
Attn: Data Protection Officer
platformprivacy((at))triplelift((dot))com

Persons in Canada, please contact:

Triplelift Technologies, ULC

1055 Dunsmuir Street, Suite 3000, Vancouver, BC, V7X 1K8, Canada

Attn: Chief Privacy Officer

platformprivacy((at))triplelift((dot))com

Persons in Australia, please contact:

Triplelift Pty Ltd

Yarra Falls, 452 Johnston Street, Abbotsford, Victoria, 3067, Australia

Attn: Chief Privacy Officer

platformprivacy((at))triplelift((dot))com