Effective Date: January 1, 2023
Notice to California Residents [Consumers] – California Consumer Privacy Protection Act
The California Consumer Privacy Act of 2018 and subsequent amendments thereto (“CCPA”) provide certain rights to residents of California. This section of Smaato Inc.’s (“Smaato,” “we,” “our” or “us”) Privacy Policy applies if you are a natural person who is a resident of California (“California Consumer” or “Consumer”) in your capacity as a business partner of Smaato and using the Smaato Demand Platform (“SDX”), the Smaato Publisher Platform (“SPX”) or the Smaato website, or you are an end-user (“End-User”) of third-party mobile applications (“apps”) that use our Software Development Kit (“SDK”) or other collection interfaces (collectively, “APIs”), (collectively, the “Smaato Ad Services”). This California Privacy Notice supplements the information in our Privacy Policy. However, this Privacy Notice is intended solely for, and is applicable only as to, California Consumers: if you are not a California Consumer (or a resident of California), this does not apply to you and you should not rely on it. The terms used in this Privacy Notice have the meaning given to them in the CCPA and its implementing regulations.
In the below tables and sections, we describe (as required by the CCPA):
Depending on how you interact with us, we may collect about you the categories of information summarized below. We also describe the categories of sources from which we may have obtained such personal information.
| Categories of Personal Information | Categories of Sources of Data Collection |
|---|---|
Identifiers, e.g., real name; office address; email address; phone number; customer number; user alias; online identifiers; pixel tags; IP address; mobile advertising identifiers; user IDs; app identifier |
From publishers of mobile apps or websites, advertising networks, internet service providers, data analytics providers and data compilers, operating systems or mobile devices, connected TVs and social networks (LinkedIn and Xing business accounts) or provided by yourself in your capacity as a business partner of Smaato. |
Categories of personal information described in Cal. Civ. Code § 1798.80(e). e.g., signature; telephone number; financial information; including financial or bank account numbers (only of business partners of Smaato) |
From data compilers, social networks (LinkedIn and Xing business accounts), or provided by yourself in your capacity as a business partner of Smaato. |
Characteristics of protected classifications under California or US law Sex/gender; age (only of End-Users of Smaato Ad Services) |
From publishers of mobile apps or websites, advertising networks. |
Internet or other electronic network activity information E.g., online interests, such as information about categories of an End-Users interests derived from online or app usage; information on an End-User’s interaction with a website, application, or advertisement (whether there was a view, click or other kind of interaction with the advertisement); mobile carrier; date and time of connection; WIFI Access point ID to which a device is connected; network provider or internet service provider; device model; operating system (e.g. Android, iOS); browser details; language settings; time zone; app or site name or version of the app; SDK version ; advertising and content type shown to an End-User (e.g. a video ad for a mobile game) |
From publishers of mobile apps or websites, advertising networks, Smaato’s website, data analytics providers and data compilers, operating systems or mobile devices, connected TVs. |
Geolocation data IP address; geo-location or precise location of End-Users devices if they have given the app or site they are using permission to collect this location information; location information inferred based on data collected through a WIFI identifier with which an End-Users device is connected to. (only of End-Users of Smaato Ad Services) |
From publishers of mobile apps or websites, advertising networks, data analytics providers and data compilers, operating systems or mobile devices, connected TVs. |
Professional or employment-related information current or past job title (only of business partners of Smaato) |
From data compilers, social networks (LinkedIn and Xing business accounts), or provided by yourself in your capacity as a business partner of Smaato. |
We may share the information collected from and about you as described above for various business purposes as explained in section 3 of this Privacy Notice, with service providers and with third parties including our business partners. The table below shows which categories of personal information we share or disclose to whom. Please note that we do not “sell” personal information of minors we know to be under 16 years of age, and we further do not generally “sell” personal information: however, ad platforms, clients and publishers that we work with may use our technology to “sell” personal information as defined by California law. If you wish to opt out of the use of your personal information for interest-based advertising purposes, you may do so by following the instructions in Section 4, below.
Note that because these opt outs are specific to the device (or in the case of web-based advertising, the browser) on which they are exercised, you will need to opt out on each device (or browser).
| Categories of Personal Information | Categories of Third Parties We Share Personal Information With |
|---|---|
| Identifiers | Advertising networks (e.g., demand-side platforms, agency trading platforms), agencies and advertisers. Data analytics providers and data management platforms. |
| Characteristics of protected classifications under California or US law. | Advertising networks (e.g., demand-side platforms, agency trading platforms), agencies and advertisers. |
| Internet or other electronic network activity information. | Advertising networks (e.g., demand-side platforms, agency trading platforms), agencies and advertisers. |
| Geolocation data | Advertising networks (e.g., demand-side platforms, agency trading platforms), agencies and advertisers. |
We also may share any of the personal information we collect as follows:
Sharing for Legal Purposes: We may share personal information with third parties in order to: (a) comply with a legal process or a regulatory investigation (e.g. a subpoena or court order); (b) enforce our Terms of Service, this Privacy Notice, or other contracts with our business partners, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; and/or (d) protect the rights, property or personal safety of us, our platform, our business partners, our agents and affiliates, its users and/or the public. We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, and spam/malware prevention, and similar purposes.
Sharing In the Event of a Corporate Transaction: We may also share personal information in the event of a corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, for purposes of due diligence connected with any such transaction or transition of service to another provider. In such cases, your personal information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.
Sharing With Service Providers: We share any personal information we collect with our service providers, which may include (for instance) providers involved in technical or customer support, operations including fraud detection, web or data hosting, billing, accounting, auditing, legal consultancy, security, marketing, data management, validation, or otherwise assisting us to provide, develop, maintain and improve Smaato Ad Services.
Sharing of Aggregate Information: We may aggregate and/or de-identify any information collected so that such information can no longer be linked to and end-user of a device or such a device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors, in our discretion.
Generally speaking, we use and share the personal information that we collect for the following purposes, as we also have described in our Privacy Policy, in the section titled “Personal Information That We Collect and Use”.
| Our Purposes for collecting, using and sharing Personal Information |
|---|
Online advertising and targeting, for example: Assisting advertisers and the platforms that they access to deliver advertising to send, tailor, optimize and analyze advertising, in mobile apps and across other advertising channels and platforms. Generally, we do this by connecting demand side platforms (and sometimes advertisers or agencies) with publishers of e.g. mobile apps, to enable advertisers to send a variety of advertising (which may be contextual, interest-based, or based on other factors such as the location of the End-User or device) to display on an End-Users device. |
Additional marketing and analytics services, for example (which may overlap with “Online advertising and targeting,” above): Advertising Reporting and Conversion Tracking: Reporting to demand-side clients information about when and how an End-User has been exposed to their ads or clicked on their ads, and reporting to our supply-side clients the information about when and how ads were shown on their digital properties and were clicked on, including to optimize the manner in which a demand-side client selects or optimizes advertising inventory or targets advertising. Frequency Capping: Preventing from serving the same advertisement or type of ad too many times to one End-User. In addition, for own our corporate purposes, we sometimes use personal contact information such as name or email address to contact businesses that we believe may benefit from using Smaato Ad Services. |
Operating Smaato Ad Services, for example:
|
Other internal purposes, for example: For internal research, internal operations, auditing, detecting security incidents, debugging, short-term and transient use, quality control, and legal compliance. We use the information collected from our own website, from social networks, from other “business to business” interaction (such as at trade shows and fairs) or from data compilers for the above, as well as for our own marketing and other internal business purposes. |
Without being discriminated against for exercising these rights, California residents have the right to request that we disclose what personal information we collect from you, to delete that information, and to opt-out of the sale of your personal information, subject to certain restrictions. You also have the right to designate an agent to exercise these rights on your behalf. This section describes how to exercise those rights and our process for handling those requests, to the extent Smaato acts as a “business” (as opposed to a “service provider”) for purposes of handling personal information. (To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.)
California residents may opt-out of the “sale” of their personal information. California law broadly defines what constitutes a “sale” – including in the definition making available a wide variety of information in exchange for “valuable consideration.”
We generally act as a “service provider” under the CCPA, for instance, to permit digital apps and properties to monetize their advertising inventory (which in many cases permits them to offer games, media and applications free of charge to the public). However, other ad platforms, clients and publishers that we work with may use our technology to “sell” personal information as defined by California law. If you wish to opt out of the use of your personal information for interest-based advertising purposes, you may do so by following the instructions here. Note that because these opt outs are specific to the device (or in the case of web-based advertising, the browser) on which they are exercised, you will need to opt out on each device (or browser).
You may also request that we delete any personal information that we have collected directly from you, such as if you have been a business partner of ours. (Note that this is different from your right to “opt-out” of the sale of your personal information; also note that we do not generally collect personal information directly from End-Users or “Consumers”, in which case “deletion” rights generally do not apply.) However, we may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as de-bugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, (f) for our own internal purposes reasonably related to your relationship with us, or to comply with legal obligations. Additionally, we need certain types of information so that we can provide our Smaato Ad Services to you. If you ask us to delete it, you may no longer be able to access or use our Smaato Ad Services.
California residents also have the right to request that we disclose what categories of your personal information we collect, use, or sell. As a California resident, you may request access to the specific pieces of personal information that we have collected from you.
California residents may learn more how to exercise these rights of information access by sending an email to datarights(at)smaato.com or submitting a request to our online web form or by calling toll free at 1-866-I-OPT-OUT [tel:18664678688] and entering Service Code 255. We will only use the information you submit to respond to your request, and we may need to identify you and your state of residence before we can respond.
However, we may withhold some personal information where the risk to you or our business is too great to disclose the information, or where we cannot verify your identity in relation to such personal information. Thus, for security purposes (and as required under California law), we will verify your identity – in part by requesting certain information from you — when you request to exercise certain of your California privacy rights. For instance, if you request categories or specific pieces of personal information we have received about you associated with a particular mobile ad identifier, you may need to confirm your possession of that identifier.
Once we have verified your identity, we will respond to your request as appropriate:
Where you have requested the categories of personal information that we have collected about you, we will provide a list of those categories.
Where you have requested specific pieces of personal information, we will provide the information you have requested, to the extent required under the CCPA and provided we do not believe there is an overriding privacy or security concern to doing so.
We encourage you to employ the industry tools listed in Section 4 of our Privacy Policy and on the NAI (Network Advertising Initiative) page addressing how Consumers may opt-out of cross-app advertising.
If we are unable to complete your requests fully for any of the reasons above, we will provide you with additional information about the reasons why we could not comply with your request.
Information for our supply-side business partners: If we act as your service provider under the CCPA, you may send us data rights requests of your users who exercised their rights to „opt out“ or to delete under the CCPA by using this form. Please ensure to only submit verified requests.
We do not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
We do not knowingly collect personal information from minors under 16 years of age in California unless we have received legal consent to do so. If we learn that personal information from such California residents has been collected, we will take reasonable steps to remove their information from our database (or to obtain legally required consent).
You may also designate an agent to make requests to exercise your rights under CCPA as described above. We will take steps to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.
Click here to download Smaato’s CCPA Privacy Notice in PDF form.