GDPR Compliance

1. Our commitment

We maintain a Data Protection Officer function, run data protection impact assessments for high-risk processing, keep records of processing, apply privacy by design in platform development, and operate documented breach procedures. Accountability is treated as an engineering requirement, not paperwork.

2. Scope and applicability

This page applies to individuals in the EEA, UK and Switzerland whose data reaches us through our corporate website, the ad tech platform (SSP, network auction, ad serving, reporting console, fraud detection and brand safety), our sales and marketing, and partner onboarding.

3. Controller and processor roles

As controller we determine the purposes of processing for our own website, console accounts, marketing, fraud prevention and platform improvement. As processor we act only on client instructions under the DPA when serving advertising on client inventory. As joint controller, to the limited extent that we and a publisher jointly determine the initial collection and transmission of identifiers for the auction, Art. 26 arrangements allocate responsibilities; all further processing is ours alone under our own notice.

4. Lawful bases, Art. 6

• Consent, Art. 6(1)(a): the primary basis for personalised advertising, profiling and access to device identifiers and storage. Withdrawable at any time through the publisher's consent mechanism or our contact points.
• Contract, Art. 6(1)(b): console accounts, publisher and advertiser onboarding, billing and delivery of contracted services.
• Legitimate interests, Art. 6(1)(f): fraud prevention, security, frequency capping, ad delivery and honouring privacy choices. We document the balancing test and will share it on request.
• Legal obligation, Art. 6(1)(c): tax, accounting and lawful requests.

5. Personal data we process

Device identifiers and cookie IDs, mobile advertising IDs, IP addresses, hashed identifiers where a client supplies them, browsing and ad-interaction data, frequency profiles, approximate location, console contact and billing data. We do not process special category data under Art. 9 and contractually prohibit partners from passing it.

6. Data subject rights, Arts. 15 to 22

You may request access, rectification, erasure, restriction, portability and objection, and you have the right not to be subject to solely automated decisions with legal effect; we do not make such decisions. Consent can be withdrawn at any time, Art. 7(3), without affecting prior processing.

7. How to exercise rights

Write to [email protected] or [email protected]. We respond within one month, extendable by two further months for complex requests, verify identity where necessary, and act free of charge unless a request is excessive. Requests that concern advertising on a specific publisher's property may be routed through that publisher, and we will support them either way.

8. Consent management

Where required, consent must be freely given, specific, informed and easy to withdraw, and we treat it as an engineering input: our tags honour the signals publishers' consent management platforms pass, including IAB Transparency and Consent Framework strings. No signal means no personalised advertising; contextual delivery continues.

9. Joint controllership with publishers

For the limited joint determination described in section 3, our arrangements with publishers cover responsibility allocation, the information provided to data subjects, cooperation with authorities and the handling of rights requests, per Art. 26.

10. International transfers

We process from the United States and serve four regions. Transfers outside the EEA, UK and Switzerland rely on Chapter V safeguards: the European Commission's Standard Contractual Clauses 2021/914, the UK International Data Transfer Addendum, adequacy decisions where available, and supplementary measures including pseudonymisation and encryption in transit and at rest. We assess transfer impacts when onboarding new sub-processors and can provide a copy of the safeguard we rely on.

11. Sub-processors

Hosting, storage, support and measurement functions are performed by vetted sub-processors under contract. The current list is available on request; clients receive prior notice of changes and may object on reasonable grounds under the DPA.

12. Data Protection Officer

Our DPO advises on compliance, monitors our processing, advises on impact assessments and is the contact point for supervisory authorities and data subjects, per Arts. 37 to 39. Contact: [email protected], or by mail: OnlyMedia, Attn: DPO, 420 W 19th, Cheyenne, WY 82001, United States.

13. Data protection impact assessments

Where processing is likely to result in high risk, including large-scale ad-data processing or new technologies, we assess it under Art. 35, consult the DPO, and where required consult the supervisory authority under Art. 36.

14. Breach notification

Confirmed personal data breaches are notified to the competent supervisory authority within 72 hours, Art. 33, and to affected individuals where the risk is high, Art. 34. When we act as processor, we notify the affected controller without undue delay and assist with their notifications. We keep an internal register of incidents regardless of severity.

15. Data retention

Storage limitation under Art. 5 applies throughout: request-level ad data is kept no longer than 13 months, website analytics no longer than 26 months, and billing records per statutory periods. Details sit in Privacy Policy section 14.

16. Security measures

Art. 32 measures include pseudonymisation, encryption in transit and at rest, resilience and backup, regular testing of effectiveness, multi-factor and role-based access control, network monitoring and intrusion detection, staff training and physical security.

17. IAB Transparency and Consent Framework

We honour TCF consent strings across the supply chain so that the consent a user gives on a publisher's property travels with the bid request, and we respect the purposes and scopes that string carries.

18. Right to lodge a complaint

You may complain to your local supervisory authority, per Arts. 77 to 79: EEA authorities are listed through the European Data Protection Board, the UK regulator is the Information Commissioner's Office at ico.org.uk or +44 303 123 1113, and the Swiss authority is the FDPIC. We would appreciate the chance to resolve your concern first, through [email protected].

19. Contact us

DPO: [email protected]. Privacy team: [email protected]. Legal department: [email protected]. General: [email protected]. Mail: OnlyMedia, Attn: DPO, 420 W 19th, Cheyenne, WY 82001, United States.