GDPR Compliance & Consent Management

1. Our Commitment to GDPR Compliance

YieldMaximizer operates advertising technology that reaches people in the European Economic Area (EEA), the United Kingdom, and Switzerland. We are committed to complying with the General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), and the Swiss Federal Act on Data Protection (FADP). This page describes the program we maintain to meet those obligations and the choices available to the individuals whose data we process.

Our compliance program is built on standing practices that include:

• An appointed Data Protection Officer who monitors our compliance, advises on risk, and serves as the contact point for supervisory authorities and individuals.
• Data protection impact assessments carried out before we begin processing that is likely to result in a high risk to individual rights.
• Records of our processing activities maintained under Article 30 of the GDPR.
• Privacy by design and privacy by default principles applied when we build new products and evaluate new partners and vendors.
• Documented internal procedures for detecting, investigating, and reporting personal data breaches.

2. Scope and Applicability

This page applies to:

• Our websites and the web properties we operate.
• Our advertising technology services, including our supply-side platform (SSP), ad network, header bidding infrastructure, campaign analytics, invalid traffic and fraud detection, and brand safety capabilities.
• Our sales and marketing activities directed at individuals in the EEA, the United Kingdom, and Switzerland.

This page supplements, and does not replace, our Privacy Policy. Read it together with the Privacy Policy, which explains how we collect and use personal data across our business, and our Cookie Policy, which explains the cookies and similar technologies we use. Where this page provides more detail about our GDPR obligations, our consent practices, or the rights of individuals in the EEA, the United Kingdom, or Switzerland, this page governs.

If you live in California or another U.S. state, your rights and the opt-out choices available to you, including the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information, are described in the U.S. state privacy rights sections of our Privacy Policy.

3. Our Role: Controller vs. Processor

The GDPR distinguishes between a controller, which decides why and how personal data is processed, and a processor, which acts on a controller's instructions. YieldMaximizer acts in each capacity depending on the activity.

When We Are a Controller

We act as a controller for processing we carry out for our own purposes, including operating our website, delivering and measuring advertising on our own network, detecting and preventing invalid traffic and fraud across our platform, and our direct sales and marketing. For this processing we are responsible for providing transparency, choosing a lawful basis, and responding to rights requests.

When We Are a Processor

When we process personal data on behalf of a client under a written contract, we act as a processor and follow that client's documented instructions. Our Data Processing Agreement governs that relationship, including the security commitments, sub-processor controls, audit rights, and deletion obligations that apply to our services.

When We Act as a Joint Controller

For the initial collection of online identifiers used to request and deliver advertising on publisher properties, we consider ourselves and the publisher to be joint controllers within a limited scope. Section 9 describes the arrangement we maintain with publishers for that processing.

4. Lawful Basis for Processing

Article 6 of the GDPR requires a lawful basis for every processing activity. The following bases apply to our processing.

Consent (Article 6(1)(a))

We rely on consent for personalized advertising and audience profiling directed at individuals in the EEA, the United Kingdom, and Switzerland, for storing and reading information on user devices where the ePrivacy rules require consent, and for marketing communications where an individual has not otherwise interacted with us. Consent is collected through consent management platforms, and Section 8 describes the standards those platforms must meet and how you can withdraw consent at any time.

Performance of a Contract (Article 6(1)(b))

We rely on contractual necessity to provide services that individuals or clients have requested, such as operating an account, delivering campaign reporting, and carrying out agreed services.

Compliance with a Legal Obligation (Article 6(1)(c))

We process personal data where required by law, for example to meet tax and accounting obligations or to respond to valid legal requests and court orders.

Legitimate Interests (Article 6(1)(f))

We rely on legitimate interests, after a documented balancing test that weighs our interests against the rights and freedoms of individuals, for preventing fraud and invalid traffic, securing our platform and investigating abuse, frequency capping so that individuals are not overexposed to the same advertisement, delivering and measuring contextual advertising, and improving our services. If you object to processing based on legitimate interests, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, and we will tell you our reasons.

5. Personal Data We Process

The personal data we process in connection with the activities described on this page typically includes:

• Device and online identifiers, such as cookie identifiers, mobile advertising identifiers, device identifiers, IP addresses, and hashed email addresses.
• Browsing and behavioral data, such as pages viewed, content categories, ad impressions, clicks, viewability measurements, and the timing of those events.
• Location data, usually approximate and derived from an IP address, such as country, region, or city.
• Contact data, such as name, email address, and organization, provided by clients, prospective clients, and people who contact us.
• Billing data for clients, such as invoicing and payment information.

We do not knowingly process special categories of personal data under Article 9 of the GDPR, such as data revealing racial or ethnic origin, political opinions, religious beliefs, health information, or sexual orientation, for advertising purposes. Our contracts prohibit partners from transmitting special category data to us, and our audience categories are not built on sensitive grounds. If you believe we have received special category data about you, contact our Data Protection Officer so we can investigate and remove it.

6. Your Rights Under the GDPR

Individuals located in the EEA, the United Kingdom, and Switzerland have the following rights over their personal data:

Section 7 explains how to exercise these rights and what to expect from us.

7. How to Exercise Your Rights

To exercise any of the rights described in Section 6, you can:

• Email our Data Protection Officer at [email protected].
• Email our privacy team at [email protected].
• Send a message through our contact page.
• Write to the Data Protection Officer at the mailing address in Section 13.

We respond without undue delay and within one month of receiving a request. Where a request is complex or you submit several requests, we may extend this period by up to two months, and where we do we will inform you within the first month and explain why.

We may ask you for information to verify your identity, but only what is necessary to locate your data and confirm that you are the person entitled to the request. We do not charge a fee. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee for the administrative cost of responding or decline to act, and in either case we will explain our reasons. If you are unhappy with how we handled your request, you can complain to a supervisory authority as described in Section 19.

For rights available under U.S. state privacy laws, including California, see the U.S. state privacy rights sections of our Privacy Policy.

8. Consent Management

Where our processing is based on consent, that consent must satisfy the standards of Articles 4(11) and 7 of the GDPR. In practice this means:

• Consent must be freely given, specific, informed, and unambiguous.
• Consent must be a clear affirmative action, such as selecting a setting. We do not treat silence, inactivity, or pre-selected boxes as consent.
• Requests for consent must be separate from other terms and conditions, and access to a service must not be unfairly conditioned on consenting to processing that is not necessary for it.
• It must be as easy to withdraw consent as it was to give it, and withdrawal takes effect for future processing.

Consent on Publisher Properties

Most of the advertising inventory we process appears on websites and apps operated by publishers. The publisher decides which consent management platform (CMP) to use and presents the consent interface to its visitors. We rely on the consent signals those CMPs produce and process data only where the applicable signal permits it. To change choices you made on a publisher property, you can usually reopen that publisher's consent interface from a link in its footer, or follow the steps described in our Cookie Policy.

Consent on Our Own Properties

On our own websites we use a CMP that presents granular choices by purpose, records your decision with a timestamp, and lets you revisit and change your choices at any time through a persistent link.

9. Joint Controllership

Article 26 of the GDPR requires joint controllers to set out, in a transparent arrangement, their respective responsibilities for complying with the GDPR. YieldMaximizer and our publisher partners act as joint controllers for a limited purpose: the initial collection of online identifiers and the disclosure of those identifiers to advertising buyers as part of a bid request for advertising that funds the publisher's content.

Our arrangements with publishers allocate responsibility as follows:

• The publisher is generally responsible for presenting privacy notices, collecting consent or objection signals from visitors through its CMP, and handling the parts of a rights request that concern its own content and services.
• YieldMaximizer is responsible for honoring the signals it receives, for transparency about its own processing as described on this page and in our Privacy Policy, for its security and retention practices, and for handling requests about its own processing of identifiers.
• The parties cooperate in responding to data subject requests and in consultations with supervisory authorities.

The arrangement does not limit your rights. You may exercise your GDPR rights against either controller, and neither controller may rely on the arrangement as a reason to refuse or redirect your request.

10. International Data Transfers

YieldMaximizer is headquartered in the United States, with offices in the United Kingdom and Singapore, and we work with service providers in several other countries. Personal data we collect in the EEA, the United Kingdom, or Switzerland may therefore be transferred to countries that the European Commission, the UK government, or the Swiss authorities have not deemed adequate. When we transfer personal data out of these regions, we rely on one or more of the following safeguards:

• The European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
• The UK International Data Transfer Addendum to those clauses, or the UK International Data Transfer Agreement.
• The EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, as described in Section 11.
• An adequacy decision that covers the destination country, where one exists.
• Binding corporate rules, where they have been approved for the recipient group.

In limited, non-repetitive situations described in Article 49 of the GDPR, such as processing necessary to perform a contract with the individual, we may rely on a derogation instead. Before relying on contractual clauses, we carry out transfer impact assessments that consider the laws and practices of the destination country, and we apply supplementary technical and organizational measures where needed. You can request a copy of the safeguards we rely on by writing to our Data Protection Officer using the contact details in Section 13.

11. Data Privacy Framework

YieldMaximizer has self-certified to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, and we adhere to the Framework Principles when we receive personal data from the European Union, the United Kingdom, and Switzerland. The Frameworks are administered by the U.S. Department of Commerce, and our adherence is enforceable by the U.S. Federal Trade Commission.

We follow the Framework Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability. Where there is any conflict between this page and the Framework Principles, the Principles prevail for personal data received under the Frameworks. Individuals who believe we have not complied with our Framework commitments can raise the concern with our Data Protection Officer and, if it remains unresolved, through the independent recourse mechanism listed on the Data Privacy Framework website.

12. Sub-Processors

We engage sub-processors to support our services, including cloud infrastructure and hosting providers, analytics providers, fraud prevention services, and customer support systems. Our commitments covering sub-processors are:

• We maintain a list of approved sub-processors and make the current list available on request.
• We vet each sub-processor before engagement for its security and privacy practices and bind it to written data protection obligations.
• We give clients prior written notice before adding or replacing a sub-processor.
• Clients may object to a new sub-processor on reasonable data protection grounds, and we will work with them in good faith toward a resolution, including adjusting services or, where no resolution is possible, allowing the client to end the affected services.
• We remain responsible for the performance of our sub-processors with respect to the personal data they process for us.

13. Data Protection Officer

YieldMaximizer has appointed a Data Protection Officer (DPO) under Articles 37 to 39 of the GDPR. The DPO informs and advises us on our data protection obligations, monitors our compliance, advises on data protection impact assessments, and cooperates with, and acts as the contact point for, supervisory authorities and individuals. The DPO reports to the highest level of management and performs the role independently, without instructions on how to exercise it.

14. Data Protection Impact Assessments

A data protection impact assessment (DPIA) is required under Article 35 where processing is likely to result in a high risk to the rights and freedoms of individuals. Because our platform processes data at scale, we evaluate our processing against DPIA triggers, including:

• Large-scale processing of behavioral data for advertising delivery and measurement.
• Systematic monitoring that involves tracking the activity of individuals across websites and apps.
• Profiling used to determine which advertising an individual receives.
• Use of new technologies in our processing.

Where an assessment is required, we describe the processing operations and purposes, assess the necessity and proportionality of the processing, evaluate the risks to individuals, and identify measures to reduce those risks. Our DPO advises on each assessment. Where an assessment leaves a high residual risk that cannot be reduced, we consult the competent supervisory authority under Article 36 before proceeding. We also assist our clients with their own impact assessments, as described in our Data Processing Agreement.

15. Data Breach Notification

We maintain procedures to detect, investigate, record, and report personal data breaches. Our approach reflects Articles 33 and 34 of the GDPR:

• Notification to supervisory authorities. Where a breach is likely to result in a risk to individuals, we notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk.
• Notification to individuals. Where a breach is likely to result in a high risk to individuals, we inform the affected individuals without undue delay, in clear and plain language, describing what happened and what we are doing about it.
• Our role as processor. Where the affected data is processed for a client, we notify that client without undue delay and give it the information it needs to meet its own notification duties.
• Breach register. We document every personal data breach, including its facts, its effects, and the remedial action taken, so that the supervisory authority can verify our compliance with Article 33.

16. Data Retention

Articles 5(1)(c) and 5(1)(e) of the GDPR require that personal data be adequate, relevant, limited to what is necessary, and kept no longer than necessary for the purposes for which it is processed. We apply these principles by:

• Collecting only the categories of data described in Section 5 for the purposes described in Section 4.
• Setting retention periods that reflect the purpose, for example short retention for raw advertising event data and longer retention for consent records we must keep to demonstrate compliance.
• Reviewing our retention schedules on a regular basis and whenever our processing changes.
• Securely deleting or anonymizing personal data when the retention period ends.

Detailed retention periods by data category appear in our Privacy Policy.

17. Security Measures

Article 32 of the GDPR requires technical and organizational measures appropriate to the risk, including measures to pseudonymize and encrypt personal data and to ensure the confidentiality, integrity, availability, and resilience of processing systems. Our security program includes:

• Encryption of personal data in transit over public networks and at rest in our systems.
• Pseudonymization of identifiers where the processing does not require direct identification.
• Role-based access controls, least privilege, and multi-factor authentication for systems that hold personal data.
• Network protections including firewalls, segmentation, and intrusion detection.
• Logging and monitoring of systems for unusual activity.
• Resilience measures, backups, and tested recovery procedures to restore availability after an incident.
• Regular vulnerability scanning, penetration testing, and follow-up on the findings.
• Security training and confidentiality commitments for personnel.
• Physical security controls at our facilities and those of our infrastructure providers.
• Periodic audits and third-party assurance reviews of our controls.

18. IAB Transparency and Consent Framework

YieldMaximizer participates in the IAB Europe Transparency and Consent Framework (TCF). The TCF is an industry program that standardizes how consent and objection signals are encoded, stored, and passed among publishers, consent management platforms, and advertising technology providers.

When a TCF-compliant CMP produces a TC string that includes our registered vendor identifier, we process personal data for the purposes and under the conditions that the string permits, and we pass the string along the supply chain when we share bid requests or similar signals. Where there is no valid TC string covering a purpose that requires consent, we do not process personal data for that purpose. You can change your choices through any TCF-compliant CMP, including the one used by the publisher property you are visiting, as described in our Cookie Policy.

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, in the United Kingdom with the Information Commissioner's Office (ICO), or in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC). The European Data Protection Board maintains a list of national supervisory authorities on its website.

You also have the right to an effective judicial remedy under Articles 78 and 79 of the GDPR and to compensation for damage under Article 82 where you have suffered material or non-material damage as a result of an infringement of the GDPR.

We would welcome the chance to resolve your concern before you escalate it, and contacting us does not reduce your rights or the time available to complain to an authority or court.

20. Contact Us

For questions about this page, our GDPR compliance, or our consent practices, you can reach us through any of these channels:

Our Offices

• San Francisco (Headquarters): YieldMaximizer, Inc., 517 California Street, Suite 4800, San Francisco, CA 94104, USA
• New York: 374 Park Avenue, Suite 2607, New York, NY 10152, USA
• London: 22 Bishopsgate, Level 34, London EC2N 4BQ, United Kingdom
• Singapore: Marina Bay Financial Centre, 8 Marina Boulevard, #05-02, Singapore 018981