Effective Date: October 28, 2020
Smaato, Inc. (“Smaato,” “we,” “our,” or “us”) provides this privacy policy to explain how we collect, use, and share information. This privacy policy (“Policy”) covers Smaato’s handling of two types of information:
We encourage consumers to learn about how information (including information we collect) can be used to market to them, and how to exercise their choices to permit or limit such marketing. We describe ways consumers can exercise that choice or opt out of marketing in Section 4 below, titled “Consumer Control and Opt-Out Options.”
Smaato provides mobile advertising technology services that facilitate transactions among advertisers, app developers, publishers of mobile websites and/or apps, and ad exchanges (collectively, “Clients”), and service providers and other data partners (collectively “Partners”). We do this by making available the Smaato Ad Services and other tools to Clients. Clients use the Smaato Ad Services and other tools to deliver advertising to End Users, and we in turn provide our services to help Clients (and their own customers) to deliver ads that are of interest to End Users. We explain what SDKs and APIs are in Section 3 below, titled “Cookies, Pixel Tags, and SDKs,” which also explains how cookies and similar technologies (which we also use to provide the Smaato Ad Services) work.
Through the Smaato Ad Services, we may (but do not necessarily, or always) collect a variety of information about End Users (whether through our SDK or through other partnerships and tools such as Client-facing APIs), including:
We may combine and merge the various types of information collected from the Smaato Ad Services, and may also enhance it (or permit our Clients to enhance it) with information collected from third parties. We refer to all of the above information as the “Service Information.”
We use the Service Information to provide a variety of services to our Clients related to advertising and marketing, including services we may describe elsewhere on Smaato Websites. This includes use of the Service Information for purposes such as to:
We, or our Clients, may deploy online cookies to track End Users across mobile websites and/or apps, or to associate End Users and these cookies with Mobile IDs. We, or our Clients, may perform such functions to resolve End Users’ identities across mobile devices and to better or more accurately target relevant ads to End Users (such as to a brand’s customers). We may also append or combine certain elements of the Service Information to other information provided by third-party data providers, to learn more about End Users or to provide advertising and analytics services. You can learn more about cookies and similar technologies, such as web beacons and SDKs, in Section 3 below, titled “Cookies, Pixel Tags, and SDKs.”
Generally, we share the Service Information with Clients and Partners in order to provide the Smaato Ad Services. For example, we share the Service Information with:
Even when you no longer access our SDK, we may continue to use and share your information as described in this Policy.
The processes we described above often involve cookies or similar technologies, which may be associated with other information about End Users, such as End Users’ interests, demographics, or transactions. This is generally known as “interest-based advertising.” We encourage individuals who are interested in controlling or learning about this type of advertising to go to Section 4 below, titled “Consumer Control and Opt-Out Options,” or go to the Digital Advertising Alliance’s (DAA’s) website at www.aboutads.info.
We may also share Service Information with third parties:
Cookies are small data files containing a string of characters, such as unique browser identifiers. Cookies are stored on your computer or other device and act as unique tags that identify your browser. Our servers may deploy a cookie on your browser when you visit the Smaato Websites. Our Clients and Partners may do likewise on the Smaato Websites, our Clients’ and Partners’ websites, and elsewhere. Smaato may use both session cookies and persistent cookies. Persistent cookies, unlike session cookies, remain after you close your browser, and may be used by your browser on subsequent visits to any given website. Using persistent cookies, a site operator (or a third party they work with) can “remember” what you have previously done on a website and personalize the site, or ads you see, for you. This technology may also provide a site operator or third party (or us, when you visit the Smaato Websites) with information regarding your IP address, browser type, the web pages that you visit just before or after visiting a website, the web pages viewed, and the dates and times of your visits.
A pixel tag (also commonly known as a web beacon or clear GIF) is an invisible 1 x 1 pixel that is placed on certain web pages. When you access a web page with a pixel tag, the pixel tag may generate a generic notice of the visit, and permit us, or our Clients or Partners, to set or read cookies. Pixel tags are used in combination with cookies to track the activity on a website by a particular browser on a particular device. If you disable cookies, pixel tags simply detect a given website visit.
We, alone or with our Clients and Partners, may use cookies to, for example, “remember” you, track trends, and collect information about how you use our Clients’ or Partners’ websites or interact with advertising. We, and our Clients and Partners, use cookies to provide relevant content to you and replace non-relevant ads with ads that better match your interests. If you wish to opt out of interest-based mobile advertising, please see Section 4 below, titled “Consumer Control and Opt-Out Options.” Please note that disabling cookies may prevent you from accessing some of the Smaato Websites’ functionalities and offerings, and those of other websites you visit.
We, or our Clients or Partners, may use or work with mobile SDKs (including our own SDK(s), which are described in more detail in this Policy) to collect information, such as Mobile IDs, and information related to how mobile devices and their users interact with our Smaato Ad Services and those using our Smaato Ad Services. The SDK is computer code that app developers can include in their apps to enable ads to be shown, data to be collected, and related services to be implemented. Sometimes, we obtain data through other (generally, simpler) interfaces that deliver similar data to us, which are commonly referred to (and which we refer to) as APIs. We may use these technologies, for example, to analyze or measure certain advertising through apps and browsers based on information associated with your mobile device. If you would like to opt out from having ads tailored to you in this way on your mobile device, please follow the instructions in Section 4 below, titled “Consumer Control and Opt-Out Options.”
Our Clients or Partners may use the above technologies (sometimes, in combination with each other or other data such as IP addresses or hashed or de-identified data files) to coordinate identifiers across platforms, browsers, or devices, in order to more efficiently analyze or target advertising.
In most cases, consumers have control over whether or not they would like to receive relevant ads and marketing email from our Clients. To change the settings for the cookies Smaato sets on your devices through the Smaato Websites, please visit our Cookie Policy.
You can opt out of many of the publishers, platforms and service providers we work with that support online interest-based advertising from cookies or similar technologies by visiting the Digital Advertising Alliance’s consumer education and opt-out page at http://www.aboutads.info (or the European Interactive Digital Advertising Alliance’s opt-out page at http://www.youronlinechoices.eu if you are located in the European Union).
Some of our Publisher clients have their own opt-out mechanisms that are linked from their websites or their online-posted privacy policies. You should review the privacy policies of those companies for these opt-out links if you no longer wish to receive targeted advertising from a certain company, or multiple companies.
You can also click below to opt out of having the Smaato Ad services used to select ads for your browser based on your online web browsing behavior. When you opt out, an opt out cookie (from smaato.net) will be stored in your web browser. Our platform will know the choice you have made when it sees your opt out cookie, and will apply your choice to all companies using Smaato Ad services for online interest-based advertising from cookies.
Please note: This type of opt out is cookie-based, which means that if you block cookies, upgrade your browser or delete your cookies, you will need to opt out again. Also, in order for your opt out choice to be effective, you must ensure that your browser is set to accept third-party cookies such as the Smaato opt out cookie. Some browsers block third-party cookies by default, and you may need to change your browser settings to accept third-party cookies before opting out. If you use a different device or browser, or erase cookies from your browser, you will need to renew your opt out choice.
Even if you opt out, Smaato may continue to collect data for other purposes and you still will receive advertising from the Smaato Ad Service when you visit websites of a Publisher who uses our Platform – but such advertising will not be personalized to you.
You can opt out of having your Mobile IDs used for certain types of interest-based mobile advertising (also called “cross-app advertising”), including those performed by Smaato, by accessing the settings on your Apple or Android mobile device, as follows:
Please note that these platforms control how these settings work, so the above instructions may change, and the precise language may be different on certain (particularly, on older) devices. Likewise, if your device uses other platforms not described above, please check the settings for those devices.
Advertisers may also provide ways for you to opt out from, or limit their collection of, certain information from and about you. Please refer to the privacy policies for retailers, apps, and mobile websites to learn more about their privacy practices.
You may opt out from receiving promotional emails from us, such as emails to inform you about events and new services, by following the “unsubscribe” instructions in any promotional email you receive, or by contacting us at marketing@smaato.com. Please note, however, that we may still send you non-promotional emails relating to your relationship with us.
The Smaato Websites provide information regarding Smaato and our products and services. Through the Smaato Websites, we collect information you voluntarily disclose to us, and we may also obtain automatically-collected information.
When registering for an account, expressing an interest in obtaining additional information about Smaato or our products and services, or otherwise contacting us through the Smaato Websites, we collect information you voluntarily disclose to us, such as your name, mailing address, email address, telephone number, credit card number, and other billing information. You may also provide us with certain information about your business or other individuals.
When you visit the Smaato Websites, we may use cookies and pixel tags that we associate with unique identifiers to keep track of visitor interactions and personalize your experience on the Smaato Websites. For more information, please see Section 3 above, titled “Cookies, Pixel Tags, and SDKs.”
We may also use third-party services, such as Google Analytics, that gather information such as your IP address, browser type, the web page from which you came to the Smaato Websites, and the times of your visit. In addition, as you browse the Smaato Websites, advertising cookies may be placed on your computer so that we can “remember” your interests. Our display advertising partners may then help us retarget ads to you on other sites based on your interactions with the Smaato Websites. To opt out of such interest-based mobile advertising, please see Section 4 above, titled “Consumer Control and Opt-Out Options.” Opting out in this way will not prevent you from receiving ads; rather, the ads you see will be less customized to you.
In addition to the uses described elsewhere in this Policy, we use the information we collect through the Smaato Websites (alone or in combination) to provide, market, improve, and operate the Smaato Websites, Smaato Ad Services, and any other products or services we have or may develop. This includes use of the information to:
We may share the information we collect through the Smaato Websites in the following situations:
With respect to aggregated or de-identified information, we may share such information without restriction.
For the purpose of designing our website in line with your needs, evaluating it from a business management perspective, controlling it and continuously optimizing our pages, we use services described in more detail below on the basis of Art. 6 Para. 1 lit. a) and f) GDPR. All of the mentioned processing operations result in a transfer of data to the servers of the providers of tracking or targeting technologies commissioned by us. Some of these servers are located in the USA. The data transfer is based on so-called standard contractual clauses of the EU Commission or under the EU-US Privacy Shield.
If you do not agree with the storage and evaluation of your data, you can object to the storage and processing of your data in the consent banner on our website. In this case, a so-called opt-out cookie will be stored in your browser, which means that the services used will not process any session data. However, you may then no longer be able to use all the functions on our websites.
You can also prevent the storage of cookies by adjusting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of our websites to their full extent.
We use the reCaptcha service of Google Inc. (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to protect us from spam and misuse.
We use this processing on the basis of Art. 6 para. 1 lit. f) GDPR.
This service serves to distinguish whether an entry was made by a human being or abusively by automated, machine processing. To determine this, Google places a cookie in your browser when you use the reCaptcha service and collects and processes the following data:
Your input behaviour (e.g. answering the reCAPTCHA question, input speed into the form fields, order of selection of input fields by the user) is processed to improve pattern recognition on Google.
Google also reads the cookies from other Google services such as Gmail, Search and Analytics. All of the above data is sent to Google in encrypted form. Google’s subsequent evaluation decides in which form the captcha is displayed on the page – in the form of a checkbox or by text input. A readout or saving of personal data from the input fields of the respective form does not take place. Further information about Google’s privacy policy can be found at https://www.google.com/policies/privacy/ .
Smaato uses Google Universal Analytics, a web analytics tool from Google Inc., USA (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield Agreement (https://www.privacyshield.gov) and we have a privacy agreement with Google.
Google uses Cookies. The information generated by the Cookies on the use of the Smaato website by the users are usually transmitted to a Google server in the USA and stored there. However, Smaato has activated the IP anonymisation, so that your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of Smaato, Google will use this information to evaluate your use of the website, to compile reports on the website activities and to provide further services to us in connection with the use of the website and the Internet. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google.
We use this processing on the basis of Art. 6 Par. 1 lit. f) GDPR for range measurement and evaluation (so-called statistics). In this case there is no further processing of your data for marketing or retargeting purposes. This serves the business optimisation of our processes. If you have given your consent (Art. 6 para. 1 lit. a) GDPR), we will also process your data for marketing purposes.
You can find more information on terms of use and data protection at https://www.google.com/analytics/terms or https://marketingplatform.google.com/about/.
We would like to point out that on this website Google Analytics has been extended by the code "gat._anonymizeIp();" in order to ensure anonymous processing of IP addresses (so-called IP masking).
If you do not agree with the processing of your data by Google Analytics, you can object here: https://tools.google.com/dlpage/gaoptout?hl=de
Generally speaking, we retain the information collected from the Smaato Websites and Smaato Ad Services for as long as necessary to achieve our objectives as detailed in this Policy, and to comply with our legal obligations, resolve disputes, and enforce our agreements.
If you are a resident of the European Economic Area (EEA), Switzerland, or the United Kingdom (UK), you may obtain a copy of the information we have about you, and correct or amend such information, by contacting us at privacy(at)smaato.com. You may read more about this and other rights in Section 11 below.
We have administrative, technical, and physical safeguards in place in our physical facilities and in our computer systems, databases, and communications networks that are designed to protect the information from loss, misuse, or alteration. No method of electronic transmission or storage is 100% secure. Therefore, we cannot guarantee absolute security of your information.
To assist with data security, you understand that YOU ARE RESPONSIBLE FOR MAINTAINING THE SECRECY OF ANY ACCOUNT CREDENTIALS THAT CAN BE USED TO ACCESS ANY ACCOUNT WITH SMAATO. ANY ACTIONS TAKEN USING YOUR ACCOUNT CREDENTIALS ARE YOUR SOLE RESPONSIBILITY.
This Policy only applies to the Smaato Websites and the Smaato Ad Services. We are not responsible for the privacy practices or disclosures of websites, developers, or apps that access or use the Smaato Websites or Smaato Ad Services. Likewise, when you access the Smaato Websites, you may be directed to other websites that are also beyond our control. We encourage you to read the applicable privacy policies and terms and conditions of such third parties and websites, and the industry tools that we have referenced in this Policy.
The Smaato Websites and Smaato Ad Services are provided, supported, and hosted in the United States, and their operation is governed by United States law. If you are using the Smaato Websites or Smaato Ad Services from outside the United States, be aware that your Information may be transferred to, stored, and processed in the United States and other countries where our facilities are located. The data protection and other laws of the United States might not be as comprehensive as those in your country. By using the Smaato Websites or Smaato Ad Services, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share your information as described in this Policy.
Please see Section 11 below, titled “The EU General Data Protection Regulation (GDPR)” for additional information we provide for the benefit of residents of the EEA, Switzerland, and the UK.
We do not currently recognize or respond to browser-initiated Do-Not-Track signals, as there is currently no industry-wide consensus as to uniform Do-Not-Track standards, implementations, or solutions. Please review Section 4 above, titled “Consumer Control and Opt-Out Options,” for information about your marketing choices.
As of May 25, 2018, a new data privacy law known as the EU General Data Protection Regulation (the “GDPR”) will be in effect through the EEA, Switzerland, and the UK. The GDPR requires Smaato and those using our services to provide users with certain information about the processing of their “Personal Data.” “Personal Data” is a term used under the GDPR that means, generally, data that identifies or can identify a particular unique user or device – for instance, names, addresses, cookie identifiers, Mobile IDs, precise location data, and biometric data.
To comply with the GDPR, we provide the below representations and information, which are specific to persons located in the EEA, Switzerland, or the UK and to the processing of personal data in the context of the activities of Smaato, Inc., Valentinskamp 70, Emporio, 19th Floor, 20355 Hamburg, Germany.
The GDPR requires us to tell you about the legal ground we are relying on to process any Personal Data about you. The legal grounds for us processing your Personal Data for the purposes set out in Sections 1 and 2 above (and Section 5 as to the Smaato Websites) will typically be because:
As Smaato is a global company and works with other global companies and technologies, we may need to transfer your Personal Data outside of the country from which it was originally provided. For instance, we may transfer your data to third parties that we work with who may be located in jurisdictions outside of the EEA, Switzerland, or the UK, and which may have data protection laws that are less strict in comparison to those in Europe.
When we transfer Personal Data outside of the EEA, Switzerland, or the UK, we take steps to ensure appropriate safeguards are in place to protect your Personal Data.
Your Personal Data will only be transferred to third countries outside the EEA, Switzerland or the UK within the legally permissible framework. We transfer Personal Data to third countries outside the EU/EEA (a) as stipulated by law or based on your consent, (b) based on the adequacy decisions of the European Commission (a public and updated list of these countries can be found here) and (c) by contractual regulations such as the EU Standard Data Protection Clauses (a public and updated list of these clauses can be found here). These safeguards shall ensure an adequate level of protection of your Personal Data and you can access further details regarding these safeguards upon request.
Smaato also complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (collectively, the “Privacy Shield”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data transferred from the European Union (EU), the UK, and Switzerland to the United States. Smaato has certified to the U.S. Department of Commerce that it adheres to the Privacy Shield Principles of notice, choice, onward transfer, security, data integrity, access, and enforcement with respect to such Personal Data. When Smaato transfers Personal Data protected by the Privacy Shield Principles to a third party acting as an agent on Smaato’s behalf, Smaato has certain liability under the Privacy Shield if both (a) the agent processes the Personal Data in a manner inconsistent with the Privacy Shield and (b) Smaato is responsible for the event giving rise to the damage. With respect to compliance with the Privacy Shield, Smaato is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
If there is any conflict between the terms of this Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit this page.
If you have any questions or complaints about Smaato’s privacy practices, you may contact Smaato at the contact information in Section 14 below, titled “Contacting Us,” and we will work with you to resolve your issue. If you are a resident of the EU, UK, or Switzerland, you may also contact your appropriate European Data Protection Authority, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner, respectively, with questions or complaints about our privacy practices.
If you are a resident of the EU, UK, or Switzerland and are dissatisfied with the manner in which we have addressed your concerns about our privacy practices, you may seek further assistance from our independent recourse mechanism, the JAMS EU-U.S. and Swiss-U.S. Privacy Shield Program, which we offer to you for concerns related to our compliance with the Privacy Shield Principles and general privacy practices:
https://www.jamsadr.com/eu-us-privacy-shield
Claims shall be arbitrated free of charge by our arbitration provider, JAMS, though each party shall be responsible for its own attorneys’ fees. Please be advised that, pursuant to the Privacy Shield, the arbitrator(s) may only impose individual-specific, non-monetary, equitable relief necessary to remedy any violation of the Privacy Shield Principles.
Under certain conditions, residents of the EU, UK and Switzerland who have unresolved complaints after: (1) contacting Smaato to resolve the issue; (2) seeking assistance from our independent recourse mechanism; and (3) contacting the U.S. Department of Commerce (either directly or through a European Data Protection Authority, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner) and affording the U.S. Department of Commerce time to attempt to resolve the issue, may elect to invoke binding arbitration through the Privacy Shield arbitration process, more fully described on the Privacy Shield website.
As a general matter, we retain your Personal Data for as long as necessary to provide our Smaato Ad Services, or for other important purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements. We generally render Mobile IDs inactive within 13 months, provided that we may retain them if we have a legal or significant operational need to do so, such as for auditing, corporate record-keeping, compliance accounting, or bug-fixes.
If you are a Client of ours and thus have an account with us, we will typically retain your Personal Data for a period of 3 years after you have requested that your account be closed, or such account has been inactive.
The GDPR provides you with certain rights in respect to Personal Data that data controllers hold about you, including certain rights to access Personal Data, to request correction of the Personal Data, to request to restrict or delete Personal Data, and to object to our processing of your Personal Data (including profiling for online ad targeting).
EU data protection law makes a distinction between organizations that process Personal Data for their own purposes (known as “data controllers”) and organizations that process Personal Data on behalf of other organizations (known as “data processors”). If you have a question or complaint about how your Personal Data is handled, we encourage you to direct your inquiry to the relevant data controller, since data controllers hold primary responsibility for your Personal Data.
Smaato may act as either a data controller or a data processor in handling your Personal Data, depending on the precise circumstances. For instance, for Personal Data that we use internally and independently to create our own data tools and operate the Smaato Ad Services, and for Personal Data that we collect about our Clients, we are a data controller. But when we handle Personal Data strictly on behalf of our Clients or Partners in order to provide our services to them, we are a data processor. Thus, for instance, if you have questions about data that is used primarily by a mobile app on which our technology is embedded – or companies that serve ads that use our technology – you should contact those companies regarding questions about the Personal Data they handle and control.
This data protection information applies to data processing by the data controller
Smaato, Inc.for users based in the European Economic Area, Switzerland or the UK, unless otherwise stated in a service-specific data protection notice.
Valentinskamp 70, Emporio, 19th Floor
20355 Hamburg, Germany
Smaato, Inc.
Data Protection Officer
Valentinskamp 70, Emporio, 19th Floor
20355 Hamburg, Germany
E-mail: privacy(at)smaato.com
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str 22, 7th floor
20459 Hamburg
Tel.: +49 (040) 42854-4040
E-mail: mailbox@datenschutz.hamburg.de
To help and foster the protection of consumer privacy, Smaato is an active member or participant of industry associations that govern the policies on consumer privacy in the context of internet-based advertising, including: the Interactive Advertising Bureau (IAB) America and Europe, the Digital Advertising Alliance (DAA), and the European Interactive Digital Advertising Alliance (EDAA).
Smaato participates in, and complies with the policies and technical specifications of, the IAB Europe Transparency and Consent Framework (IAB TCF). Smaato’s IAB Europe-assigned identification number is Vendor ID #82.
Please see Section 4 above, titled “Consumer Control and Opt-Out Options,” for more information about your privacy choices.
We may occasionally update this Policy to reflect changes to our privacy practices. The amended Policy will be displayed on the Smaato Websites. Please check our Policy regularly to ensure you have read the latest version and to stay informed of our privacy practices. Your continued access to and use of the Smaato Websites and Smaato Ad Services constitute your acknowledgement of this Policy and any updates.
If you have any general questions regarding this Policy, you may contact us by email at privacy(at)smaato.com or mailing the following address:
Smaato, Inc.
240 Stockton Street, 9th Floor
San Francisco, CA 94108