NextRoll

Service Privacy Notice

Add Comment

Effective as of January 22, 2021 View archived Privacy Notice NextRoll, Inc. (formerly AdRoll, Inc.) and its subsidiaries and affiliates (“we” “our” or “us”) is an independent marketing technology company that offers intelligent, data-driven advertising and marketing services and solutions to help big and small companies accelerate their growth (“Services”). We have prepared this Service Privacy Notice to describe the types of data we collect from you, and explain how, why and when we collect this data in order to provide our Services to our Customers. References to (“customer” in this Policy Notice refers to any business, brand, marketer and/or advertiser who uses NextRoll’s Services. This Service Privacy Notice also identifies what rights you have concerning the collection of this data, such as the right to opt-out of interest-based advertising (also commonly referred to as targeted or personalized advertising). If you have additional questions, you can visit our Trust Center or Contact Us. Please note that this Privacy Notice does not apply to data we collect when you visit a NextRoll website, including https://www.nextroll.com/, www.adroll.com and https://www.rollworks.com/. To learn what data we collect when you visit our websites, please visit the NextRoll Website Privacy Notice. Table of Contents <ul> <li>About NextRoll's Services</li> <li>What Data we Collect</li> <li>How We Use the Data We Collect</li> <li>Data Sharing</li> <li>Aggregated and De-Identified Data</li> <li>Cookies and Related Technologies</li> <li>Non-Cookie Technology for Tracking Outside European Territories</li> <li>Your Choices and Opting-Out of Interest-Based Advertising and Analytics</li> <li>Data Retention</li> <li>Security</li> <li>International Transfers</li> <li>Information for European Territory Residents: Our Legal Basis and Your Rights</li> <li>Information For California Residents Only</li> <li>Information For Individuals Located in Brazil</li> <li>Changes to this Service Privacy Notice</li> <li>Contact Us About Questions</li> </ul> 1. About NextRoll's Services Back to top NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their businesses. Powered by machine learning and integrated data platforms, NextRoll’s intelligent, data-driven marketing and advertising services and solutions go beyond serving digital ads by providing companies better visibility into which audiences are most interested in certain products and services. By using NextRoll’s Technology, companies can better understand their current customers, find new loyal customers and build lasting customer relationships through intelligence-driven direct marketing activities. All told, NextRoll’s proprietary data and machine learning offerings ("NextRoll Technology") are aimed at a single mission: helping companies of all shapes, sizes and industries accelerate their growth. NextRoll has three different business divisions: <ul> <li>AdRoll is an e-commerce marketing platform for companies that sell their products and services directly to consumers (called “Direct to Consumer” or “D2C” companies). The AdRoll platform makes it easy and affordable for D2C companies to deliver the cross-channel experiences consumers expect – enabling them to sell more to their existing consumers and identify new consumers to whom they can build relationships with to sell their products and services to. AdRoll does this by creating connected, personalized customer journeys that enable brands to reach new and existing customers through digital advertising, email marketing and onsite experiences. AdRoll also helps companies understand the impact of their marketing efforts with advanced measurement and attribution;</li> <li>RollWorks offers an account-based platform for businesses who want to sell their products and services to other businesses (called “B2B” companies). Our RollWorks Services help B2B companies identify their target accounts and key buyers, reach those accounts across multiple channels and measure program effectiveness in their system-of-record. and</li> <li>NextRoll Platform Services offers API-based services that provide platforms and e-commerce marketplaces with a blueprint to build their own marketing technology solutions that enable monetization, automation and activation of data and inventory assets. Our Platform Services help companies’ in-house marketing platforms deliver inventory monetization, audience extension and attribution offerings to their advertising customers.</li> </ul> Interest-Based Advertising NextRoll’s Technology helps our D2C and B2B Customers provide ads and send emails to people that are most likely to find them interesting by showing them ads that are relevant to their specific interests. This is called “interest-based advertising”. We show many of these interest-based ads on websites and mobile apps which rely on advertising revenue to support the content they provide - and what we all consume - for free each day. When you visit a website or a mobile application (each a “Digital Property”) operated by one of our Customers, open an email from a Customer, or get served an ad by us on behalf of our Customer on a third party site, we may collect certain data from your device as described in this Service Privacy Notice. Our platform then uses that data, as well as other data described in What Data We Collect, to help our Customers provide ads and send emails to you that aim to be more relevant to you. To see an example of how this works in practice, see Example of Interest-Based Advertising. Interest-based advertising enables publishers of Digital Properties who rely on advertising to monetize their content and offerings to more accurately determine which ads to serve to specific users based on near real-time data. In turn, this allows our Customers who use our Services to provide more effective advertising that reaches a more precise pool of prospective buyers and avoids wasting marketing resources on those prospective buyers who are uninterested and less inclined to purchase. All in all, interest-based advertising promotes better competition in the marketplace (for example, small and medium sized companies have a better opportunity to reach as many prospective buyers as large, well-funded, competitors), and allows our Customers to provide free or low-cost content to their customers due to the resources generated by effective advertising. Example of Interest-Based Advertising You’re working from home for the foreseeable future and want to invest in more comfortable work-from-home clothing. You can’t go to the store right now so you decide to peruse some direct-to-consumer/e-commerce sites instead. You go to Google and type in “loungewear” and a list of websites pop up, including one for ABC Sweatshirts. You’re still in the research phase so you browse their site but don’t purchase. Luckily, ABC Sweatshirts is a customer of NextRoll and uses the AdRoll e-commerce platform to power it’s technology. Our technology notes that your device visited ABC Loungwear’s website and was looking at sweatshirts. Later, as you browse the Internet, we can show you ads online from ABC Sweatshirts to encourage you to come back and purchase the sweatshirt, perhaps even with a discount offer or notice of an upcoming sale. We may also show you ads from other companies that sell similar products or services you may be interested in to complete your loungewear outfit, such as sweatpants or home slippers. In addition, if you gave ABC Sweatshirts your email address for marketing purposes, we may also send you emails on behalf of the brand that tell you about its new exclusive line of sweatshirts, special promotions, and more. Alternatively, we may use your email to serve you interest-based ads on social media (for example, your social media provider may match a pseudonymized form of your email address that we provide them with the email address details you have registered with your social media account, enabling us to show you interest-based ads in your social media newsfeed). Measurement and Attribution In addition to interest-based advertising, we also provide various analytics to help our Customers measure the success of their advertising campaigns and identify prospective buyers who may be the most interested in their products or services. For instance, by collecting a unique identifier (such as a cookie ID) from the devices of users who see our Customers’ ads or visit their Digital Properties, we can measure whether those unique identifiers subsequently took a particular action, such as buying a Customer’s product or visiting their Digital Property (sometimes called a “conversion”). In some cases, we may use our cross device data asset to match unique identifiers (which includes browsing activity) to email addresses. Customers are only notified of a match if the email already exists in the Customer ‘s CRM records. AdRoll’s D2C Services can collect, measure and analyze different types of data in conjunction with these unique identifiers and provide useful information to our AdRoll Customers such as what IP address ranges visitors to their Digital Properties are from (indicating the geographic locations of a visitor, which may help indicate what locations to run a particular ad campaign), what products or services located on their Digital Property are attracting more attention (or less), and what ad campaigns ultimately led a cookie ID back to a Digital Property to view more products or make a purchase. RollWorks’ B2B Services provide similar types of analytics derived from the same sort of data as AdRoll’s D2C Services described above, but with a focus on firmographic information to provide insights on the type of B2B customers that appear to be interested in specific products or offerings on that Customer’s Digital Property. For example, determining which IP address ranges are associated with a unique identifier (such as a cookie ID) so we can identify companies who may be interested in a RollWorks Customer’s product or service, or, if a unique identifier is linked to an email address that has already been provided to the B2B customer, RollWorks may alert the B2B customer of increased browsing activity that indicates interest from a particular known account. Overall, we use the information learned from unique identifier behavior across the Internet to provide reporting to both our D2C and B2B Customers. A more detailed list of all the data we collect is described in What Data We Collect. 2. What Data we Collect Back to top We collect the following categories of data in the provision of our Services for the purposes explained below. Data You or Our Customers Provide To Us <ul> <li> Email and CRM data from our Customers: Some Customers provide their customer relationship data to us (e.g. name, email address, company address) or instruct us to collect clear email addresses on their behalf using NextRoll Technology (“Customer CRM Data”) for processing as part of our Services. By doing so, we help our Customers identify who is showing interest on their Digital Properties as well as serve, measure and analyze interest-based ads to their current or potential customers (we may also trigger these ads by licensing RollWorks B2B Contact Data to a Customer). For example, using the scenario we provided above, if you gave ABC Sweatshirts your email address, the company may use our Services to send you a promotional email for a loungewear set you looked at but did not purchase. Similarly, if you are browsing a software company’s website and submitted your email to download a white paper, the software company may use our Services to contact you and provide you with more information about the software company’s products that appear to be of most interest to you (subject to the marketing preferences you indicate to the software company). We use our Customer’s CRM Data only as a processor for the purpose of assisting that particular Customer with their own advertising efforts and reporting performance back to the Customer's CRM system. We do not share clear email addresses belonging to one Customer with another Customer for their advertising purposes.</li> <li> Shopping Data: Some Customers provide us with data about their buyers’ shopping habits, including non-financial transactional data, product codes and check-out activity in addition to the browsing data that we collect. This data may come from their Digital Properties or other non-financial transactional data they maintain. We use this data to help us better target, personalize and measure the effectiveness of advertising campaigns. This data is also Customer CRM Data and belongs to our Customers and is handled by NextRoll as a processor or service provider.</li> <li> Hashed email addresses: When a Customer permits us, we collect hashed versions of the email addresses that you have entered on that Customer’s Digital Property. Hashing is a technology process that pseudonymizes email addresses. For instance, when joe_the_cat@nextroll.com is run through a typical hashing function, it becomes the following string of digits: 0F0B7B1A1A7E8BDBBC6AA545F8CCD6F83671B32479271BFCB6CC8498912058D5. We take this step to protect email addresses, while being able to use the unique identifier created for the purpose of recognizing you online across Digital Properties and sending you interest-based ads across different devices (computers, tablets and mobile devices) and browsers (also called “cross-device matching”). We describe cross-device matching in further detail in How We Use the Data We Collect.</li> <li> Data We Receive in Our Corporate Capacity: We also collect data from our own Customers and visitors to our website(s). To learn more about how we collect and use that data, please see our Website Privacy Notice.</li> </ul> Data We Automatically Collect From Your Device Unless you have opted-out or have otherwise refused to provide consent, the following is data that we collect from your device automatically: <ul> <li> Cookies: A unique identifier that NextRoll assigns to you when visiting a Customer’s Digital Property so NextRoll can understand your online journey and have the opportunity to serve ads to you when you visit Publisher’s Digital Properties.</li> <li> Device Information: This is technical information about the device you use to access our Customers’ Digital Property, such as your device's IP address and operating system. Additionally, in the case of mobile devices, your device type, and mobile device's unique advertising identifier (such as the Apple IDFA or Android Advertising ID), and any other unique identifier that may be assigned to the mobile device, such as an Android ID or UDID in older Apple phone models, or a non-cookie unique identifier used by Non-Cookie Technologies.</li> <li> IP Address: The IP address associated with the device you are using when accessing a Customer’s Digital Property.</li> <li> Location Data: This is non-precise information related to your geography derived from your device’s IP address (e.g. laptop, desktop or mobile etc.). This does not reveal your precise geographic coordinates (i.e. GPS latitude and longitude) - only country, state, city and zip/postal code level location data, and helps us to display ads that are relevant to your general location (for example, showing ads in French if you are located in France).</li> <li> Browser Data: This is technical information about the browser you are using that is captured in order to serve you an ad that can be rendered on your device, for example, Chrome, Firefox, Safari etc.</li> <li> Activity on Customers’ Digital Properties: This is data about your browsing activity on a Customer’s website or application. For example, which pages you visited and when, what items were clicked on a page, how much time was spent on a page, whether you downloaded a white paper on a B2B website, what site or ad brought you to the Customer’s website, what items you placed into your online shopping cart and what products were purchased (and the price of the products purchased).</li> <li> Ad Data: This is data about the online ads we have served (or attempted to serve) to you. For example, how many times an ad has been served to you, what page the ad appeared on and whether you clicked on or otherwise interacted with the ad.</li> </ul> All of this data is collected to help make sure you get the best and most relevant experience when engaging with our Customers. Data We Collect From Third Party Sources <ul> <li> Campaign Performance Data: This data includes information about how well our Customers’ ads and campaigns have performed, whether on our platform or on other advertising platforms.</li> <li> Data from Audience Partners: We may collect additional information about you from our audience partners who create and provide us with segments which we use for our Customers (“Audience Partner”). A segment is a grouping of users who share one or more attributes (e.g. demographic or firmographic attributes). We use this data to better understand the Customers’ target audience and to better market the Customers’ products and services to you. We also may work with our Customers and Audience Partners to synchronize their unique, pseudonymous identifiers to our own to enable us to more accurately recognize a particular unique browser or device and the advertising interests associated with it (commonly known as “ID or User Syncing”).</li> <li> Data from Advertising Partners: This is data that allows us to match the NextRoll cookie identifier with identifiers that may already be used by other companies in the digital advertising ecosystem that we work with (“Advertising Partners”). For example, we work with ad exchanges, publishers and supply side platforms (i.e. companies that sell advertising space on publishers’ websites) in order to serve our ads. Matching cookie identifiers helps us deliver ads to you and recognize you across browsers and devices and may include pseudonymous advertising identifiers (meaning identifiers that help identify your browser or device, but not you directly) which some Advertising Partners choose to share with us.</li> </ul> Data collected pursuant to RollWorks Business only: <ul> <li> Email Communications: Customers may provide us with access to their email communications from their prospects when they have engaged us to provide email marketing services, which we process as a processor only on behalf of our Customers and in accordance with their instructions. When access to such data involves access to Gmail Data such access will be subject to these additional restrictions: <ul> <li>We will only use access to read, write, modify or control Gmail message bodies (including attachments), metadata, headers, and settings to provide a web email that allows users to compose, send, read and process emails and will not transfer this Gmail Data to others unless doing so is necessary to provide and improve these features, comply with applicable law or as part of a merger, acquisition or sale of assets;</li> <li>We will not use this Gmail Data for serving advertisements. and</li> <li>We will not allow humans to read this data unless agreed to by the Customer, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the provision of NextRoll’s Services.</li> </ul> </li> <li> Contact data from third parties: We obtain and collect contact data from various third-party sources, including from public sources and through licenses with data providers. We may also infer contact data based on email addresses and email naming conventions. This contact data is B2B information – in other words, it is typically a business email address, business street address and a business telephone number. Please note that as part of our RollWorks Services, we do not collect business email addresses for any individuals who are residing in any European Territories (as defined in International Transfers).</li> </ul> 3. How We Use the Data We Collect Back to top Our goal is to leverage this data to help Customers better identify and engage with you so you get the best online experience. For example, to serve ads that aim to be more relevant to you or to identify companies interested in the Customer’s products and services. The data we collect also helps Customers analyze traffic on their Digital Properties, measure the effectiveness of their ad campaigns and gauge the interest of prospective buyers - again to deliver the right messages at the right time to you. Additionally, we use this data to operate, improve and enhance our Services, not only to serve the most relevant ads to you but also to improve the performance of our Customer’s marketing and advertising efforts. Specifically, we use this data for the following purposes: <ul> <li> Interest-Based Advertising: To select ads that are more likely to be relevant to you based on data such as your browsing activity, the time of day and time spent visiting specific Digital Properties, and non-precise geographic data inferred about your device(s). For example, we may show you ads for your favorite shopping site (or similar sites we think you may like) for goods or services only available in your city, region or country during your lunch or commute hours.</li> <li> Segmenting Audiences: To segment you into groups (like bargain hunters, high intent visitors, low intent visitors) for certain purposes such as reporting and analytics as well as determining what ads and email content would best peak your interest. To do so, we use data from Customer Digital Properties you visit in addition to data provided by the Customer and from Audience Partners (i.e. demographic and firmographic information about your unique identifier).</li> <li> Ad Delivery: We use data about your browser or other technical information about your device in order to technically deliver advertising and confirm successful delivery of the ad.</li> <li> Frequency Capping: Make sure that you don't see the same ad too many times. If we know you’ve already seen one of our Customer’s ads several times, we’ll try to show you a different ad next time.</li> <li> Sequencing: If you are being served a sequence of ads, to make sure we show you the right ad next in the sequence.</li> <li> Mapping data to Our Cross-Device Asset: NextRoll Technology includes its cross-device asset which is used to connect multiple devices to one person, household, and/or online identifiers such as an email address (hashed for security) that a Customer may have collected directly from its customers. The cross-device asset allows companies to better understand their known-customer activity, as well as improves the ability to target and measure ad campaigns (including limiting the number of times the same person or household sees an ad). <ul> <li> Cross-device matching: Identifying different devices and browsers that are likely to be associated with you so that ads can be targeted, capped and sequenced across those devices, and so that campaign effectiveness can be measured and analyzed. For example, cross-device matching helps us not show you ads for the shoes you were looking at on your phone but already purchased on your tablet. Instead we’ll try to show you ads for an upcoming triathlon where you can put those shoes to work. It also helps us match devices so we can honor your opt-out choices across all devices we know are connected to the opted-out cookie. You may opt-out of cross-device interest-based targeting by employing the respective opt-out techniques we describe in Your Choices and Opting-Out of Targeted Ads. To learn more about how we use cross-device matching, visit our blog.</li> <li> Syncing Online Identifiers with Customer CRM Data: Customers may use NextRoll Services to match online browsing activity indicated by online identifiers with existing email addresses the Customer has already obtained in compliance with applicable law ( i.e. Customer CRM Data). Customers may also use this information to understand which consumers or business accounts are showing increased interest to better understand their website audience and respond with appropriate marketing activity.</li> </ul> </li> <li> Identifying Companies Associated with an IP Range for B2B marketing: We match IP address ranges to companies who disclose their IP address ranges in order to provide aggregated reports to companies regarding their website traffic.</li> <li> Reporting and Attribution: To provide Customers insights into how their ad campaigns served either by NextRoll and/or by third parties are performing as well as insights into their customers by analyzing activity on their Digital Properties. Reporting may include ad metrics such as traffic on certain Digital Properties, measuring impact of campaigns, impressions (ads served), clicks (ads you clicked on) and conversions. What qualifies as a “conversion” is defined by the Customer—it might include, for example, a sale or a white paper download or a correlation to an actual or inferred sale, site visit or store visit. This data allows a Customer to determine if an ad is not performing well (few attributed conversions), so that the Customer will be able to see that data and update the ad (perhaps with a better deal!).</li> <li> Licensing Data: Other than Customer CRM Data, to license any of the data we receive or create to our Customers or other third parties. For instance, as mentioned in What Data We Collect, when we receive an email address for a U.S. resident from a third party data provider or derive an email address, we may license that to our Customers in the form of our RollWorks Contact Data Product.</li> <li> Conducting Our Corporate Operations: As to data we collect in our corporate capacity – our own B2B lists of Customers— we use that data to conduct our business operations and communications. Please see our Website Privacy Notice to learn more about how we use that data.</li> <li> Complying with Legal Process: To satisfy in good faith any applicable law, legal process or proper governmental request, such as to respond to a subpoena (whether civil or criminal) or similar process.</li> <li> Investigating Wrongdoing and Protecting Ourselves or Third Parties: To enforce or investigate any potential violation of our Terms of Service, policies or the law, and to protect ourselves, our Customers or any third party from any potential harm (whether tangible or intangible).</li> </ul> 4. Data Sharing Back to top We may disclose data about you with the following third parties: <ul> <li> With a Customer: We may share data about how you have interacted with a Customer’s Digital Properties, email campaigns or its Ads. We may share business contact data collected from third party sources or inferred (for example, based on email naming conventions) with a RollWorks B2B Customer if we think that your business or employer would be interested in that Customer’s products. In regards to RollWorks’ Services, we do not collect contact data about residents of European Territories from third parties.</li> <li> With Our Audience Partners: We share hashed email addresses or other pseudonymous online identifiers with our Audience Partners in connection with audience creation and modelling and creating segments for the Customer based on the Customer’s CRM Data.</li> <li> With Our Advertising Partners: We disclose cookie ID data and the ad we propose to serve with our Advertising Partners, as necessary, to allow for the successful delivery of ads to your device.</li> <li> With Our Service Providers: We contract with companies who provide services to us to support our business operations (e.g., for example, website and data hosting, fraud prevention, viewability reporting, data hygiene, marketing and email delivery), as well as billing, collections, tech, customer and operational support.</li> <li> With Our Subsidiaries and Affiliates: Our subsidiaries and corporate affiliates will only process your data for the purposes already explained in this Service Privacy Notice. Our subsidiaries are NextRoll Limited (Ireland), AdRoll Limited (UK) and NextRoll Pty Limited (Australia).</li> <li> In Connection with Legal Proceedings: When we are under a legal obligation to do so, for example, to comply with a binding order of a court or where disclosure is necessary to exercise, establish or defend the legal rights of NextRoll, our Customer or any other third party.</li> <li> In Connection with a Sale of Our Business: If a third party acquires some or all of our business or assets, we may disclose your information in connection with the sale (including during due diligence in preparation for the sale).</li> </ul> 5. Aggregated and De-Identified Data Back to top NextRoll may aggregate and de-identify data it collects so that it can either no longer be directly or indirectly associated with a natural person or cannot be associated with a natural person at all. NextRoll will then use such data for our machine learning, reporting and other business purposes. We may also share aggregated and de-identified data with our subsidiaries and affiliates and third parties, including with our Advertising Partners. 6. Cookies and Related Technologies Back to top NextRoll Technology uses cookies, tracking pixels and related technologies to provide our Services to our Customers. Cookies are small data files that are served by our platform and stored on your device. You can refuse consent to, or opt-out of, NextRoll cookies at any time, as explained in Your Choices and Opting-out of Interest-Based Advertising and Analytics below. For more information regarding data associated with cookies, please refer to Data Retention. <ul> <li>Specifically, the NextRoll cookie we serve through our NextRoll Technology for this purpose is named “__adroll”, “__ar_v4” and “__adroll_fpc.”</li> </ul> Our Advertising Partners may also drop cookies for the purposes described in What Data We Collect. Generally, the type of cookies dropped will vary depending on the Advertising Partner. We provide a list of our Advertising Pixel Partners here. Additionally, we use non-tracking cookies (not unique) to store user decisions in terms of your ad consent and opt-out choices: <ul> <li>We may drop a __adroll cookie with value opt-out if you opt-out as described below.</li> <li>We may drop a __consent cookie that stores the consent choices you have made regarding data processing and advertising by NextRoll.</li> </ul> A full list of NextRoll cookies is set out below: Tracking cookies Non-tracking cookies __adroll __ar_v4 __adroll_fpc __adroll_consent_params __adroll_post_consent_html __adroll_post_connsent_css 7. Non-Cookie Technology for Tracking Outside European Territories Back to top In respect of website visitors with IP addresses not from a European Territory, NextRoll and some of its Advertising Partners may use technologies other than cookie technology to recognize your computer, device or browser for the purposes of interest-based advertising, analyzing engagement with ads or content, measuring the effectiveness of a particular ad campaign or marketing effort, to monitor against fraud or misuse of our Services, or in other ways described in this Service Privacy Notice in How We Use the Data We Collect. This use of non-cookie technology may be used in addition to cookies, or separately, to collect and record data about your web browsing activities on browsers, search engines or other platforms that may not utilize NextRoll Technology. You may opt-out of tracking via non-cookie technologies by employing the respective opt-out techniques described in Your Choices and Opting-Out of Interest-Based Advertising and Analytics Ads. 8. Your Choices and Opting-Out of Interest-Based Advertising and Analytics Back to top You can control how you share your data with NextRoll, including electing to opt-out of interest-based advertising altogether. Please visit our opt-out webpage to opt-out. Generally speaking, an opt-out allows you to direct NextRoll not to engage in a particular type of data collection. There are many different ways that NextRoll collects data, different purposes for that data collection, and different industry-specific and NextRoll-specific tools for opting-out. We describe below the different options for controlling how NextRoll uses your data: <ul> <li> Web browser: You can opt-out of receiving interest-based ads served by us or on our behalf by clicking on the blue icon that typically appears in the corner of the ads we serve and following the instructions provided or by clicking on our opt-out page. Please note that this opt-out function is browser-specific and relies on an opt-out cookie. This means if you delete your cookies or upgrade your browser after having opted out, you will need to opt-out again.</li> <li> Cross Device Opt-Out: As described above in How We Use the Data We Collect, we may link multiple browsers or devices to the cookie ID, hashed email address or other unique identifiers associated with you. If you opt-out on a browser or device and we have additional devices or browsers linked to you, we will extend your opt-out decision to any other linked browsers and devices. Since we only link users across browsers and devices in certain conditions, there may be cases where you are still being tracked in a different browser or device we have not linked, and where we are treating you as a different user.</li> <li> Mobile Device Opt-Out: To opt-out of receiving interest-based ads that are based on your behavior across different mobile applications, see instructions for iOS and Android devices: <ul> <li> iOS 7 or Higher: Go to your Settings &gt. Select Privacy &gt. Select Advertising &gt. Enable the “Limit Ad Tracking” setting. and</li> <li> For Android devices with OS 2.2 or higher and Google Play Services version 4.0 or higher: Open your Google Settings app &gt. Select Ads &gt. Enable “Opt-out of interest-based advertising.”</li> </ul> </li> <li> Industry Opt-Out Tools and Self-Regulation: <ul> <li>NextRoll is a member of the Network Advertising Initiative (NAI) and adheres to the NAI Code of Conduct. You may use the NAI opt-out tool which will allow you to opt-out of seeing interest-based ads from us and from other NAI approved member companies. In addition, the NAI opt-out tool allows you to separately opt-out of “audience matched” advertising through the NAI’s “Audience Matched Advertising Opt-Out.” You can also use the email opt-out tool provided by our Advertising Partner, LiveRamp, to opt-out your email address from their database. Audience matching is a particular type of interest-based advertising where de-identified data (e.g. hashed emails) is tied to “offline” activity or information (this information generally is or can be associated with a consumer’s email address - whether that information is part of our Customer’s own customer lists or in lists we license to the Customer). To do “audience matching,” we or another platform then “match” that information (in de-identified form) to cookie IDs, mobile ad IDs, or other online identifiers. We describe this hashing activity in additional detail in What Data We Collect. Because this “audience matched” information is derived from an email address or information that can be tied to an email address, it is possible to opt-out with an email address. However, when you opt-out this way, you will need to submit all of the email addresses that you use for the opt-out to work.</li> <li>We also comply with the Self-Regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance (DAA). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners, via the DAA website.</li> <li>We also comply with the Canadian Self-regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance of Canada (DAAC). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners via the DAAC website.</li> <li>Finally, we also adhere to the European Interactive Advertising Digital Alliance (EDAA) guidelines for online advertising. You may opt-out via the EDAA website.</li> </ul> </li> <li> Reminder to Users Residing in a European Territory: If you are located in a European Territory you will also have additional data protection rights. These are described in Information for European Territory Residents: Our Legal Basis and Your Rights.</li> </ul> 9. Data Retention Back to top Customer CRM Data: We are processors and act as a service provider of Customer CRM data (e.g., customer lists containing clear emails) that the Customer instructs us to collect or otherwise provides to us in order for us to perform our Services. We retain this Customer CRM Data until the Customer asks us to delete this data or the agreed time for deletion set forth in our Terms of Service (whichever is earlier). Mobile Identifiers and Cookie Identifiers: Cookies we set expire (and are then deleted) 13 months from the last time your device accessed a Digital Property using NextRoll Technology. If you visit another Digital Property that uses our technology inside that 13-month expiry period, then the expiry period will be reset and measured from that date instead. The expiration period for mobile identifiers is controlled by you on your own device. Personal Data Associated with Mobile and Cookie Identifiers Related to Browsing History: We delete personal data associated with mobile and cookie identifiers after 12 months. For example, data such as a Customer’s website you visited or ads that you may have clicked. Personal Data Associated with Advertising Bidding Requests: Data logged in order to process an advertising bid request we have received from an Advertising Partner (such as cookie identifier, IP address, the domain url requesting to display the ad, and browser information) are deleted after 7 days. Data we have logged regarding bids we have placed to display an advertisement (including cookie identifiers, mobile identifiers, the advertisement bid on and the advertisement won or displayed to the end-user) are deleted after 15 days. Personal Data Associated with the Display of an Advertisement: Data logged for the display of an advertisement (including cookie identifiers, the advertisement won or displayed to you and data indicating whether you clicked on the particular advertisable displayed) are deleted after 12 months. 10. Security Back to top We apply technical, administrative and organizational security measures to protect the data we collect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against other unlawful forms of processing. NextRoll has also completed the SOC2 Type 2 Audit (Security and Privacy) with no exceptions. This report is only available to Customers by a request to support@nextroll.com. 11. International Transfers Back to top We may transfer the data we collect about you to countries (including the United States of America) other than the country where we originally collected it for the purposes of performing our Services. In general, the transferring countries will be the countries in which we, our Customers, our Advertising Partners, or our or their service providers operate. Those countries may not have the same data protection laws as your country. However, when we transfer your data to other countries, we will protect that data as described in this Service Privacy Notice and take steps, where necessary, to ensure that international transfers comply with applicable laws. For example, when we transfer your data from a European Territory (as defined below) to our parent company in the United States, we do so under the European Commission's Standard Contractual Clauses. These Standard Contractual Clauses are incorporated in the NextRoll Data Protection Addendum between NextRoll and each of our Customers where applicable. When we transfer your data outside of a European Territory to Advertising Partners (or vice versa), we do so under lawful data export mechanisms which may include Standard Contractual Clauses and Binding Corporate Rules. 12. Information for European Territory Residents: Our Legal Basis and Your Rights Back to top Our Legal Basis: If you interact with our Services from the European Territories, our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it. For these purposes, "European Territories" means the European Economic Area, Switzerland and the United Kingdom. Specifically, we will normally process personal data about you based on consent (except where the purpose of processing is based on legitimate interest, as described in the “vendor” details of the Consent Management Tool presented to you while visiting Digital Properties from the European Territories). For example, when you visit a Customer’s Digital Property, you will be asked to consent to NextRoll dropping a cookie. If you have questions about, or need further information concerning, the legal basis on which we collect and use your personal data, please email dpo@nextroll.com. European Residents’ Privacy Rights: In addition, if you are a resident of a European Territory, you have the following data subject access rights under EU data protection law: <ul> <li>If you wish to access, correct, update or request deletion of your personal data, please visit our privacy requests webpage to obtain a verifiable request form.</li> <li>If you wish to object to us processing your personal data or would like to otherwise restrict the processing of your personal data, we will honor that request. Please visit the Your Choices and Opting-Out of Interest-Based Advertising and Analytics portion of this Service Privacy Notice to select the best opt-out method for you.</li> <li>Similarly, if we process your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. You can also refuse consent for NextRoll or our Advertising Partners to drop cookies by visiting our opt-out page or by refusing consent for NextRoll (or changing your consent preferences) when you see a “consent banner” displayed on a Customer site which lists NextRoll as a vendor.</li> <li>You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Territories are available from the European Data Protection Board website. However, if you have any questions about our collection and use of your personal data, we encourage you to contact us first at support@nextroll.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@nextroll.com.</li> </ul> In some cases, we act as a processor for our Customers (for example, when we handle our Customers’ CRM data solely to provide them Services) and, in those cases, you should direct any requests to exercise your data protection rights to the relevant Customer. If you are uncertain whether we process your personal data as a controller or a processor in any specific context, you can contact us at support@nextroll.com and we will advise you accordingly. 13. Information For California Residents Only Back to top This section supplements the information contained in this Service Privacy Notice and applies solely to visitors, users and others who are residents of the State of California, as defined in Section 17014 of Title 18 of the California Code of Regulations. This section is effective as of January 1, 2020, to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this section. Information We Collect and the Purposes for Which this Information is Used We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). This collection of information is listed in What Data We Collect. We set out below the CCPA categories of personal information we have collected from consumers within the last twelve (12) months in respect of our Services. Please note that personal information in certain categories may overlap with other categories. Category Collected Details Source A. Identifiers Yes Device IP address, email address, cookie string data, pseudonymous data (e.g. hashed emails), operating system, and your device type, and mobile device's identifier (such as the Apple IDFA or Android Advertising ID) and any other unique identifier that may be assigned to any device by third parties and cross-referenced to recognize a device. Directly and indirectly from consumers, third party data providers, ad exchanges, supply-side platforms and Audience Partners. In the case of business email addresses, RollWorks B2B Services may infer a business email address. B. Personal information listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) Yes Name, business address, business telephone number, education, employment, employment history, household income.the perceived general education level of consumers may be collected for marketing, advertising and analytics. Directly from third party data providers and Audience Partners. C. Protected classification characteristics under California or federal law Yes Limited to age ranges such as 35-44, 45-54, 55-64 and 65+ and male/female gender categories are sometimes collected for use for NextRoll Services that do not carry a risk of unintended discrimination. From Audience Partners. D. Commercial information Yes Records of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies. Directly from consumers and Customers. E. Biometric information No - - F. Internet or other similar network activity Yes Browsing history, search history, information on a consumer's interaction with a website, application or advertisement. For example, which pages you visited and when, what items were clicked on a page, how much time was spent on a page, whether you downloaded a white paper on a B2B website, what items you placed into your online shopping cart, what products were purchased and the price of the products purchased. Directly from browsing history on Customers’ Digital Properties. Non-personal information about one of our ads (e.g. the third party who served the ad, and the name of the ad) may be connected with browsing history or activity on our websites for the purposes of determining attribution information (e.g. whether particular ad led to a consumer visiting our website, and, if so, which particular ad campaign). G. Geolocation data Yes Non-precise geolocation derived from IP address. Directly from consumers, ad exchanges, publishers and supply-side platforms and audience partners. H. Sensory data No - - I. Professional or employment-related information Yes Current or past job history, including details about the employer (industry, name, company location, company domain or URL), and employee (positions held, duration of employment, and office location of the company where the employee worked). TThird party data providers and audience partners. J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R Part 99)) No - - K. Inferences drawn from other personal information Yes Creating profiles that reflect consumer preferences and interests. Audience partners. For clarity, under CCPA personal information does not include: <ul> <li>Publicly available information from government records;</li> <li>De-identified or aggregated consumer information. and</li> <li>Information excluded from the CCPA's scope such as: <ul> <li>health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data. and</li> <li>personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.</li> </ul> </li> </ul> Purposes for Which Personal Information is Collected NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their businesses. All data we collect is for the business purpose of providing services primarily for our marketing, advertising and analytical Services. However, as part of performing these Services, we also use data collected (as identified above) for the following additional business purposes: <ul> <li>Auditing Interactions with Consumers: count ad impressions and verify the quality of ad impressions served to unique visitors identified by cookie id or other unique identifier;</li> <li>Debugging and Repair: the identification and repair of impairments to intended and existing functionalities in our Services and NextRoll Technology, perform debugging and related activities to repair errors that impair the functionality of our Services;</li> <li>Security: detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities;</li> <li>Internal Research and Development: conduct internal research for technological development of our Services and demonstration of the performance of these Services. and</li> <li>Quality and Safety Maintenance and Verification: verify the quality or safety of our Services and improve, upgrade or enhance our Services and NextRoll Technology we provide.</li> </ul> For more information on how we use this data, please refer to How We Use the Data We Collect. Sharing Personal Information We may disclose your personal information to a third party for a business purpose (as set out above) or sell your personal information, subject to your right to opt-out of those sales (See Personal Information Sales Opt-In Rights). The Data Sharing section sets out the personal information that we share with third parties. Disclosure of Personal Information for a Business Purpose With the exception of our RollWorks B2B Contact Data, NextRoll’s Services do not amount to a sale of personal information . Instead, to the extent that NextRoll discloses personal data to third parties, it does so for business purposes , primarily to perform its advertising, marketing and analytical Services, but also for the purposes set out in Purposes for which Personal Information is Collected above. However, NextRoll always provides consumers with the ability to opt-out of interest based advertising (and control their data collection in additional ways). You may opt-out of interest-based advertising, which may constitute a sale of personal information under CCPA, by visiting https://app.adroll.com/optout or through the instructions provided in the Your Choices and Opting-Out of Interest-Based Advertising and Analytics Section of this Privacy Notice. In the preceding twelve (12) months, we have disclosed personal information for our business purposes: <ul> <li>Category A: Identifiers</li> <li>Category F: Internet or Similar Network Activity</li> <li>Category G: Geolocation</li> </ul> We disclose your personal information for a business purpose to the categories of third parties set out in Data Sharing. Sales of Personal Information In the preceding (12) twelve months, pursuant to our RollWorks B2B Contact Data Service, we have sold personal information in the form of business emails from Category A (Identifiers). Other than our RollWorks B2B Contact Data Service, we do not consider that our Services constitute a ‘sale of personal information’ under the CCPA. However, we will still honor requests from consumers to opt-out of the collection and disclosure of their personal information. Your Rights and Choices The CCPA provides California residents with specific rights regarding their personal information. This section describes the rights of California residents under CCPA and provides information on how to exercise those rights. Right to Know and Data Portability Rights You have the right to request that we disclose certain information to you about our collection and use of personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you: <ul> <li>The categories of personal information we collected about you;</li> <li>The categories of sources for the personal information we collected about you;</li> <li>Our business or commercial purpose for collecting or selling that personal information;</li> <li>The categories of third parties with whom we share that personal information;</li> <li>The specific pieces of personal information we collected about you (otherwise known as a data portability request). and</li> <li>Two separate lists where we have sold or disclosed your personal information for a business purpose: <ul> <li>Sales: identifying the personal information categories that each category of recipient purchased. and</li> <li>Disclosures for a business purpose: identifying the personal information categories that each category of recipient obtained</li> </ul> </li> </ul> Right to Delete You have the right to request that we delete any of your personal information that we collect from you and retain, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Right to Know, Data Portability and Right to Deletion), we will delete (and direct our services providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to: <ul> <li>Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relations with you or otherwise perform our contract with you;</li> <li>Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for such activities;</li> <li>Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided by law;</li> <li>Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);</li> <li>Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;</li> <li>Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;</li> <li>Comply with a legal obligation. and</li> <li>Make other internal and lawful uses of that information that are compatible with the context in which you provided it.</li> </ul> Exercising Right to Know, Data Portability and Right to Deletion To exercise the access, data portability and deletion rights described above, please submit the consumer request to us by either: <ul> <li>Calling us at 1-844-740-7126. or</li> <li>Visiting this webpage.</li> </ul> After submitting the request, a form will be sent to the requestor to verify the consumer request. On the verification form, the requestor must: <ul> <li>Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. and</li> <li>Describe the request with sufficient detail that allows us to properly understand, evaluate and respond to it.</li> </ul> Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may only make a verifiable request for access of data portability twice within a 12-month period. We cannot respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request. and (ii) confirm the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. As mentioned above in Sales of Personal Information, we have elected to honor sale opt-out rights. Please see Personal Information Sales Opt-Out and Opt-In Rights. Response Timing and Format We will deliver our written response to you electronically unless you indicate delivery to be by mail. Any disclosures we provide to you will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot complete a request, if applicable. Please note that personal information deleted during this period as set out in Data Retention will not be provided. The format of our responses to you concerning personal information collected, disclosed or sold will be provided in a readily useable format that should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. Personal Information Sales Opt-Out Rights To exercise the right to opt-out of our sale of your Contact Data or to opt out of interest-based advertising, you (or your authorized representative) may submit a request to us by visiting the Do Not Sell My Personal Information webpage. Non-Discrimination We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not: <ul> <li>Deny you goods or services;</li> <li>Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;</li> <li>Provide you a different level or quality of goods or services. or</li> <li>Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.</li> </ul> 14. Information for Individuals Located in Brazil Back to top Please view NextRoll’s disclosures pursuant to the Brazilian Data Protection Law, the Lei Geral de Proteção de Dados Pessoais (“LGPD”), here. 15. Changes to this Service Privacy Notice Back to top We may update or modify this Service Privacy Notice at our discretion and at any time. When we make changes to this Service Privacy Notice we will post the updated notice online and update the notice’s effective date. Please review this Service Privacy Notice periodically. If we are required by applicable data protection laws to obtain your consent to any material changes before they come into effect, then we will do so in accordance with law. 16. Contact Us About Questions Back to top If you have any questions about this Service Privacy Notice or our privacy practices, you can contact support@nextroll.com. If you are located in a European Territory then, where we process your data as a data controller, NextRoll Limited is the data controller of your information. To contact NextRoll Limited please email support@nextroll.com or write to us at the following address: NextRoll Limited Attn: Legal Level 6 1, Burlington Plaza Burlington Road Dublin 4, Ireland If you wish to escalate your inquiry after contacting the support team, you are welcome to contact our Data Protection Officer at dpo@nextroll.com: Lucid Privacy Group NextRoll Data Protection Officer 1050 Page Street San Francisco, CA 94117 USA