Privacy Policy<p>
</p>
<p>mediarithmics SAS is a marketing and analytics software editor.
mediarithmics solutions may collect and process personal data.</p>
<p>
</p>
<p>In the current context of Big Data and continuous technological evolution, we are aware that personal data processing requires software market players to take more and more responsibility.
As a consequence, we take privacy and personal data protection very seriously and commit to: </p>
<ul>
<li>Apply without exception the current regulations about personal data privacy,</li>
<li>Make it our duty to raise awareness, to advise and to control our Clients when using our solutions,</li>
<li>Ensure a complete transparency to end-users concerning the processing of their personal data.</li>
</ul>
<p>
</p>
<p>Regarding personal data management and processing, we take on two roles: </p>
<ol>
<li>Provider of a marketing software</li>
<li>Provider of a service to match device identifiers from third-party providers</li>
</ol>
<p>The hereunder policy details our commitments towards these two roles.</p>
<p> </p>
<p>
<strong>MEDIARITHMICS – MARKETING SOFTWARE PROVIDER</strong>
</p>
<p>
</p>
<p>We provide our Clients with software solutions through SaaS (Software as a Service) cloud services.
Every Client is given a dedicated instance and access.
mediarithmics acts as a Data Processor under the General Data Protection Regulation (GDPR).
</p>
<p> </p>
<p>
<strong>Principles for providing our Software Solutions</strong>
</p>
<p>
</p>
<ul>
<li>Strict isolation of our Client’s personal data</li>
</ul>
<p>Applying « Privacy by design » principles requires to strictly isolate the personal data collected by each Client using mediarithmics solutions.
Collected data is the exclusive property of our Clients.
mediarithmics makes no usage of its Client data, nor process any cross-Clients enrichments.</p>
<p>
</p>
<ul>
<li>Availability of all tools and services required for compliance</li>
</ul>
<p>mediarithmics solutions gather a package of services and features that enables regulation compliance and allows users to exercise their rights, including: </p>
<ul>
<li>Collection and consent management features</li>
<li>Services to access users’ personal data</li>
<li>Services to delete users’ personal data</li>
<li>Services to proceed to bulk deletions of personal data</li>
</ul>
<p>
</p>
<ul>
<li>Advisory duty and intransigence on our Client regulation compliance</li>
</ul>
<p>We require our Clients to strictly comply with the current regulations on personal data protection when they use our software solutions.
</p>
<p>In order to support them, we offer our expertise and advice on how to implement and configure our solutions.</p>
<p>As a Data Processor, we also have a duty to alert whenever we notice a usage that seems noncompliant, either on data collection or data processing.</p>
<p>
</p>
<p>
<strong>Description of our Software Solutions</strong>
</p>
<p>
</p>
<p>mediarithmics software solutions are part of a complete and integrated marketing platform.
Acting as a Data Controller under the GDPR, our Clients are responsible for their usage of our solutions, regarding the data they collect, or the features they use.
</p>
<p>
</p>
<p>This usage must be defined and detailed in a Record of processing activities, which should include: </p>
<ul>
<li>The description of collected data and the storage duration</li>
<li>The purpose that justifies the collection</li>
<li>The list of mediarithmics features that are used to process this data</li>
</ul>
<p>
</p>
<p>To ensure transparency and provide web users with information on our solutions, we detail below the possible usages our Clients may operate.</p>
<p>
<strong>Those descriptions may not reflect our Clients reality: to get the most accurate information, please refer to the privacy policies of their respective supports.
</strong>
</p>
<p> </p>
<p>Purposes</p>
<p>We recommend our Clients to use our software solutions to serve two purposes: </p>
<ul>
<li>To improve their customer, prospects or user knowledge by understanding their behaviours and expectations</li>
<li>To offer personalized marketing content to their customers, prospects or users</li>
</ul>
<p>
</p>
<p>Collected data</p>
<p>Clients can collect various natures of data using our solutions: </p>
<ul>
<li>Activity history (e.g.
metadata coming from the websites or mobile applications browsing history, exposure to advertising campaigns, etc.)</li>
<li>User profiles (e.g.
age range, gender, etc.)</li>
<li>Emails</li>
<li>Device advertising identifiers (cookies, mobile identifiers)</li>
<li>Customer identifiers (CRM id, etc.)</li>
<li>Hashed emails identifiers</li>
<li>Precomputed audience lists</li>
</ul>
<p>
</p>
<p>Each nature can be used to collect standard information (e.g.
« URL » for browsing activity, « Gender » for a given profile, etc.) or specific information (« Product universe » for an e-commerce company, « article category » for a news website, etc.).</p>
<p>
</p>
<p>The collected data may be pseudonymized (e.g.
cookie identifier) or fully identifiable (e.g.
email).
</p>
<p>
</p>
<p>When setting-up our software solutions, each of our Clients configures the data they wish to collect (with the legal obligation to inform end-users and obtain their consent before capturing).
</p>
<p>
</p>
<p>We strictly forbid the use of our solution to collect and process sensitive data as defined in the GDPR.
</p>
<p>
</p>
<p>Usable features</p>
<p>The features available within our software solutions can be related to the following categories: </p>
<ul>
<li>Data collection from different channels: embedded scripts in web pages, queries on mediarithmics public APIs from servers or mobile applications, flat-files transmissions</li>
<li>Segmentation: user lists built by queries on collected data</li>
<li>Web site and mobile application advertising campaigns (which can target lists of users identified by their cookies or mobile advertising identifiers)</li>
<li>Email advertising campaigns (which targets users using their emails)</li>
<li>Transmission of user lists to third party providers (e.g.
to broadcast an advertising campaign with another provider)</li>
<li>Data exploration and analytics</li>
</ul>
<p>
</p>
<p>As for collected data, our Clients are legally obliged to inform the users about features they use to process their personal data.
</p>
<p>
</p>
<p>
<strong>Consent management, user communication</strong>
</p>
<p>
</p>
<p>Each of our Clients, acting as a Data Controller under the GDPR, must: </p>
<ul>
<li>Inform its users about the data they collect, the storage time and the processing of the data</li>
<li>Obtain user consent to collect and process personal data</li>
<li>Enable users to exercise their rights to access, modify and delete their personal data</li>
</ul>
<p>
</p>
<p>mediarithmics provides its clients with the necessary tools to fulfil their obligations, including a consent management and traceability system, and automated services to access, edit and delete data.
</p>
<p>Each Client defines the way these services are exposed to end-users and is legally obliged to enable them to comply with the regulation.</p>
<p>
</p>
<p>
<strong>Exercising your rights</strong>
</p>
<p>
</p>
<p>Your rights of data access, edition, opposition and deletion must be exercised directly against our Clients, as well as the consultation of the consents you gave.</p>
<p> </p>
<p>
<strong>Personal data security and storage</strong>
</p>
<p>
</p>
<p>mediarithmics implements state of the art practices to ensure personal data security, including: </p>
<ul>
<li>Enforcement of security principles at each step of the software creation process, from conception and development to maintenance</li>
<li>“Defence in depth”: each software layer is secured (applications, infrastructures and networks)</li>
<li>Encryption of communications</li>
<li>Physical separation of the databases hosting cookies and mobile identifiers in databases from the databases storing the rest of personal data</li>
</ul>
<p>
</p>
<p>Personal data is hosted on dedicated servers within OVH datacentres in France.
</p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p>
</p>
<p>
<strong>MEDIARITHMICS – DEVICE IDENTIFIER MATCHING SERVICE PROVIDER</strong>
</p>
<p>
</p>
<p>Besides its software solutions, mediarithmics provides its clients with a service to reconcile, for a given device, the identifiers coming from multiple providers.
In this role, mediarithmics acts as a Data Processor under the GDPR.
</p>
<p>
</p>
<p>
<strong>Why do we offer this service? </strong>
</p>
<p>
</p>
<p>The need to match a device on different websites</p>
<p>Reconciling device identifiers from multiple providers is a prerequisite to:</p>
<ul>
<li>Allow clients that own several brands to reconcile the browsing history of their end-users on their multiple website domains / applications </li>
<li>Operate targeted campaigns on third party websites or applications</li>
</ul>
<p>
</p>
<p>Device identification</p>
<p>Assuming that the necessary consents have been given by the end-user, there are two ways to identify a device: </p>
<ol>
<li>In the case of mobile applications: through the advertising identifier of the device (« IDFA » for iOS-based systems, « AAID » for Android-based systems).
</li>
<li>In the case of websites: through an identifier embedded in a cookie.
</li>
</ol>
<p>
</p>
<p>In the first case, the advertising identifier can be accessed within any application on the device, with a unique value: it is therefore possible to reconcile a given device from an application to another and exchange information between providers (e.g.
between an application selling advertisement inventory and advertisers buying this inventory).</p>
<p>
</p>
<p>In the second case, the advertising identifier is embedded in a cookie, stored in a web browser.
This cookie may only be read by the website that wrote it: this website can be the one you are browsing (in this case it will be a « first-party » cookie) or a third-party website (in this case, a « third-party » cookie).
</p>
<p>Therefore, in order to reconcile a device browsing two different websites or in order to exchange information between providers, third-party cookies with third-party identifiers must be used.</p>
<p>
</p>
<p>mediarithmics ensures a matching of third-party identifiers for a given device and offers it as a service, allowing to reconcile a device browsing websites on different domains and expose it to targeted ads.
</p>
<p>
</p>
<p>
<strong>Service usage principles</strong>
</p>
<p>
</p>
<p>This service is offered to each of our Clients.
Through the use of our generic scripts to collect website browsing activity, our Clients can enrich the service database and use it to identify a known web browser from one site to another.</p>
<p>
</p>
<p>To remain consistent with our software editor role, we do not sell this data.
The access to this service is included in our contracts for the marketing software solutions.
</p>
<p>
</p>
<p>
<strong>Description of the service </strong>
</p>
<p>
</p>
<p>Purpose</p>
<p>
</p>
<p>Match third-party cookie identifiers for a given web browser to reconcile its browsing activity on various websites and retarget it afterwards.</p>
<p>
</p>
<p>Operation of the service </p>
<p>
</p>
<ul>
<li>Collection and matching</li>
</ul>
<p>When our tracking scripts are loaded on web pages, they call the websites of our partners to get the identifiers they gave to the web browser.</p>
<p>If the identifiers are known, the device browsing activity will be linked to an existing device.
If not, the identifiers will be stored by the service for future use.</p>
<p>
</p>
<ul>
<li>Transmission to third party providers</li>
</ul>
<p>When our Clients share audiences (lists of users) with third-party providers, they may use this service to send identifiers that are already known by the provider.
</p>
<p>
</p>
<p>Processed data</p>
<p>
</p>
<p>In the scope of this service, we only process cookie identifiers, considered as pseudonymous personal data.</p>
<p>The third-party providers for which we operate this matching service include: Google DoubleClick, AppNexus, SmartAdServer, BidSwitch.</p>
<p>
</p>
<p>
<strong>Consent</strong>
</p>
<p>
</p>
<p>The collection and processing of your personal data in the scope of this service can only be operated under your consent.
</p>
<p>We ask our Clients to obtain the consent of their users, on the web sites on which they collect data, and in compliance with the regulation.</p>
<p>
</p>
<p>At any time, you can give or take back your consent.
</p>
<p>
</p>
<p>
</p>
<p>
</p>