What Xandr is doing in response to COVID-19. Learn More.
xandr

Digital Platform Privacy Policy

Last modified: March 24, 2020 

Xandr, an AT&T company (“Xandr”) provides an advertising technology that allows websites, apps and other internet-connected properties to generate revenue by showing advertisements to their users, and allows marketers and other advertisers to show advertisements to individuals online who may be interested in their products or services. This policy explains how we collect, use, and disclose information through our digital advertising technology platform (the “Platform”). If you are interested in learning how we collect, use, and disclose information through other corporate activities, such as on our corporate website, Xandr.com, please click here.

Our goal is to be transparent about our business by describing our technology and services in simple terms so that you can understand our practices. We know this is complicated, so if you have any questions about this information, please contact us here.  We also created an Online Advertising and Ad Tech Glossary if you want to learn more about our technology, our services and more generally about the advertising technology ecosystem.

Overview

Below we provide an overview of our practices and where you can find more information.

What information do we collect and use? The Platform is designed to collect and use only Platform Data (as defined below) as described in this document. Details.
How do we collect information? The Platform uses cookies, beacons, pixels, tags, mobile SDKs, and other non-cookie technologies to collect and store Platform Data about web browsers and devices across web sites and apps and over time. Details.
For what purposes do we use the collected information? Xandr uses the information collected on the Platform to provide, operate, manage, maintain, and enhance the Platform and allow our clients to use our Platform. This means facilitating: serving of ads, including interest-based advertising by our clients and partners; facilitating serving of ads based on precise geographic location information; reporting on ad delivery and conversions; providing frequency capping and recency measurement; using information for fraud detection and the prevention and detection of malicious behavior and maintaining and enhancing our services including through the use of information for machine learning, optimization and statistical analysis. Details.
What information do we share with third parties? Where permitted, we provide clients and their third-party providers access to their Platform Data that they collect, acquire, or use on the Platform, and typically they may remove it from the Platform for their own use. For a current list of third-party providers who may, subject to our clients’ permission, receive your data, see here. Xandr may also provide Platform Data to partners and service providers for the purpose of operating, managing, maintaining, or enhancing our services, including for the safety and security of the Platform and the online industry, or as required by law. Xandr does not share the information collected on the Platform with other third parties, unless legally required. Details.
How is the information stored and how long is it kept? Platform Data is stored using generally accepted security standards. It is usually aggregated or deleted within 3-60 days but may be retained in the Platform for up to 18 months from the date of collection before aggregation or deletion. Details.
What are your choices and rights? If you are a resident of certain jurisdictions, you may have certain rights and protections under a particular jurisdiction’s law regarding the collection, processing, and use of information about you. This policy describes the rights that may be available to you, and how you can implement them. Details.

Regardless of where you live, Xandr provides several options for you to choose how you want to interact with the Platform and respects user choices provided by certain apps and device-system software. Specifically, you may be able to: (i) opt out of having the Platform used to select ads for your browser based on your online web browsing behavior, (ii) opt out of the use of information about your usage of mobile apps for targeted advertising purposes, based on choices made available to you by those apps and your mobile device, and (iii) opt out of the collection of certain forms of location information, based on preferences available to you on your mobile device.  Details.

If you have questions about privacy on the Platform, you can send us a message here.

What are your California Privacy Rights? If you are a California consumer as defined by the CCPA (as defined below), you may have the right to: (i) request access to your personal information and request additional details about our information practices, (ii) request deletion of your personal information, (iii) opt out of the “sale” of your personal information (as that term is defined by the CCPA), and (iv) to not be discriminated against for exercising any of your rights under the CCPA.  Your options regarding the personal information we collect or receive about you are described in “Your Choices and Rights” below. You may also call us at 1-855-546-1015. Details.
What are your rights and protections in European Countries? If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “European Countries”), you have certain rights and protections under applicable law regarding the processing of your “personal data” as defined under applicable law. Some of the Platform Data that Xandr maintains in its Platform may constitute “personal data” under these laws. Details.
Where do we operate? Xandr is a global company headquartered in the United States with data centers located in the United States, Europe and Asia. If you access any of the Digital Properties  (as defined below) that use our technology, please be aware that your information may be transferred to, stored and processed by us and our affiliates in our facilities in the United States and other countries (including in Singapore, Japan, Australia and Brazil where our global affiliates have offices) and by those third parties with whom we may share your information. Details.
What happens if this privacy policy is changed? Check this page for changes. We may change this privacy policy at any time. If we make changes that, in our sole discretion, are material, those changes will not be applied to information collected prior to the date the changes went into effect.
Questions? If you have questions about privacy on the Platform, you can send us a message here.

 

Introduction to the Xandr Platform

Xandr provides a digital advertising technology Platform . Websites, mobile apps and publishers of other internet-connected digital media properties such as internet-connected TVs (each a “Digital Property” and collectively“Digital Properties”) use the Platform to sell ad space on those properties. Advertisers or companies on the advertiser’s behalf, use the Platform to purchase that ad space in the most efficient way possible. The Platform also allows Digital Properties and advertisers to do other things, like measure the effectiveness of their ads, to help prevent malware or other bad activity, and similar functions designed to make the buying and selling of ad space seamless, efficient, and effective.


Information Xandr Collects

When you (an internet user) visit a Digital Property that has integrated our Platform or that uses technology that integrates with our Platform, we collect certain information about your visit. This policy refers this information as “Platform Data”, and includes the following:

  • Information about your browser including: the type of browser you use, browser language, browser settings, and cookie information.
  • Information about your device including device operating system version, connection type, device make, device model, device Identifiers such as your IDFA or AAID, and the IP address from which the device accesses a client’s Digital Property.
  • Precise geographic location information when location services have been enabled for an app on your device that has integrated our technology or that sends that information to our Platform.
  • Information about your activity on a Digital Property including web pages or apps visited or used and the time those web pages or apps were visited or used.
  • Information about ads served, viewed or clicked on, including the type of ad, where the ad was served, whether you clicked on it and whether you visited the advertiser’s website or downloaded the advertiser’s app.
  • Information about your internet service including information about which internet service provider is used by you.

The information we collect does not reflect your name, email address, or other information that directly identifies you, and we take care to ensure that we do not collect any information that tells us who you are.

Xandr’s Platform allows Digital Properties, advertisers, and others to buy and sell data to help make the ads that you see more relevant. Advertisers may share with us information about your interests or demographic information (your age or gender) that they have collected directly from you and from third parties, and they may use that information on our Platform to help make the ads served to you more relevant or for other purposes.


How Xandr Collects Platform Data

When you first visit a Digital Property, we assign a random unique identifier (an “AppNexus ID”, or “Xandr ID”) to your browser or device, which allows the Platform to automatically recognize your browser or device the next time it visits another Digital Property that has integrated our technology.  This allows our clients and partners to sync their own unique identifiers against this ID so that they can use their own data on the Platform that they may have associated with you (collectively “Digital Identifiers”).

The Platform uses cookies, beacons, pixels, tags, mobile SDKs, and similar technologies to collect this information. For a detailed description of cookies and similar technologies set by the Platform, see the Xandr Digital Platform Cookie Policy.


How We Use the Information We Collect

We use, and allow our clients to use, the information we collect for the following purposes, some of which are “business purposes” under California law:

  • For our legitimate business interests to provide services to advertisers and owners of Digital Properties, including providing and operating our services which includes:
    • Compiling statistics about the advertising transactions occurring through our Platform and conducting research and development for our own internal business purposes, such as analyzing campaign forecasts and conducting machine learning to help our clients improve their sales of ad space and delivery of ads to you
    • Analyzing and reporting on campaign and ad performance, such as reporting to advertisers about when and how you have been exposed to ads or clicked on ads, and reporting to Digital Properties information about when and how ads were shown on their Digital Properties and whether they were clicked on
    • Investigating, protecting against and deterring malicious activity, fake traffic or fraudulent, unauthorized or illegal activity on the Platform and on the internet
  • Hands on help: The Platform enables Xandr’s clients to collect, buy, and sell data and to use Platform Data to buy and sell online advertising. Sometimes, Xandr staff gives hands-on help to clients use the Platform for these purposes, for example by configuring advertising campaigns for clients to best meet their objectives.
  • Allowing our clients to use Platform Data for the following advertising-related purposes:
    • Interest-Based Advertising: Using Platform Data to infer what you may be interested in and to serve ads to you based on these inferred interests.  Our clients may use their Platform Data to create interest profiles about you.
    • Frequency Capping: Limiting the number of times you see an ad so you don’t see the same ad or type of ad too many times
    • Showing Ads in Sequence: Showing you ads in a particular order to provide a better user experience
    • Geo-Targeting: Customizing ads shown to you based on your current or prior location
    • Contextual Ads: Showing ads to you based on the content you are viewing
    • Ad Measurement: Understanding how users respond to ads (e.g., clicking on the ad)
    • Aggregated Statistics: Reporting aggregated statistics regarding, for example, the effectiveness of online advertising campaigns
    • Cross-Device Mapping: Enabling Cross-Device Mapping in order to serve or measure advertising on related devices on behalf of our clients.

 

Typically, companies using the Platform own the data that they provide to and get from the Platform. While we take care to obtain assurances from our clients and partners that their use of Platform Data will comply with applicable laws, when clients remove data from the Platform, their use of that data is governed by their own privacy policies and applicable laws, rules, or regulations.


How and Why We Share the Information We Collect

We share the information we collect with third parties as follows:

  • Clients and Third-Party Providers: When you visit a Digital Property and that Digital Property wants to show you ads, and, in order to show you those ads, the Digital Property may allow certain third parties to access your device or receive and use the information noted above under “What Information do we collect and use.”
    • When our clients integrate our technology in order to show you ads and enable us to collect your data, other than for the reasons noted in this section below, we do not decide which third parties may receive your data.
    • We share information with advertisers and third-party providers in accordance with the Digital Property’s instructions so that they can decide whether to bid on ad inventory or serve an advertisement and choose the best ad for you using their data and our and our partners’ technology.
    • This shared information may also be used to create demographic and interest profiles to help our clients choose the best ad for you
    • These advertisers and third-party providers may use the information we provide to improve their products and services for use by us and others across the broader online advertising ecosystem (e.g. your Device Identifier may be used to improve fraud detection services).

 

  • Service Providers (including data centers, hosting providers, anti-fraud, technology and security providers): We share with Service Providers (or enable their collection of) Platform Data so that they can perform functions and provide services to us including for purposes of protecting the safety and security of the online ecosystem, including to detect and prevent malicious activity or fake traffic. Our Service Providers are subject to obligations consistent with this Privacy Policy and appropriate confidentiality and security measures.

 

  • Legal Rights and Compliance with Law: We may also disclose Platform Data in the event that we reasonably suspect malicious activity or fake traffic or when we reasonably believe it is required by law, subpoena or other legal process, including to meet national security or law enforcement requirements.

 

  • Affiliates: We share Platform Data with other companies in the Xandr and AT&T Inc. group of companies, including WarnerMedia, Warner Bros. and Xandr’s parent company AT&T for use in accordance with this Privacy Policy. Xandr receives data from our affiliates for use in accordance with this Privacy Policy.

 

  • Business Transfers: We may transfer Platform Data to a successor entity in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change.

 

  • Aggregated Data: We may also share aggregated data derived from the Platform, including, for example, statistics about Platform activity.


Your Choices and Rights

If you reside or are located in certain jurisdictions, you may have rights and protections regarding the collection, processing, sharing, and use of your data under a particular jurisdiction’s law. This may mean that you may have the right to:

  • Request access and obtain a copy of your data;
  • To request rectification of your data;
  • In certain circumstances, and subject to some specific legal reasons where we may need to retain data, to request that your data be deleted or erased;
  • To opt out of the sale of your data to third parties;
  • If applicable, to enforce your right to data portability;
  • To object to the processing of your data in certain circumstances;
  • Not be discriminated against for exercising your rights with respect to your data.

We explain how to exercise these rights below.


Opt Out of Interest-Based Advertising

Web Browsers

You can visit privacycenter.xandr.com to opt out of having the Platform used to select ads for your browser based on your online web browsing behavior. When you opt out, an opt out cookie (from adnxs.com) will be stored in your web browser. The Platform will know the choice you have made when it sees your opt out cookie, and will apply your choice to all companies using the Platform. If you block or delete the opt out cookie, you will not be opted out and will need to allow cookies from Xandr and renew your opt out choice.

To review your opt in status or learn more about interest-based advertising, please visit the Network Advertising Initiative opt out page, the DAA’s WebChoice tool or the DAAC’s WebChoices tool.

Important things to note about the web browser opt out:

  • Blocked cookies: The opt out cookie may not work if your browser is configured to block third-party cookies.
  • Deleting or protecting opt outs: If you delete your cookies, you will need to opt out again. There are browser plugins to help you preserve your opt out cookies. For more information, please visit http://www.aboutads.info/PMC.
  • Only this browser: The opt out only applies to the browser profile in which you set it. For example, if you set the opt out while using Firefox, but then use Chrome, the opt out will not be active in Chrome. To opt out in Chrome, you will need to repeat the opt out process. This is because the cookies cannot be read between different browsers or browser profiles.
  • The opt out does not block or delete cookies: It also does not prevent the use of cookies or other technologies for purposes other than selecting ads based on your interests as inferred by your online behavior. If you opt out, data may still be collected about your web browsing activities and you will still see advertising. Ads may be selected, for example, based on the content of the web page in which they are shown. If you wish to block or delete cookies altogether, you can use web browser settings to do so.

Mobile Apps

Mobile device system software such as Apple iOS or Google Play Services provide mechanisms that allow users to opt out of the use of information about their usage of mobile apps to deliver targeted ads to their mobile device. For more information, or to opt out using these mechanisms, consult your device settings (“Opt out of Personalized Ads” on Android devices and “Limit Ad Tracking” on iOS devices).

Location Data

Most mobile devices offer you the ability to stop the collection of location information at any time by changing the preferences on your device.  You may also be able to stop the collection of location information by particular apps by adjusting the settings for individual apps or following the standard uninstall process to remove specific mobile apps from your device.  Note when location services have not been enabled in any of your apps, we will still infer data about your location based on your IP address.

Televisions

Your internet connected device (e.g. a smart TV or a set- top box) may give you the ability to opt-out of the use of information for advertising purposes.  To determine if your Internet connected device has these options, please visit your device’s settings menu. Xandr reads and applies industry opt out signals for connected televisions.

AT&T Customers

If you are an AT&T subscriber, you have the choice to opt out of the use of information about your use of AT&T services for advertising purposes. In order to exercise these choices, visit AT&T’s privacy page.

Access Rights

If you reside in certain jurisdictions, you may have the right to access the data we hold about your devices. If you are interested in exercising any of these rights, please click here. Note that because we do not collect that directly identifies an individual (and prohibit clients from storing this information) on the Platform, it is generally not feasible for us to provide individuals information that is tied to their identities.

Deletion Rights

If you reside in certain jurisdictions, you may have the right to delete the data we hold about your devices. If you are interested in exercising any of these rights, please click here. Note that you can delete your cookies at any time by using your browser settings. You can also reset the advertising identifier in your mobile device at any time by using your platform setting referenced in Mobile Apps above.

Industry Self-Regulation

Xandr supports industry self-regulation, and endorses best practices and self-regulatory requirements that apply to the Platform. Xandr/AppNexus is a member in good standing of the Network Advertising Initiative (“NAI”) and adheres to the NAI Code of Conduct for Web and Mobile. Xandr/AppNexus also follows the industry self-regulatory guidelines of the Digital Advertising Alliance (“DAA”) and the Digital Advertising Alliance of Canada (“DAAC”). The following links are lists of the Xandr-provided interest segments that are available on the Platform for use by Xandr’s clients in creating tailored advertising based on health related information or interests and political information or interests.

Additionally, the following industry sites provide useful information about industry self-regulation of interest-based advertising:


Our Global Operations

Xandr is a global company headquartered in the United States with data centers located in the United States, Europe and Asia. If you access any of the Digital Properties that use our technology, please be aware that your information may be transferred to, stored and processed by us and our affiliates in our facilities in the United States and other countries (including in Singapore, Japan, Australia and Brazil where our global affiliates have offices) and by those third parties with whom we may share your information.

These countries (including the United States) may not provide an adequate level of data protection for your information (as determined by the European Commission for personal data in its jurisdiction) or have data protection or other laws as comprehensive as those in your country. Please see “Information for Residents of European Countries” below for information on how we protect information that is transferred out of the European Economic Area, United Kingdom, and Switzerland.


Information for California Consumers: Your California Privacy Rights

The California Consumer Privacy Act or “CCPA” (California Civil Code Section 1798.100 et seq.) applies to the collection, use, and disclosure of “personal information” collected from California “consumers” (as those terms are defined by the CCPA). Some of the Platform Data that Xandr maintains may constitute “personal information” under the CCPA. Consequently, the CCPA requires us to disclose to California consumers the categories of personal information (as defined in the CCPA) we collect, our business and commercial purposes for collecting, using, or selling such personal information, the categories of sources from which we collect personal information, the categories of personal information we have disclosed or sold for a business or commercial purpose in the preceding 12 months, and the categories third parties with whom we share personal information. We have provided these disclosures in the“Information Xandr Collects,” “How We Use the Information We Collect,” and “How and Why We Share the Information We Collect” sections above.

If you are a California consumer as defined by the CCPA, you may have the right to: (i) request access to your personal information and request additional details about our information practices, (ii) request deletion of your personal information, (iii) opt out of the “sale” of your personal information (as that term is defined by the CCPA), and (iv) to not be discriminated against for exercising any of your rights under the CCPA.  Your options regarding the personal information we collect or receive about you are described in the Your Choices and Rights section above. You may also call us at 1-855-546-1015.

 

Please note that if you wish to exercise any of your rights with any of Xandr’s clients, you must make your request directly to those Xandr clients, based on information and procedures that they supply.  Xandr clients own the Platform Data that they maintain in the Platform.  Xandr does not control how those clients use Platform Data.

 

Do Not Sell My Personal Information

Some of our clients may use our Platform to buy and sell personal information as defined by applicable law. We give you the ability to opt out of the use of our Platform for these purposes as described in the “Opt Out of Interest-Based Advertising” section above. Xandr never sells any Platform Data pertaining to any individual that Xandr knows is a minor under applicable laws.


Information for Residents of European Countries

 

If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “European Countries”), you have certain rights and protections under applicable law regarding the processing of your “personal data” as defined under applicable law. Some of the Platform Data that Xandr maintains in its Platform may constitute “personal data” under these laws.

 

Role of Xandr as a Controller or Processor

 

If you are located in one of the European Countries, Xandr may act a “controller” as defined under applicable law when processing your personal data. Xandr may also act as a “processor” as defined under applicable law to the extent that it processes your personal data on behalf of and at the instruction of another party, for example a Xandr client.

 

Legal Basis for Processing

Xandr’s legal basis for processing your personal data depends upon the specific context in which we collect or use it. We normally rely on our legitimate interests to collect and use personal data, except where our interests are overridden by your data-protection interests or your fundamental rights and freedoms. Our legitimate interests are described in greater detail in the “How We Use the Information We Collect” section of this policy. These legitimate interests include the operation of our Platform and business and the provision of our online advertising technology services to our clients as required by our agreements with them. In some cases, we may rely on your consent which is obtained for us by the operator of the Digital Properties that use our technology or use technology that interacts with our Platform. If we rely on consent to process your data, we will obtain such consent in compliance with applicable laws. Additionally, we may have a legal obligation to process personal data.

Your Rights

If you are located in one of the European Countries, you may be entitled to exercise certain data-subject rights available under applicable laws. These rights may include the right to request access to personal data we hold about you. You may also have the right to object to, or request that we restrict, processing of your personal data. You may also have the right to ask that your personal data be corrected, erased, or transferred to another party. If you would like to exercise any of these rights, you may do so as explained in the Your Choices and Rights section above.

Data Transfers and Privacy Shield

When Xandr transfers your personal data to group companies or third-party service providers outside of the European Countries, we ensure that appropriate protections are in place under European data protection legislation (which includes either Model Clauses or Privacy Shield compliance).  For example, in order to ensure that your personal data is adequately protected when transferred outside of the European Countries, Xandr has entered into inter-company “model clause” agreements and other adequacy arrangements with other various entities located outside the European Countries with whom we share your information. A copy of such agreements is available on request.

Additionally, if we transfer personal data from the European Union to the United States or Switzerland to the United States, we comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union and Switzerland to the United States, respectively. Xandr (under AppNexus) has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

For any questions or complaints regarding our compliance with either the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework, please contact us here. If Xandr does not resolve your complaint, you may submit your complaint free of charge to ICDR/AAA, Xandr’s designated independent dispute resolution provider. Under certain conditions specified by the principles of the EU-U.S. and the Swiss-US Privacy Shield Frameworks, respectively, you may also be able to invoke binding arbitration to resolve your complaint. Xandr is subject to the investigatory and enforcement powers of the United States Federal Trade Commission (“FTC”). If Xandr shares the personal data of an individual located in the EU or Switzerland with a third-party service provider that processes the data solely on Xandr’s behalf, then Xandr will be liable for that third-party’s processing of that data in violation of the Principles, unless Xandr can prove that it is not responsible for the event giving rise to the damage.

IAB Europe Transparency and Consent Framework

If you are located in one of the European Countries and visiting a Digital Property, we are registered as a vendor with, support and encourage our clients to use the IAB Europe Transparency and Consent Framework (the “Industry Framework”) to provide you with dynamic transparency into and choice about the various third parties our clients use to serve you ads, including ourselves. When you visit a Digital Property, the Industry Framework is designed to allow a Digital Property the means to choose which vendors they wish to allow to access your device and process your personal data and provide dynamic transparency and choice to you about each of these vendors (either an opportunity for you to consent to the vendor or opt out of data processing by the vendor depending on that vendor’s legal basis and processing activities).

 

Questions or Complaints

 

If you are in one of the European Countries and have a question or concern about how we process personal data you can contact our Data Protection Officer here. If we are not able to resolve your issue, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see here.

Information Our Clients and Vendors Collect

Our clients, our Service Providers (as defined above), and our clients’ Service Providers who use our technology, may use their own tags, pixels, cookies, or other similar technology (or those of their other affiliates) within their advertisements and on certain Digital Properties. We are not responsible for our clients, vendors and/or our clients’ vendors use of such tracking technologies or for their privacy practices.


Retention

We never store any information longer than we need it. Platform Data is usually aggregated or deleted within 3-60 days but may be retained in the Platform for up to 18 months for specific clients and for security and the detection and prevention of fraud and invalid traffic from the date of collection before aggregation or deletion.  When we no longer need the information we collect, it is deleted or aggregated. Aggregated information is used for reporting and analysis and may be stored in the Platform for up to 2 additional years.

When partners receive information through us or clients remove their information from the Platform, their storage and retention of the removed information is governed by their own privacy policies and applicable laws, rules, or regulations.

Changes to this Privacy Policy

Check this page for changes. We may change this privacy policy at any time. If we make changes that, in our sole discretion, are material, those changes will not be applied to information collected prior to the date the changes went into effect.

Contact Us

If you have questions about privacy on the Xandr Platform, you can send us a message here.

If you are located in the European Countries, you can contact our Data Protection Officer here.

You can also contact us by post using the details provided below:

Xandr Inc.
Attn: Privacy Office
28 West 23rd Street, Fl 4
New York, NY 10010
USA