Privacy Policy

1. Important information and who we are

This Policy sets out how MediaMath collects and processes personal data about you via the Platform, when you visit the Website, and when we engage in marketing activities based on contact information you provide to MediaMath through other means described in this Policy. It also sets out our practices regarding our use of such data, the steps we take to protect it, the parties with whom we share it, and the choices and rights that you have regarding how we collect and process personal data about you.

You should read this Policy carefully so that you are fully aware of how and why we are using your personal data.

MediaMath is a global provider of digital advertising media and data management technology. We provide a technology platform and services which help advertisers do a more effective job of reaching their targeting audiences. This technology delivers greater performance, transparency, and control to advertisers and a better Internet experience to users. As a Demand-Side Platform, our clients, which include advertisers and agencies, use our technology to purchase advertising, including display, video, social, native, and mobile ads, in an automated fashion. As a Data Management Platform, our technology enables our clients to control and activate data and provides them tools to onboard, segment and understand their data.

When MediaMath processes your personal data as a controller in the context of operating the Platform, the controller of your personal data is MediaMath, Inc. MediaMath, Inc. and MediaMath GmbH are both controllers of your personal data in instances where our clients have contracted with MediaMath GmbH. In connection to the Website and our marketing activities, the controller of your personal data is MediaMath, Inc.

MediaMath is an active member of the industry associations that govern policies around user privacy in the context of digital advertising, including: the Digital Advertising Alliance (“DAA”) in the US, EU, and Canada; the Data & Marketing Association in the US and the UK; the Network Advertising Initiative (“NAI”) (www.networkadvertising.org); and, at the time this Policy was written, the Interactive Advertising Bureau in Australia, Brazil, Canada, Europe, France, Germany, Mexico, Singapore, the US, and the UK. MediaMath complies with the DAA “Self-Regulatory Principles for Online Behavioral Advertising”, their “Application of Self-Regulatory Principles to the Mobile Environment, and the “2018 NAI Code of Conduct”. We believe that these programs’ principles help protect user privacy.

If you have any questions about this Policy, including any request to exercise your legal rights, please contact us as follows.

• If you are based outside of the European Economic Area ("EEA"):
  • By email to [email protected]
  • By post to MediaMath, Inc., Attn: Alice Lincoln, 4 World Trade Center, 45th Floor, New York, NY 10007.
• If you are based in the EEA, you may contact our data protection officer who is responsible for overseeing questions in relation to this Policy:
  • Melinda Clemans, Data Protection Officer, Chief Counsel, International
  • By email to [email protected]
  • By post to MediaMath UK Ltd, Attn: Melinda Clemans, 230 Blackfriars Road, London, SE1 8NW

You have the right to lodge any complaints you have regarding our processing of your personal data with a regulatory authority. We care about your privacy, and we appreciate the chance to address your concerns before you do so.

From time to time MediaMath may revise this Policy. The date of the last update can be found at the top of the Policy. If we make revisions that materially change or affect whether or how we collect or use personal data, we will notify you by email (if, as a user of our Website or recipient of our marketing communications, you have provided us your email address) or by means of a notice on our Website prior to the change becoming effective. If you would like to stay up-to-date on our most current policies and practices, you should review the Website periodically.

MediaMath’s products and services are not designed for children, and we do not knowingly collect personal data from or about any children. If we are made aware that we have received personal data from or about a child, we will use reasonable efforts to remove that data from our records.

This Policy relates solely to the personal data we collect and process about you in relation to our Platform, our Website, and other interactions you may have with MediaMath described in this Policy. MediaMath’s Website contains links to other sites, and the ads delivered by the Platform may run on a variety of other sites. Clicking on those links, accessing other sites, or enabling those connections may allow third parties to collect or share data about you. MediaMath does not control these third-party sites and is not responsible for the privacy practices of such other sites. You should refer to the privacy statements of such third-party websites to find out how they collect and use your personal data and whether and for what purpose they use cookies. Also, as explained below in Section 5, third parties may process personal data from you when you visit the Website. Such processing is governed by privacy statements of such third parties.

2. The data collected via the Platform

While MediaMath collects certain categories of personal data in the course of delivering an ad to you via the Platform, we do not intentionally collect data that reveals your real-world identity, such as your name, address, phone number, or any government identifiers such as your Social Security Number. Instead, MediaMath collects certain data about your computer or device through the use of cookies and other similar technologies, as explained below.

We may assign a unique identifier called a MediaMath ID to your browser, mobile device, or connected television and over-the-top television devices (“OTT TV Device”) when we serve an ad to it or you use it to access a client’s digital properties, including their websites, emails, apps, and websites, emails, and apps where their ads appear (“Digital Properties”). The MediaMath ID enables the Platform to determine within a reasonable level of confidence that a computer or device is the same as one with which the Platform has previously interacted. For example, the MediaMath ID allows us to determine that a browser or device to which we served an ad on Monday is likely to be the same browser or device for which we observed a purchase on Tuesday. In some cases, based on third-party data, we are able to infer within a reasonable probability that a particular computer or device should be associated with the same MediaMath ID. For example, a client may provide us with hashed personal data that (if unhashed) would reveal your real-world identity, and we may use that data to associate your devices with each other. Also, our partners may provide us with associations that they have made based on data they collect from you. Where we are able to make such inferences, we may use this information to deliver targeted ads across multiple computers or devices. This is sometimes referred to as cross-device advertising.

The MediaMath ID can be a cookie ID (a unique ID assigned randomly by MediaMath to an unrecognized browser), a mobile advertising ID (a unique ID assigned by the mobile operating system, e.g. Apple ID for Advertising or Android Advertising ID), an OTT TV Device Identifier for Advertising (a unique ID assigned by an OTT TV provider, e.g., Roku ID for Advertising), or a statistical ID (created by MediaMath). We use information about your computer or device to generate the statistical ID, including your operating system, user-agent string, Internet Protocol (“IP”) address, installed fonts, and similar information. This information makes your computer or device distinct enough for our systems to determine within a reasonable probability that they are encountering the same computer or device over time, including in environments where MediaMath cookies are not supported.

Your MediaMath ID is associated with other categories of personal data that we collect about you. These categories include the following:

• Bid Request Data and Impression Data: MediaMath collects personal data about you when we have the opportunity to show you an ad on Digital Properties and when we deliver an ad. We refer to this data as Bid Request Data and Impression Data, and we receive this data from media supply sources, such as publishers (i.e. organizations who operate Digital Properties) and exchanges or supply-side platforms who display ads on publishers' Digital Properties. This data includes: your imprecise location (e.g., country, region, postal code), browser type (e.g., Chrome or Internet Explorer); operating system (e.g., Mac OS or Windows); browser language (e.g., English or Spanish); IP address; Internet Service Provider (e.g., Comcast or Verizon); and either a MediaMath ID or an ID that one of our partners may assign to your browser or device, which we may associate with the MediaMath ID that we assigned to your browser or device. It also may include Precise Location Data, such as GPS-level latitude-longitude coordinates or location-based radio frequency signal triangulation. When we process Precise Location Data, the mobile app publisher or other media supply source is responsible for enabling you to provide or withdraw consent with respect to the collection and use of your Precise Location Data. Please check the settings of the mobile app and your device if you would like to change your preferences in relation to Precise Location Data.
• Pixel Data and Other Client Data: MediaMath clients may use the Platform to collect data regarding your interactions with them when you visit their Digital Properties. We also may collect the same data when you visit the Website. This includes information such as the time you visited the site, the page URL, your IP address, your browser type (e.g., Chrome or Internet Explorer), the operating system (e.g., Mac OS or Windows), the type of device you use (e.g. laptop or desktop), and data regarding your activities on the Digital Properties. For example, if you are shopping for a product online, place a product in your online shopping cart, or make an online purchase, the client associated with the website or app may use the Platform to collect that data and later show you an ad on a different site or app related to that product. MediaMath clients also may use the Platform to collect hashed personal data that (if unhashed) would reveal your real-world identity, such as hashed email addresses. We refer to everything described above as Pixel Data. Clients also may import data that they have obtained outside the Platform, such as segments that our clients create or obtain independently from other third-party sources. A segment is a grouping of users who share one or more attributes (e.g., “car enthusiast”). Clients also may import data that they may possess or independently obtain offline, such as data regarding a purchase you made in the client’s store. The client’s offline data is first processed by a third party, which removes any data that reveals your real-world identity, appends a MediaMath ID, and transmits the file to MediaMath for processing. We refer to this data as Other Client Data.
• Third-Party Segment Data and Other Third-Party Data: When they choose to provide it to us, we also receive personal data from third parties. We work with data providers who create and provide us with segments for our clients to use for advertising purposes. We refer to this as Third-Party Segment Data. We also send personal data to and receive personal data from third-party partners that allows them and/or us to associate the MediaMath ID with those partners’ identifiers (through a process called “cookie syncing”) as well as data that associates your different devices with each other. We refer to this data in the Policy as Other Third-Party Data.
• Special or Sensitive Categories of Personal Data: We do not knowingly collect any special categories of personal data about individuals in the EEA, including: personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; personal data concerning your health, sex life, or sexual orientation; and genetic or biometric data. MediaMath also does not knowingly collect any data about other sensitive categories such as personal data about children, financial account numbers, insurance plan numbers, and criminal convictions or offenses.

3. How data is collected via the Platform

The Platform uses various technologies to collect your personal data from Digital Properties. We also may receive your personal data directly from our clients and partners.

Like most digital marketing platforms, MediaMath uses cookies and other technologies to recognize computers and devices and collect the categories of data described above in Section 2 so that we and our clients are able to understand your interests, deliver more relevant advertising to you, measure the impact of that advertising, and better understand your digital media usage patterns.

The types of technologies used via the Platform that enable us, our clients, and our partners to identify a computer or device, and enable the Platform to function and serve more relevant ads include:

• Cookies – Cookies are small text files that contain a string of characters. MediaMath uses cookies to uniquely identify an Internet browser. Certain browsers or browser settings sometimes block cookies, and cookies may not work effectively on some mobile devices.
• Pixel Tags – Pixel tags are transparent images, iFrames, or JavaScript that we, our clients, and our partners use to understand how users interact with their Digital Properties.

As described above, we receive personal data from our clients and partners. Specifically, our clients and partners may send us segments that include you and personal data they have obtained about you, our partners may provide us with data that allows us to associate the MediaMath ID with unique identifiers that they may have and data that associates your different devices with each other, and media supply sources, such as publishers and the digital advertising companies with whom publishers work, may send us Bid Request Data and Impression Data. We receive this data in a number of ways, including through server-to-server transfers, a process called “cookie syncing” and other partner calls to MediaMath originating from the browser.

4. How the Platform uses data

We use the personal data that we collect to deliver more relevant ads to you. We also use it to improve our Platform and the products and services that we provide to our clients and partners, and to create new products and services. We have set out below a description of specific ways we use your personal data in the Platform.

As described above, a segment is a grouping of users who share one or more attributes. Our clients may use health-related segments about non-sensitive conditions such as an inferred interest in health and wellness or cough medicine and allergy medications. Click here for a list of the standard health-related segments provided for use by clients in MediaMath’s Platform.

While MediaMath does not knowingly create segments that are based upon what we consider to be sensitive information (for example, we do not create segments of EEA users based on personal data considered to be sensitive in the EEA, such as personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, personal data concerning your health, sex life or sexual orientation, or genetic or biometric data), our clients may use the Platform to process some sensitive data, which may come from our clients’ Digital Properties or our partners. We take steps designed to ensure that this is done in compliance with applicable laws and self-regulatory guidelines, including through our contracts and policies with our clients and partners.

The Platform uses proprietary algorithms to make decisions about whether or not to bid on opportunities to serve you ads and, if so, how much to bid. The ads you see are the result of client campaigns that specify how much to spend and on what basis to spend combined with the use of our algorithms. The ways in which we use algorithms to determine bid prices may be considered automated decision-making in certain jurisdictions. Additionally, these processes, in combination with client campaigns described below, may constitute profiling in certain jurisdictions.

As explained above, we assign a MediaMath ID to your browser or device. Using proprietary technology, we associate data that we collect about you with this MediaMath ID and create segments using inferred details about certain of your preferences, behaviors, and demographic information. Many of our clients’ campaigns rely on such segments. For example, if you are browsing a shoes website we may infer that you are interested in buying sneakers, and if your IP address is associated with a geographic range where the population is mostly below the age of 50, we may put your MediaMath ID in a segment of individuals ages 25-34. If a client wants to advertise sneakers to potential shoe buyers between 25-34 years, for example, the client may choose to target that segment. If MediaMath receives an opportunity to show you an ad on a publisher’s website or in a publisher’s app, that client may be one of the many who are eligible to bid to serve an ad to you.

The automated processes that we use do not affect your legal rights (such as your right to vote, take legal action, or freely associate with others) or your ability to receive social benefits or obtain citizenship, nor do they have legal effects on you. Also, we do not knowingly process or make automated decisions about EEA users based on any data that falls into special categories in the EEA. As described below, you have the right to object to this automated processing at any time and you may have additional rights described in Section 11.

Our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we process it. However, we will normally collect personal data from you only where the processing is in our (or a third party's, such as our clients’) legitimate interests and not overridden by your rights, such as your right to opt out. If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate the Platform and serve you ads on behalf of our clients. We may have other legitimate interests and, if appropriate, we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided under the “How to contact us” heading above.

If you want to limit the data MediaMath collects and processes about you and want us not to target ads that are based on your interests to your browsers or devices, you may opt out from MediaMath tracking and interest-based advertising at any time through one of the ways described below. If you opt out, you will still see ads, but those ads are not likely to have anything to do with products or services you care about. With interest-based advertising, you receive ads and offers that are more likely to be useful to you.

Your opt-out is only applicable to the Platform and does not opt you out from platforms provided by third-party companies. However, you can opt out from both MediaMath and many third-party companies at once; to do so, please see “Other ways to opt out” below. When you opt out, MediaMath will collect and process data from your browser, app, or device only as needed to honor your opt-out and for limited research and development purposes to improve our browser- and device-recognition technology, which also helps to improve our ability to honor your opt-out. When you opt out, MediaMath also stops targeting interest-based advertising to the opted-out browser, app or device.

If you use multiple browsers or devices and wish to limit the data MediaMath collects and processes and do not wish to receive MediaMath interest-based advertising on any of them, you must opt out from each browser and device individually.

You may opt out if you are using a browser by clicking the “Click here to opt out” link below. Please note that if cookies are not enabled in your browser, including if third-party cookies are disabled, or if you use certain ad-blocking tools, our opt-out mechanism may not work properly. Please also note that deleting your cookies does not opt you out. Please be aware that if you clear your cookies, or if you use a different browser or device, you will need to renew your opt-out choice.

Your current opt-out status with MediaMath in this web browser is:

You may opt out in mobile app environments using the “AppChoices” mobile application, where applicable, which you can download to your mobile device from your App Store or via the Digital Advertising Alliance AppChoices page here.

You may learn more about interest-based advertising and opt out of interest-based advertising from MediaMath and other online advertising companies that are also members of applicable self-regulatory organizations by visiting their opt-out links:

• Network Advertising Initiative – http://optout.networkadvertising.org/
• Digital Advertising Alliance (DAA) – http://optout.aboutads.info/
• Digital Advertising Alliance Canada – http://youradchoices.ca/choices
• Digital Advertising Alliance EU – http://www.youronlinechoices.com/
• DAA AppChoices page – http://www.aboutads.info/appchoices

You also may limit ad tracking in mobile app environments on your mobile device as well as on your OTT TV Device. For the most effective and up-to-date methods for doing so, you should consult instructions provided by those device manufacturers. We offer the following information solely for informational purposes, and we cannot guarantee that the methods below are the most current:

• Apple instructions for how to Limit Ad Tracking on devices such as iPhones, iPads and Apple TV
• Google instructions for how to express choice on Android devices
• Roku’s instructions for how to express choice on Roku devices

Where MediaMath receives a signal to limit ad tracking, we will collect and process data from your device only as needed to honor your choice and for limited research and development purposes to improve our device-recognition technology, which also helps to improve our ability to honor your choice. Where MediaMath receives a signal to limit ad tracking, MediaMath also will not serve interest-based advertising in the apps on your mobile device or OTT TV Device.

If you have questions about how to opt out or limit ad tracking, please contact us at [email protected].

5. The data collected via the Website or offline and how we collect it

If you visit our Website or certain third-party marketing applications used by MediaMath, or if you interact with MediaMath in other ways described below, MediaMath collects certain personal data from you when you choose to reveal it to us, and we also automatically collect certain personal data. Third parties may collect personal data from you if you use certain features on the Website. The Website also may reflect certain personal data provided to us separately when you provide your consent for such display.

When you visit the Website, you may choose to provide your personal data to set up an account, request information such as a demonstration of our products, or send us questions. You also may choose to provide us with your personal data through sources other than the Website, including, for example when you register for or attend an event hosted by MediaMath. The personal data may include your name, email address, company, title, and region, as well as information about your business such as industry, size, revenue, and address. You have the ability to provide additional information at your discretion.

You also may provide us with your personal data on the publicly accessible blogs on our Website. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them.

We do not link the personal data described in this section with personal data that we may have about you in the Platform. You may choose to stop receiving marketing communications at any time by following the unsubscribe instructions included in any marketing communications we send you or by contacting us via email at [email protected]. Also, you may request removal of your personal data from our blog, community forum, or our marketing database by contacting us the same way. In some cases, we may not be able to remove your personal data from publicly accessible blogs on the Website, in which case we will let you know if we are unable to do so and why.

As is true of most websites, we gather certain personal data automatically when content is displayed to you on the Website and store it in log files. This information may include IP address, browser type, Internet Service Provider, referring and exit pages, operating system, date and time stamp, and/or clickstream data. We do not link this data stored in log files to other information we collect about you.

We also automatically collect, and allow certain of our partners and service providers automatically to collect, personal data from you when you visit the Website. This is done using various technologies including cookies and pixels. Examples of service providers include video providers and email service providers. We consider the data that we collect from you on the Website using cookies and pixels as Pixel Data, which is described above in Section 3. Our partners and service providers also may collect personal data, may sync with additional third parties, and may allow third parties with whom they partner to set cookies on the Website. Please note, MediaMath does not control these partners and service providers. You should refer to the privacy statements of such parties to find out what personal data they collect, how they use cookies and how they interact with other third parties. For further information on the cookies and pixels we use on the Website, including a list of the partners and service providers described above, and how you can opt out, please see our Cookie Notice.

The Website includes Social Media features that allow you to share news, events and blog posts from the Website on platforms such as Facebook, Twitter and LinkedIn or by email. These Social Media features are hosted by the third parties providing them, and your interactions with these features are governed by the privacy policy of the company providing it, which you should read and ensure you understand.

We display testimonials from satisfied clients on the Website in addition to other endorsements. We will obtain our client’s permission before we place these testimonials on the Website. If you are a client who wishes to update or delete your testimonial, please contact us at [email protected].

Our legal basis for collecting and using the personal data described above in this Section 5 will depend on the personal data concerned and the specific context in which we collect it. However, we will normally collect personal data from you only where the processing is in our legitimate interests and not overridden by your rights, such as your right to opt out, or where we have your consent to do so. If we collect and use your personal data in reliance on our legitimate interests, this interest will normally be to operate the Website, communicate with you, send you marketing communications (where we have your permission to do so, if such permission is required by applicable law), and show you ads on Digital Properties. We may have other legitimate interests and, if appropriate, we will make clear to you at the relevant time what those legitimate interests are.

In some cases, we also may have a legal obligation to collect personal data from you. If we ask you to provide personal data to comply with a legal requirement, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not (as well as of the possible consequences if you do not provide your personal data). Where we are required by applicable law to obtain your consent, for instance (in some cases) in order to send you marketing communications, we will do so, and in such cases the legal basis for our processing of personal data will be your consent. If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided under the “How to contact us” heading above.

6. How we use data collected via our Website

When you provide your personal data to MediaMath on the Website or through other means described in this section, including, for example, when you attend an event hosted by MediaMath, we may use the data for the following purposes:

• To respond to your inquiry;
• To understand your business and offer you potential business opportunities;
• To know or infer your interest in marketing products and services;
• To enrich certain personal data you provide, for example your IP address or company information with information obtained from third parties;
• To segment (group) you with similar individuals;
• To provide you with information and offers about MediaMath products and services, information resources (e.g. whitepapers, reports and webinars), industry news and opinions, and announcements about MediaMath;
• To inform you about and invite you to events, educational opportunities, or training opportunities;
• To ask you to share MediaMath information, offers, and invitations with other people; and
• To attribute your responses or actions to specific marketing campaigns, activities, and channels.

As mentioned above, you may choose to stop receiving marketing communications at any time by following the unsubscribe instructions included in any marketing communications we send you or by contacting us via email at [email protected]. You also may request removal of your personal data from our blog, community forum, or our marketing database by contacting us the same way. We may not be able to remove your personal data from publicly accessible blogs on the Website, but we will let you know if that is the case.

MediaMath uses information from the Website log files for troubleshooting and security purposes. We use the Pixel Data that we collect from you on the Website for the purposes described in Section 4 above. Accordingly, each purpose and activity that applies to our clients in Section 4 could apply to MediaMath. For example, we may use Pixel Data that we collect from you on the Website to deliver ads to you when you visit other Digital Properties, and we may collect additional personal data from you on those Digital Properties, such as Bid Request or Impression Data. We use other data that is collected on the Website using cookies and pixels to determine how you found out about us, what your interests are regarding our services, and how to further improve the functionality of the Website and our service towards you as well as to analyze trends and administer the Website. For further information on the cookies and pixels we use on the Website and how you can opt out, please see our Cookie Notice.

7. Disclosure of data from the Platform and Website

We may share your personal data with the following categories of third parties for the purposes set out in Section 4 and Section 6 above:

• With our group companies for business operations that are based in our regional offices in England, Spain, France, Germany, Singapore, Brazil, Japan, and Australia.
• With our clients, resellers and partners where this is necessary in order to operate the Platform and the Website, to provide our products and services, to improve our Platform, products and services, and to create new products and services. These partners include but are not limited to segment providers, any provider with whom we synchronize cookie IDs, and partners who receive data exported from the Platform at our clients’ request.
• With media supply sources such as publishers (i.e. organizations who operate Digital Properties) and exchanges or supply-side platforms who display ads on publishers' Digital Properties in connection with the opportunity to purchase advertising inventory.
• With third parties with whom we contract to help with the operation of the Platform and Website, the provision of our products and services and our business operations. Services provided in connection with the Platform include data storage and computing infrastructure, content delivery, dynamic creative optimization, ad measurement, audience modeling, data enrichment and the AdChoices icon. Services provided in connection with the Website and our marketing activities include email services, event management, maintenance of our marketing database, web analytics, recruitment, management of marketing and customer relationship and social media.
• With third parties when we consider this to be necessary: to establish or protect the legal rights of MediaMath or its employees, agents and contractors, as well as the legal rights of its clients or other third parties; to protect the safety and security of users and visitors to our Website; to protect against fraud; or to comply with the law or legal process.
• When we are required to or allowed to do so by law (for example in response to subpoenas, to comply with a binding court order, legal process, or government requests, including in response to a public authority to meet national security or law enforcement requirements).
• If MediaMath sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, we may transfer or assign the personal data to a third party as part of that transaction.

We require third parties to respect the security of your personal data and to treat it in accordance with applicable laws. We also define the permissible scope and, where appropriate, restrict the use by third parties of your personal data. We require our third parties who provide us services to only use the information that we provide to them in connection with the services they perform for us and in accordance with our instructions.

We also may publish or otherwise make public anonymous, aggregate, or summary information regarding campaigns run in the Platform on behalf of our clients. For example, we may publish a report that reflects aggregated statistics regarding seasonal trends in shopping patterns or geographic differences in advertising impression opportunities.

8. International transfers

The information that we collect from you and about you may be transferred to and stored in a country other than your country of residence, such as the USA, which may not offer the same level of protection of personal data as your country of residence. However, we will take contractual and/or other measures to ensure your personal data is protected.

MediaMath has its headquarters in the USA and many of our partners or vendors are based outside of the EEA. Whenever we transfer your personal data out of the EEA, we ensure that it receives a similar degree of protection by implementing at least one of the following:

• Reliance on our or our applicable partners’ or vendors’ Privacy Shield certification if the transfer is to the United States.
• Entering into contracts approved by the European Commission with our group companies and applicable partners or vendors.

MediaMath, Inc. complies with the EU-U.S. Privacy Shield Framework and the Swiss–U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the EU and Switzerland to the United States, respectively.

MediaMath, Inc. has certified to the Department of Commerce that for all personal data it receives from the EU and Switzerland, it will adhere to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfers, Security, Data Integrity & Purpose Limitation, Access, and Recourse, Enforcement and Liability.

If there is any conflict between the terms in this Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To find out more about the Privacy Shield, access the Privacy Shield List, and find details of our certification, please visit: https://www.privacyshield.gov/list.

Under the Privacy Shield, MediaMath, Inc. may remain liable if its third-party service providers process your personal data in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Residents of the EU or Switzerland who believe that their personal data has not been processed in compliance with the Privacy Shield Principles may raise their complaint in the following ways:

1. You can contact MediaMath, Inc. directly using the details in the "How to contact us" section above. We will respond to your complaint within 45 days of receipt.
2. We have further committed to refer unresolved privacy complaints under the Privacy Shield via the Better Business Bureau (“BBB”), an alternative dispute resolution provider located in the United States. If you do not receive a timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed by us, please visit https://www.bbb.org/EU-privacy-shield/for-eu-consumers/ for more information and to file a complaint directly with the BBB.
3. Further, your complaint can be made or referred to the U.S. Department of Commerce or the Federal Trade Commission for further investigation.
4. For residual disputes that cannot be resolved by the methods above, you may be able to invoke a binding arbitration process under certain conditions. To find out more about the Privacy Shield’s binding arbitration scheme, please see: https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

The Federal Trade Commission has investigation and enforcement authority over our compliance with the Privacy Shield.

9. Data security and integrity

MediaMath implements appropriate technical and organizational measures to safeguard personal data in our possession against being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. No transmission of data over the Internet, however, is guaranteed to be completely secure. It may be possible for third parties not under the control of MediaMath to intercept or access transmissions or communications unlawfully. While we strive to protect your personal data, we cannot ensure or warrant the security of any data you transmit to us or that we collect about you. We have procedures in place to address any suspected personal data breach, and if we are required by law, we will notify you of any such breach.

MediaMath processes information in a way that is compatible with and relevant for the purpose for which it was collected. To the extent necessary for those purposes, we take reasonable steps to ensure that any information in our care is accurate, complete, current, and reliable for its intended use. If you have any questions about security on the Website or through the Platform, you can contact us at [email protected]

10. Data retention

As described above, we process your personal data for different purposes, and the length of time that we retain your personal data varies depending on the processing purpose, the category of personal data and certain external factors.

We will retain the MediaMath ID and, where applicable, its association with other devices for as long as it is necessary for our legitimate business purposes.

We will retain all other categories of personal data that we collect or receive on the Platform, including Bid Request Data and Impression Data, Pixel Data and Other Client Data, and Third-Party Segment Data and Other Third-Party Data, for no longer than thirteen months, and we retain much of this data for shorter periods of time. Furthermore, we may delete personal data in response to a request from a user under applicable law or when contracts with our clients end. Also, most cookies set via the Platform expire within thirteen months, while certain cookies that are not used for tracking are refreshed for as long as such cookies are necessary for our legitimate business purposes.

If you provide us with your personal data on our Website or through other means described above in Section 5, we will retain your information for as long as it is necessary for our legitimate business purposes. For example, if you sign up for an account or request information on the Website, we will retain the data you provide for as long as we think you may have an interest in receiving information from us. Similarly, we retain log files for as long as it is necessary for our legitimate business purposes.

We retain the Pixel Data that we collect as described above in the section ‘Retention of data collected on the platform’.

11. Your legal rights

MediaMath acknowledges that in some circumstances, you have certain rights under data protection laws in relation to your personal data. Depending on where you are located, these may include the right to access your personal data, correct certain personal data, erasure of your personal data, object to certain processing of your personal data, restrict certain processing of your personal data, personal data portability and not be subject to decisions based solely on automated processing. To the extent required and permitted by applicable law, we will provide you access to the personal data we hold about you and also allow you to correct inaccurate information in certain situations (e.g., if you submit your email address on the Website), delete your personal data, object to processing, restrict certain processing of your personal data, port your personal data or elect not to be subject to decisions based solely on automated processing. If you would like to exercise any of these rights, please send your request to us at [email protected] and we will respond to your request in accordance with applicable laws.

We may need you to provide additional information to allow us to confirm your identity in order to process your request. We do this as a security precaution and to ensure that we do not disclose personal data to the wrong person.

Unless otherwise indicated in the Policy, we try to fulfill legitimate requests within 30 days. If it will take longer, we will notify you and keep you updated.