For the data processing operations described below, Adform is considered as a joint controller together with its clients and/or partners (Joint Data Processing). Following the case-law of Court of Justice of the European Union as well as other relevant precedents, the Joint Data Processing is only limited to certain stages of processing, where for later stages, parties may have different roles (e. g. a sole controller or a processor).
Use Case |
Category of Data/Data |
Purposes of Joint Data Processing |
Legal basis |
Roles of the parties and contractual setup |
|
#1 |
1st-party identifiers (identifiers that are specific to one website and one device and are not recognizable on other digital properties) |
• 1st party data are matched and combined with other data points (e. g. identifiers and other device information; for example, via linking to other devices) through Adform' s proprietary technology called the ID Fusion that allows to create enriched segments (target groups of users depending on their common features or traits). This allows Adform’s clients to retarget the users, i. e. to reach out to the users who previously visited the clients’ digital properties, like websites and apps;
• With the support of Adform’s technology, clients can generate segments based on the above referenced processing alongside with other (target group) characteristics and information that may reveal additional information about the users' previous surfing behaviour, interests and preferences; and
• Subject to the necessary consents collected from data subject, Adform serves personalised ads relevant to users, as applicable and appropriate. |
Consent |
The Joint Data Processing is only applicable for the purposes of matching and combing of 1stparty IDs.
For any further processing stages of 1st party IDs, Adform is deemed as a processor. |
|
#2 |
3rd party identifiers (identifiers that are not website- and device-specific and may be recognized on other digital properties)
|
• 3rd party cookies are matched and combined with other data points (e.g. identifiers and other device information; for example, via linking to other devices) through Adform' s proprietary technology called the ID Fusion hereby creating enriched segments (as defined above) for the purpose of the parties' retargeting use case;
• With the support of Adform’s technology, clients can generate segments based on the above referenced processing alongside with other (target group) characteristics and information that may reveal additional information about the users' previous surfing behaviour, interests and preferences; and
• Subject to the necessary consents collected from data subject, Adform serves personalised ads relevant to users, as applicable and appropriate.
Furthermore, and subject to a suitable lawful basis, Adform may place its 3rd party cookies on its clients and/or partners websites for the purposes described in the Privacy Policy. |
Consent |
The Joint Data Processing is only applicable for stages of collection of data, transfer of data to Adform, and processing of data for the purposes established herein.
In case For any further processing stages, Adform is a sole controller of Adform 3rd party data. |
1. Data collection obligations
The client is responsible for implementing of Adform tracking technologies on its digital properties (e.g. websites, apps, etc), as well as to ensure that a suitable lawful basis (consent) is collected, (and be able to evidence it) as required under the applicable data protection laws. Only personal data that was collected from the user who was consented may be transferred to Adform.
2. Transparency, disclosure and accountability obligations
The client is responsible to provide information required under applicable data protection laws with respect to transparency and disclosure obligations in an easily accessible and meaningful manner. This information shall include at least a link to Adform’s privacy policy, parties’ identities as joint controllers and scope of joint controllership. Client must store the evidence of user’s choices to be able to prove the lawful basis, if requested.
3. Data security obligations
Both parties shall maintain suitable technical and organizational measures in their respective areas of responsibility to ensure appropriate protection. In case of a data breach related to Joint Data Processing, Adform shall fulfil any notification obligations arising from applicable data protection laws, whereas the client undertakes to assist Adform with implementing the aforementioned notification obligations.
4. Data subject rights obligations
Data subjects may exercise their data subject rights against any of the joint controllers. In case the data subject request concerning Joint Data Processing is received by the client, the client shall immediately forward such request to Adform, where relevant, and vice versa. The client shall not answer data subject requests concerning Joint Data Processing without prior consultation with Adform.