Data processing addendum

The signed agreement governs. This page summarises the terms of our data processing addendum for readers who want to know what to expect. It is not itself a contract. The full addendum is available on request through the contact page.

Roles

When an advertiser sends us data about its own app users, the advertiser is the controller and Drive Audience LLC is the processor. We process that data only to provide the advertising services the advertiser has asked for. Where the advertiser is itself a processor for another party, we act as its sub-processor.

Some activity, such as handling bid request data and ad delivery logs, may fall outside this addendum. The privacy policy explains our position. The customer agreement states each party's role for that activity.

Subject matter and duration

The subject matter is the provision of retargeting services: building audiences, bidding on in-app inventory, delivering creative and measuring results. The addendum lasts for as long as we provide services to the advertiser, and its confidentiality and deletion terms continue after that where needed.

Categories of data and data subjects

Data subjects: the advertiser's app users and former users.
Data: mobile advertising identifiers (the IDFA where the person allowed tracking, and the Android advertising ID), app event data such as sessions and purchases, and signals about consent. Where the advertiser provides a product feed, the content of that feed.
Not expected: names, email addresses, phone numbers, sensitive categories of data or data about children. The advertiser must not send them.

Our obligations as processor

Instructions. We process the data only on the advertiser's documented instructions, which include using the services as configured. We tell the advertiser if we think an instruction breaks the law.
Confidentiality. People who handle the data are bound by confidentiality duties.
Security. We apply technical and organisational measures suited to the risk, such as access controls, encryption in transit and separation of one advertiser's data from another's.
Sub-processors. We use sub-processors, such as infrastructure providers, under written terms that carry the same data protection duties. The current list is available on request from privacy@mobiretarget.com. The advertiser is told of changes and may object on reasonable grounds.
Rights requests. We help the advertiser to answer requests from its users, including requests to delete data or to stop retargeting. If a person contacts us directly about the advertiser's data, we refer them to the advertiser.
Breach notification. We notify the advertiser without undue delay after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own duties.
Deletion or return. When the services end, we delete the advertiser's data or return it, as the advertiser chooses, unless the law requires us to keep it.
Audits. We make available the information needed to show compliance and allow reasonable audits, with notice, during working hours and under confidentiality, in a way that does not expose other customers' data.

International transfers

Where processing involves moving personal data out of the EEA or the UK to a country without an adequacy decision, the parties rely on standard contractual clauses and any supplementary measures the law requires. The same applies to transfers to our sub-processors.

Advertiser responsibilities

The advertiser remains responsible for the lawfulness of the data it sends us. In particular, it must:

have a valid lawful basis for the processing, and for retargeting;
collect any consent the law requires, including the permission iOS asks for through App Tracking Transparency, and pass the resulting signals to us accurately;
give its users clear notices that explain retargeting, and a way to opt out;
not send us sensitive data, or data about children, and not ask us to build audiences from either.

Our advertiser policy sets out the audience rules in more detail.

Data processingaddendum.