Processing Location

United States of America [identity resolution]

Local market [pseudonymization activity, client-profile and RTB hosting]

Role of Client:

Disclosing Controller

Role of Epsilon:

Recipient Third Party

Data Subjects:

• Client’s customers
• Visitors to Client’s digital properties (websites, mobile applications, and digital advertisements)

Nature of the Processing:

• Client will transfer an offline file of names, addresses, email addresses, customer IDs, and transactions to Epsilon as part of the data onboarding for the Core ID Services. Epsilon will conduct hygiene on the contact information provided and then match the contact information to Epsilon’s pseudonymous IDs (the Core ID), thereby dropping the offline contact information (name, address, email) from the client-profile. The customer IDs and transactions will be placed into Client’s client-profile tied to the assigned Core IDs.
• Epsilon will send code to Client in order to tag Client’s websites, apply a reverse proxy First Party Cookie, server-to-server API, and/or SDK in applicable Client mobile applications (this is applying device tracking technology to Client digital properties) to collect cookie IDs, device IDs, IP address, customer ID, and customer events/transactions on those digital properties. The customer event/transactions collected from Epsilon’s device tracking technologies are placed into Client’s client-profile. For Data Subjects located in the United States, Epsilon may add First Party Cookies to the CORE Identity, which First Party Cookies will not be accessible to or used by any other Epsilon client. For Data Subjects located outside the United States [if the Agreement contemplates services provided outside of the United States], all processing purposes apply.
• Epsilon will use Client’s client-profile and Epsilon’s own personal data (Core Identity, demographic information, contextual labels, transactional information, attitudinal information) to (1) model audiences to be used for Client’s media campaigns, (2) develop insights for Client’s internal marketing purposes using Epsilon’s own algorithms and technology, and/or (3) personalize content for Client’s website, email communication, or digital advertising.

Purpose of the Processing:

Cross-context behavioral advertising (aka targeted advertising or interest based advertising) and identity resolution. More specifically: (a) use limited data to select advertising and/or content; (b) create profiles for personalised advertising and/or content; (c) use profiles to select personalised advertising/and or content; (d) measure advertising and/or content performance; (e) understand audiences through statistics or combinations of data from different sources; (f) develop and improve services; (g) ensure security, prevent and detect fraud, and fix errors; (h) deliver and present advertising and content; (i) save and communicate privacy choices; (j) match and combine data from other data source, link different devices, and identify devices for personalized advertising (identity); as more specifically explained in the IAB TCF policy and as registered by Epsilon under the IAB TCF.

Categories of Personal Data Processed:

• Personal identifiers (e.g., name; alias; postal address; online identifiers; IP address; session id, customer id, cookie id, email address; account name; or hashed identifiers)
• Commercial or transactional information (e.g., records of personal property, goods or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)
• Internet or other electronic network activity information (e.g., browsing history; online interests, such as information about categories of consumer interests derived from online usage; and information on a consumer’s interaction with a website, application, or advertisement)

Duration of the Processing:

The Personal Data will be processed for as long as necessary for the purpose(s) or as needed to comply with another legal obligation.

Processing Location

• Audiences: United States of America and local market
• Metrics Data: United States of America and local market
• Install, Data Append, List, or Feed: United States of America

Role of Client:

Recipient Third Party

Role of Epsilon:

Disclosing Controller

Data Subjects:

Consumers

Nature of the Processing:

• Audiences: Epsilon develops audiences using its proprietary data sets and possibly Client provided data (Client 1PD) for use in targeted advertising (aka interest-based advertising). Epsilon utilizes its identity graph (Core ID) mapped to certain third-party activation partners’ pseudonymous IDs. Epsilon will send the audience to the third party activation partner selected by Client. The audience will land in the Client’s account within the third-party activation partner’s platform.
• Metrics Data: If Epsilon acts as the demand side platform to activate media, Epsilon may share log-level media performance data with Client that Epsilon has collected through its device tracking technologies or the programmatic bid stream.
• Install, Data Append, or List: Epsilon licenses individual or household level personal data to Client to be used by Client for Client’s marketing, advertising, or internal business analytics uses related to the forecasting, sale, or marketing of the Client’s goods/services. The personal data is delivered to Client typically through a SFTP file or transferred via API to Client’s instance of a CDP, CRM, or Cleanroom.

Purpose of the Processing:

• Audiences: Client may process the audiences for cross-context behavioral advertising (aka targeted advertising or interest-based advertising).
• Metrics Data: Client may process the metrics data through analytics to identify the performance of its media campaigns.
• Sublicensing: If Client is a “Reseller” as defined in its agreement with Epsilon, Client may sublicense the personal data to a third party provided that the third party may only process the personal data for the purposes identified herein (audiences and install, data append or list)

Categories of Personal Data Processed:

• Audiences: Pseudonymous identifiers (e.g., online identifiers; IP address; session id, customer id, cookie id, or hashed identifiers), Audience segment name.
• Metrics Data: Pseudonymous identifiers, Internet or other electronic network activity information (e.g., browsing history and information on a consumer’s interaction with a website, application, or advertisement)
• Install, Data Append, or Lis t: varies by the terms of the agreement, please see Epsilon’s privacy notice at [https://legal.epsilon.com/us/NA-products-privacy-policy] for potential categories of personal data.

Duration of the Processing:

The Personal Data will be processed for as long as necessary for the purpose(s) or as needed to comply with another legal obligation.

Processing Location

United States of America

Definitions

“Sightings Data” means the hashed email address, IP address, user-agent string, and timestamp that corresponds to a particular use of or visit to a digital property by an individual.

Role of Client:

Disclosing Controller

Role of Epsilon/Lotame:

Recipient Third Party

Data Subjects:

Global data subjects (not inclusive of residents of China):

• Client’s customers
• Visitors to Client’s digital properties (websites, mobile applications)

Nature of the Processing:

Lotame will Process Sightings Data to (1) assign and share Panorama IDs with Client and the third parties identified by Client and (2) develop, maintain, and improve Lotame’s services.

Purpose of the Processing:

Audience profiling and segmentation; Advertising & content performance measurement; Audience Insights; Data onboarding and enrichment; and Cross-device linking (graphing)

Categories of Personal Data Processed:

Pseudonymous Identifiers

Internet or other electronic network activity

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.

Processing Location

United States of America

Role of Client:

Recipient Third Party

Role of Epsilon/Lotame:

Disclosing Controller

Data Subjects:

Global data subjects (not inclusive of residents of China):

Consumers

Nature of the Processing:

Lotame’s Spherical Platform hosts audiences Lotame makes available derived from Lotame’s personal data. Lotame maintains a mapping of pseudonymous identifiers between Lotame and third-party activation partners that Lotame’s clients may choose to use. Through the mapping, Lotame will deliver audiences identified by Client to Client’s seat within the third-party activation partner’s platform.

Purpose of the Processing:

Audience profiling and segmentation; Advertising & content performance measurement; Audience Insights; Data onboarding and enrichment; and Cross-device linking (graphing)

Categories of Personal Data Processed:

Pseudonymous Identifiers

Internet or other electronic network activity

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.

Processing Location

United States of America

Role of Client:

Disclosing Controller

Role of Captiv8:

Third Party

Data Subjects

Global data subjects (not inclusive of residents of China):

Content creators and prospective creators

Nature of the Processing:

The Client uploads, imports, submits, or otherwise makes available personal data relating to creators, influencers, and prospective creators through the Captiv8 platform. Captiv8 hosts, stores, organizes, analyzes, and otherwise processes such personal data to facilitate creator discovery, creator relationship management, campaign administration, creator communications, campaign measurement, analytics, reporting, fraud prevention, platform operations, customer support, and related influencer marketing and advertising services

Purpose of the Processing:

Creator discovery and recruitment;

Influencer marketing campaign management;

Creator relationship management;

Campaign execution;

Campaign measurement and reporting;

Audience and engagement analytics;

Fraud prevention and platform security;

Customer support and platform administration.

Categories of Personal Data Processed:

Identifiers;
Contact information;
Social media identifiers and account information;
Demographic data;
Audience characteristics;
Campaign participation data;
Communications data;
Performance and engagement metrics;
Content and profile information;
Payment and contractual information;
Internet or other electronic network activity.

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.

Processing Location

United States of America

Role of Client:

Third Party

Role of Captiv8:

Disclosing Controller

Data Subjects

Global data subjects (not inclusive of residents of China):

Content creators and prospective creators

Nature of the Processing:

Captiv8 collects, maintains, organizes, licenses, discloses, and otherwise makes available creator and influencer information maintained within the Captiv8 platform to Advertisers. Advertisers may access creator profiles, audience insights, performance metrics, demographic information, content-related information, and other creator-related data to identify, evaluate, select, recruit, engage, and measure creators for advertising, sponsorship, influencer marketing, and related commercial activities. Captiv8 may make creator information available as part of its creator discovery, campaign matching, analytics, reporting, advertising, and platform services.

Purpose of the Processing:

Creator discovery and evaluation;
Campaign matching;
Influencer marketing;
Advertising campaign planning;
Audience analysis and audience insights;
Campaign measurement and optimization;
Performance analytics and reporting;
Marketing and commercial decision-making

Categories of Personal Data Processed:

Identifiers;
Social media identifiers and profile information;
Demographic data;
Audience characteristics;
Engagement and performance metrics;
Content-related information;
Inferences and derived insights;
Internet or other electronic network activity;
Creator profile and analytics information.

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.

Service:

Website enhancement (Accelerate Tag)

Role of Client:

Controller

Role of Epsilon:

Processor

Categories of data subjects:

Data subjects that visit Client’s digital properties.

Categories of personal data:

Technical data: including browser language and type, geolocation, and information about the browser.

Identifiers: IP address, de device identification information (such as user agent, MAC address, IMEI, and device time), name, address, email address, phone number, and additional fields as defined by the Client.

Activity data: (i) website browsing activity information such as pages viewed, timestamps of visits and actions activity events, referring URL and time spent on pages; (ii) transactional information such as order ID, order value, and information and quantity of products in the basket and in transactions; (iii) mouse interaction information with the digital property such as exit intent and clicks; (iv) form submissions, (v) age and website information as defined by our client (e.g. travel route queries); and (vi) error logs.

Content information: Content and settings information about the Campaigns to which the data subject has been exposed (impressions) as well as the variant they have seen in the case of A/B tests.

Nature and purpose of processing:

The provisions of the Services.

Epsilon’s Tag collects visitor’s browsing activity to assign targeting rules that trigger personalised messaging and capture conversions on Client’s digital properties.

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Sub-processors:

Please see: https://support.yieldify.com/en/articles/5144108-data-collection-policy

Service:

Website Analytics (Accelerate Tag)

Role of Client:

Controller

Role of Epsilon:

Processor

Categories of data subjects:

Data subjects that visit Client’s digital properties.

Categories of personal data:

Technical data: including browser language and type, geolocation, and information about the browser.

Identifiers: IP address, de device identification information (such as user agent, MAC address, IMEI, and device time), name, address, email address, phone number, and additional fields as defined by the Client.

Activity data: (i) website browsing activity information such as pages viewed, timestamps of visits and actions activity events, referring URL and time spent on pages; (ii) transactional information such as order ID, order value, and information and quantity of products in the basket and in transactions; (iii) mouse interaction information with the digital property such as exit intent and clicks; (iv) form submissions, (v) age and website information as defined by our client (e.g. travel route queries); and (vi) error logs.

Content information: Content and settings information about the Campaigns to which the data subject has been exposed (impressions) as well as the variant they have seen in the case of A/B tests.

Nature and purpose of processing:

The provisions of the Services.

Epsilon’s Tag collects information from the Client’s digital properties to provide analytics.

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Sub-processors:

Please see: https://support.yieldify.com/en/articles/5144108-data-collection-policy

Service:

Lead Generation/Surveys

Role of Client:

Controller

Role of Epsilon:

Processor

Categories of data subjects:

Data subjects that visit Client’s digital properties.

Categories of personal data:

Technical data: including browser language and type, geolocation, and information about the browser.

Identifiers: IP address, de device identification information (such as user agent, MAC address, IMEI, and device time), name, address, email address, phone number, and additional fields as defined by the Client.

Activity data: (i) website browsing activity information such as pages viewed, timestamps of visits and actions activity events, referring URL and time spent on pages; (ii) transactional information such as order ID, order value, and information and quantity of products in the basket and in transactions; (iii) mouse interaction information with the digital property such as exit intent and clicks; (iv) form submissions, (v) age and website information as defined by our client (e.g. travel route queries); and (vi) error logs.

Content information: Content and settings information about the Campaigns to which the data subject has been exposed (impressions) as well as the variant they have seen in the case of A/B tests.

Nature and purpose of processing:

The provisions of the Services.

Information captured via lead generation or survey forms on Client’s digital properties is sent via API to Client’s CRM and also stored in with Epsilon on behalf of the Client.

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Sub-processors:

Please see: https://support.yieldify.com/en/articles/5144108-data-collection-policy

Service:

Website Enhancement Powered by CORE ID

Role of Client:

Controller

Role of Epsilon:

Controller

Categories of data subjects:

Data subjects that visit Client’s digital properties.

Categories of personal data:

Identifiers: such as device identifiers, advertising IDs, cookie IDs, IP-addresses, and other information about the data subject’s browser and/or device.

Transactional and browsing information: such as the digital property and/or content that the data subject engages with and information about purchases and transactions that the data subject has made, as well as customer IDs, transaction IDs, and order IDs.

Nature and purpose of processing:

The provisions of the Services, including (i) store and/or access information on a device; (ii) use limited data to select advertising; (iii) create profiles for personalised advertising; (iv) use profiles to select personalised advertising; (v) create profiles to personalise content; (vi) use profiles to select personalised content; (vii) measure advertising performance; (vii) measure content performance; (xi) understand audiences through statistics or combinations of data from different sources; (x) develop and improve services; (xi) use limited data to select content; (xii) ensure security, prevent and detect fraud, and fix errors; (xiii) deliver and present advertising and content; (xiv) save and communicate privacy choices, and (xv) in connection with (i) – (xiii) match and combine data from other data sources, link different devices, and identify devices based on information transmitted automatically.

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Service:

Onsite Retail Media

Role of Client:

Controller

Role of Epsilon:

Processor

Categories of data subjects:

Current and potential customers of Client, including data subjects who visit Client’s digital properties.

Categories of personal data:

• Advertising IDs,
• Hashed email addresses,
• Non-precise geolocation,
• Date and time,
• Click event information,
• Impression event information,
• information about the data subject’s browsing behaviour, including selected filters
• Digital property and ad content that the data subject engages with
• Transactions that the data subject has made including specific products and SKU data
• Transaction, sessionID and order IDs related to transaction

Nature and purpose of processing:

The provision of the Services, including CitrusAd platform receives impression, click and purchase data from retailers. In order to perform attribution (discover which purchases were made due to CitrusAd served ads) a customer identifier is also included with the impressions/clicks/purchases to allow for appropriate matching. The retailer is responsible for pseudonymization (it is typically a string representing a session id).

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Sub-processors:

• Google Cloud US: Storage
• Google Cloud France(France)

Service: Storage

• Publicis Sp. z o.o (Poland)
  Service: Epsilon affiliate used for technical support
• Citrus International Pty Ltd (Australia)
  Service: Epsilon affiliate used for technical support.
• Epsilon India Data and Digital Technology Solutions LLP (India)
  Service: Epsilon affiliate used for technical support

Service:

Loyalty

Role of Client:

Controller

Role of Epsilon:

Processor

Categories of data subjects:

Current and potential customers of Client, including data subjects who visit Client’s digital properties.

Categories of personal data:

Identification and contact data (name, date of birth, gender, general, occupation or other demographic information, address, title, telephone number and other contact details, including email address), personal interests or preferences (including marketing preferences and purchasing and transactional history); communications data (including time/date of communications, and communications content sent and received through the Services); other types of personal data Client has included or input to be processed via the Services.

Nature and purpose of processing:

The provision of the Services, including the hosting of a customer database that Client controls the data stored and accessed.

Retention:

Until termination of this SOW, unless otherwise required by applicable law.

Sub-processors:

• Google Cloud Platform, Azure, or AWS: storage
• Epsilon Data Management LLC (US) [where contracted by Epsilon UK]

Service: Service: Epsilon affiliate used for technical support

• Epsilon India Data and Digital Technology Solutions LLP (India)
  Service: Epsilon affiliate used for technical support