Applicable Services

Services leveraging Epsilons CORE Identity (Core ID Services)

CleanRoom, Demand Side Platform

Processing Location

United States of America [identity resolution]

Local market [pseudonymization activity, client-profile and RTB hosting]

Role of Client:

Disclosing Controller

Role of Epsilon:

Recipient Third Party

Data Subjects:

• Clients customers
• Visitors to Clients digital properties (websites, mobile applications, and digital advertisements)

Nature of the Processing:

• Client will transfer an offline file of names, addresses, email addresses, customer IDs, and transactions to Epsilon as part of the data onboarding for the Core ID Services. Epsilon will conduct hygiene on the contact information provided and then match the contact information to Epsilons pseudonymous IDs (the Core ID), thereby dropping the offline contact information (name, address, email) from the client-profile. The customer IDs and transactions will be placed into Clients client-profile tied to the assigned Core IDs.
• Epsilon will send code to Client in order to tag Clients websites, apply a reverse proxy First Party Cookie, server-to-server API, and/or SDK in applicable Client mobile applications (this is applying device tracking technology to Client digital properties) to collect cookie IDs, device IDs, IP address, customer ID, and customer events/transactions on those digital properties. The customer event/transactions collected from Epsilons device tracking technologies are placed into Clients client-profile. For Data Subjects located in the United States, Epsilon may add First Party Cookies to the CORE Identity, which First Party Cookies will not be accessible to or used by any other Epsilon client. For Data Subjects located outside the United States [if the Agreement contemplates services provided outside of the United States], all processing purposes apply.
• Epsilon will use Clients client-profile and Epsilons own personal data (Core Identity, demographic information, contextual labels, transactional information, attitudinal information) to (1) model audiences to be used for Clients media campaigns, (2) develop insights for Clients internal marketing purposes using Epsilons own algorithms and technology, and/or (3) personalize content for Clients website, email communication, or digital advertising.

Purpose of the Processing:

Cross-context behavioral advertising (aka targeted advertising or interest based advertising) and identity resolution. More specifically: (a) use limited data to select advertising and/or content; (b) create profiles for personalised advertising and/or content; (c) use profiles to select personalised advertising/and or content; (d) measure advertising and/or content performance; (e) understand audiences through statistics or combinations of data from different sources; (f) develop and improve services; (g) ensure security, prevent and detect fraud, and fix errors; (h) deliver and present advertising and content; (i) save and communicate privacy choices; (j) match and combine data from other data source, link different devices, and identify devices for personalized advertising (identity); as more specifically explained in the IAB TCF policy and as registered by Epsilon under the IAB TCF.

Categories of Personal Data Processed:

• Personal identifiers (e.g., name; alias; postal address; online identifiers; IP address; session id, customer id, cookie id, email address; account name; or hashed identifiers)
• Commercial or transactional information (e.g., records of personal property, goods or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)
• Internet or other electronic network activity information (e.g., browsing history; online interests, such as information about categories of consumer interests derived from online usage; and information on a consumers interaction with a website, application, or advertisement)

Duration of the Processing:

The Personal Data will be processed for as long as necessary for the purpose(s) or as needed to comply with another legal obligation.

Applicable Services

Licensing of data or audiences from Epsilon to Client

Processing Location

• Audiences: United States of America and local market
• Metrics Data: United States of America and local market

Role of Client:

Recipient Third Party

Role of Epsilon:

Disclosing Controller

Data Subjects:

Consumers

Nature of the Processing:

• Audiences: Epsilon develops audiences using its proprietary data sets and possibly Client provided data (Client 1PD) for use in targeted advertising (aka interest-based advertising). Epsilon utilizes its identity graph (Core ID) mapped to certain third-party activation partners pseudonymous IDs. Epsilon will send the audience to the third party activation partner selected by Client. The audience will land in the Clients account within the third-party activation partners platform.
• Metrics Data: If Epsilon acts as the demand side platform to activate media, Epsilon may share log-level media performance data with Client that Epsilon has collected through its device tracking technologies or the programmatic bid stream.

Purpose of the Processing:

• Audiences: Client may process the audiences for cross-context behavioral advertising (aka targeted advertising or interest-based advertising).
• Metrics Data: Client may process the metrics data through analytics to identify the performance of its media campaigns.

Categories of Personal Data Processed:

• Pseudonymous identifiers (e.g., online identifiers; IP address; session id, customer id, cookie id, or hashed identifiers)
• Audience segment name
• Internet or other electronic network activity information (e.g., browsing history and information on a consumers interaction with a website, application, or advertisement)

Duration of the Processing:

The Personal Data will be processed for as long as necessary for the purpose(s) or as needed to comply with another legal obligation.

Applicable Services

Lotame Processing of Behaviors and Clients Proprietary Identifiers for Spherical Platform (not including Data Collaboration services)

Processing Location

United States of America

Definitions

Behaviors means attributes, preferences, interests, and other characteristics of an individual who uses or visits Clients digital properties and does not include an entity or organization created by law.

Proprietary Identifiers means identifiers that Client derives or creates to identify an individual who uses or visits Clients digital properties.

Role of Client:

Disclosing Controller

Role of Epsilon/Lotame:

Recipient Processor

Data Subjects:

Global data subjects (not inclusive of residents of China):

• Clients customers
• Visitors to Clients digital properties (websites, mobile applications)

Nature of the Processing:

Lotame will store Client provided Behaviors and Proprietary Identifiers in order for Client to use this data through Lotames Audience Optimizer.

Purpose of the Processing:

Storage

Categories of Personal Data Processed:

Pseudonymous Identifiers

Internet or other electronic network activity

Demographics

Preferences

Commercial behaviors

Duration of the Processing:

The Personal Data will be processed for the term of the Agreement

Applicable Services

Lotame Processing of Sightings Data for Spherical Platform

Processing Location

United States of America

Definitions

Sightings Data means the hashed email address, IP address, user-agent string, and timestamp that corresponds to a particular use of or visit to a digital property by an individual.

Role of Client:

Disclosing Controller

Role of Epsilon/Lotame:

Recipient Third Party

Data Subjects:

Global data subjects (not inclusive of residents of China):

• Clients customers
• Visitors to Clients digital properties (websites, mobile applications)

Nature of the Processing:

Lotame will Process Sightings Data to (1) assign and share Panorama IDs with Client and the third parties identified by Client and (2) develop, maintain, and improve Lotames services.

Purpose of the Processing:

Audience profiling and segmentation; Advertising & content performance measurement; Audience Insights; Data onboarding and enrichment; and Cross-device linking (graphing)

Categories of Personal Data Processed:

Pseudonymous Identifiers

Internet or other electronic network activity

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.

Applicable Services

Delivery of Audience from Lotame to Clients identified Third Party Partner

Processing Location

United States of America

Role of Client:

Recipient Third Party

Role of Epsilon/Lotame:

Disclosing Controller

Data Subjects:

Global data subjects (not inclusive of residents of China):

Consumers

Nature of the Processing:

Lotames Spherical Platform hosts audiences Lotame makes available derived from Lotames personal data. Lotame maintains a mapping of pseudonymous identifiers between Lotame and third-party activation partners that Lotames clients may choose to use. Through the mapping, Lotame will deliver audiences identified by Client to Clients seat within the third-party activation partners platform.

Purpose of the Processing:

Audience profiling and segmentation; Advertising & content performance measurement; Audience Insights; Data onboarding and enrichment; and Cross-device linking (graphing)

Categories of Personal Data Processed:

Pseudonymous Identifiers

Internet or other electronic network activity

Duration of the Processing:

The Personal Data will be processed in accordance with the timeframe identified in the Agreement.