Legal

Your Privacy Rights and How to Exercise Them

Last Updated: 3 April 2024

You can make choices about how your personal information, personal data, or the equivalent terminology in your region (collectively, Personal Data) is collected, used, and shared (Processed). To learn more about how we Process Personal Data for our Platform Services, please visit our Exchange Platform Privacy Policy. To learn more about how we Process Personal Data in relation to your interactions with us in a business capacity, please visit our Corporate and Website Privacy Policy. Please find details about your privacy rights and how you can exercise them below.

Access and deletion requests

As noted in our Exchange Platform Privacy Policy, the Exchange Platform only Processes certain Digital Identifiers that enable us to recognize your web browser or device.

Web browser

To make an access or deletion request for web browser Digital Identifiers on the Exchange Platform, please use our User Rights Request Form.

  • Access request: when you submit an access request using the drop-down menu in the User Rights Request Form, a PDF will download with a copy of the Digital Identifiers we have in our systems and a list of the third parties we’ve shared it with as part of our Cookie syncing activities.
  • Deletion request: when you submit a deletion request using the drop-down menu in the User Rights Request Form, you will receive a confirmation notice that your Personal Data will be deleted from our systems within 24 hours.

Please note, that the User Rights Request Form request only applies to the specific web browser you are using to make that request. To access or delete Personal Data on other web browsers, please use the User Rights Request Form for each web browser.

Other sources (such as mobile and TV)

To make an access or deletion request for other Digital Identifiers on the Exchange Platform, please email privacy@indexexchange.com with a copy of your device advertising ID. For a web browser on a mobile device or TV, please use the User Rights Request Form from that device. Some examples of device advertising IDs (not an exhaustive list) are the following:

  • Identifier for Advertisers (IDFA) is used on Apple devices running iOS,
  • Android Advertising ID (AAID) is used on Android devices,
  • Google Advertising ID (GAID) is a unique advertising ID assigned to Android devices by Google Play services,
  • Roku Advertising ID is a unique identifier assigned to Roku devices,
  • LG Smart TV Advertising ID is a unique identifier assigned to LG smart TVs, and
  • Samsung Smart TV Advertising ID is a unique identifier assigned to Samsung smart TVs.

General access and deletion requests

For any and all other access and deletion requests, such as for Personal Data under the Website & Corporate Privacy Policy, please contact us at privacy@indexexchange.com or at the address in the “Contact Us” section below.

Correction requests

You have the right to correct your Personal Data. If you feel the Personal Data we have about you is incorrect and would like us to rectify it, please contact us at privacy@indexexchange.com or at the address in the “Contact Us” section below.

Limit and object to Processing

The ads you see on Publisher Digital Properties may be personalized to your interests. Index Exchange offers options to opt-out of personalized advertising. Kindly note that opting-out of personalized advertising does not mean you will no longer see online ads, it simply means you will not see ads personalized to your interests. You will receive ads that may be less relevant and more repetitive. The way to opt-out depends on the web browser and device you are using.

Web browser opt-out

To opt-out of the Processing of your Personal Data for personalized advertising, please visit the National Advertising Initiative’s opt-out page: https://optout.networkadvertising.org/?c=1.

When you opt out in a web browser, an opt-out cookie will be stored in your web browser. The purpose of this cookie is to let our systems know that you have made the choice to opt-out. Any previous Personal Data that we have stored about you is deleted or anonymized within 30 days.

Don’t forget:

  • You need to separately opt-out on each web browser you use. This also applies to the same web browsers you use on different devices. Cookies are not shared between web browsers and devices;
  • If you block, clear, delete, or restrict all cookies on your web browser, your opt-out cookie will also be deleted. You will need to reset the opt-out cookie; and
  • Some web browsers may block and delete cookies. On these web browsers, our opt-out cookie may not work.

You may also opt out of the Processing of your Personal Data from other businesses that are involved in digital advertising more broadly. This can be done on opt-out pages provided by organizations who set industry standards in the digital advertising space. Below are some helpful links for opting out.

US industry opt-out:

  • www.aboutads.info/choices
  • www.networkadvertising.org/choices.

Europe industry opt-out:

  • www.youronlinechoices.com

Canada industry opt-out:

  • www.youradchoices.ca/choices.

Mobile opt-out

Mobile devices provide mechanisms that allow you to opt out of personalized ads on your mobile device. To opt out of the Processing of personalized advertising on your mobile device, please consult your device settings. You may find it helpful to consult NAI’s Mobile Choices page. You can also visit http://www.aboutads.info/appchoices, download the Digital Advertising Alliance’s (DAA) AppChoices mobile app, and follow the instructions provided in the AppChoices mobile app. NAI and DAA are industry standards bodies in the digital advertising space.

Television & digital video programming opt-out:

Digital video programming devices (such Smart TVs and apps on Smart TVs) may give you the ability to opt out of the use of your Personal Data for advertising purposes. To determine if your device has these options, please visit your device’s setting menu. You may wish to consult the following guidance for consumer choice mechanisms on various connected devices: https://www.networkadvertising.org/internet-connected-tv-choices/.

General limit and object to Processing

For any and all limit and object to Processing requests, such as for Personal Data under the Corporate and Website Privacy Policy, please contact us at privacy@indexexchange.com or at the address in the “Contact Us” section below.

Europe – right to lodge a complaint

Index Exchange complies with our obligations under European data protection and privacy laws and makes every effort to ensure your rights are protected and respected. If you have any questions or complaints about our Personal Data Processing, please contact us directly or our Data Protection Officer (DPO) using the details provided in the “Contact Us” section below.

You have a right to lodge a complaint with your local Data Protection Supervisory Authority if you wish to dispute the way we Process your Data. Please see the contact details of supervisory authorities below:

EU Data Protection Authorities:

http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm

Swiss Data Protection Authority:

https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html

UK Information Commissioner’s Office:

https://ico.org.uk/for-the-public

California – CCPA rights

As a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act (collectively, CCPA):

  • You have the right to know and access (please see our Website and Corporate Privacy Policy or our Exchange Platform Privacy Policy):
    • the categories of personal information and specific pieces of personal information we have collected,
    • the categories of personal information we have disclosed for a business purpose to third parties in the preceding 12-months,
    • the categories of sources from which we collect personal information,
    • the business or commercial purpose for collecting, sharing, or selling your personal information, and
    • the categories of third parties with whom we disclose, sell, or share personal information with;
  • You have the right to request deletion of personal information that we have collected, subject to certain exceptions;
  • You have the right to request correction of inaccurate personal information;
  • You have the right to opt out of the sale or sharing of your personal information;
  • You have the right not to receive discriminatory treatment for exercising your privacy rights conferred by the CCPA; and
  • You have the right to limit the use and disclosure of sensitive personal information.

Under California law, providing personal information to intermediary organizations for the purposes of ‘cross-context behavioral advertising’ constitutes a ‘sale’ or a ‘share’ of personal information, as these terms are defined in the CCPA. When you visit one of our customers, they may offer a “Do not Sell” and/or a “Do not Share” option. When you exercise any of those options, we should either not receive any personal information or receive personal information in addition to a signal that informs us of your decision. When we receive personal information with such a signal, we do not pass the information to any other party in the digital advertising space.

Additionally, you can opt out of the sale or sharing of personal information by submitting a request here. Please be aware that these opt-outs are specific to the web browser on which they are exercised, you will need to opt out on each web browser.

Privacy rights requests metrics

Please find below metrics to various requests under data protection and privacy laws for the previous calendar year:

Access requests

Total number: 83
Total fulfilled: 83
Total denied: 0
Mean fulfillment time: 1 day

Correction requests

Total number: 0
Total fulfilled: 0
Total denied: 0
Mean fulfillment time: not applicable

Deletion requests

Total number: 39
Total fulfilled: 39
Total denied: 0
Mean fulfillment time: 3 days

Opt-out of sale/sharing

Total number: 1
Total fulfilled: 1
Total denied: 0
Mean fulfillment time: 20

Limit use of sensitive Personal Data

Total number: 0
Total fulfilled: 0
Total denied: 0
Mean fulfillment time: not applicable

Changes to this document

We may change this document to accommodate new technologies, industry practices, regulatory requirements, or for other purposes. The date at the top of this document reflects the most recent changes made. We encourage you to review this document for the latest information on your privacy rights and how to exercise them, and to contact us if you have any questions or concerns.

Contact us

Privacy team at Index Exchange
If you have any questions, concerns, or complaints about the above or our privacy practices, please contact us at privacy@indexexchange.com or at:

Attn: Index Exchange c/o Privacy
8 Spadina Avenue, Suite 2600, Toronto, Ontario
M5V0S8 Canada

Data Protection Officer
You can also contact our DPO at gdpr@legalarmy.net or at:

Attn: Index Exchange Data Protection Officer
Legal Army, S.L., B88103700
Calle Princesa 31, Piso 5, Puerta A1, Madrid, Spain, 28008