End-Users Privacy Policy – Maestro Activation

(when our client wants to buy advertising)

Summary

Equativ (ex Smart AdServer) is a French company specializing in digital advertising. Our clients in particular advertisers use our product Maestro Activation to buy advertising space and display their ads on Equativ’s other clients environment (website, apps, etc.), according to various criteria, such as the content of the page visited, your interests, your location, the type of device used, or, etc.

Equativ and its clients only process your personal data as necessary for the selection of the best advertisement in compliance with applicable privacy and data protection laws. 

You will find on this page all the details on our processing activities within our product Maestro Activation used by our clients and the various means to assert your rights. 

Please note that Equativ acts both as controller and as joint controller with its Maestro Activation client, the essence of the joint controller agreement with such clients can be found below in section12. 

1. 1. Who are we? 

Equativ (“Equativ”, “our”, “us”, “we”) is an online advertising platform. Our clients in particular advertisers use our product Maestro Activation to buy advertising space and display their ads on Equativ’s other clients environment (website, apps, etc.), according to various criteria, such as the content of the page visited, your interests, your location, the type of device used, or, etc.

We enable our clients (“Client” or “Clients”) who can be publishers, advertisers, or intermediaries acting on their behalf (agencies, ad network,etc…) to offer you ads that best match your interests. 

Publishers sell their advertising space and advertisers buy the advertising spaces to display ads to you. For our product used by Publishers you can learn more about the processing of personal data here.

Advertisers use our technology to deliver their advertising campaigns according to certain criteria to meet their buying strategy plan and measure their advertising performance through statistical reporting, as explained below. .

Equativ is located at 66 rue de la Chaussée d’Antin, 75009 Paris, France. If you have any questions regarding privacy, you can contact us at privacy@equativ.com .

The purpose of this Privacy Policy is to explain, in the context of our Maestro Activation product how we use information we gather about you (“Personal Data”) including :

1. 1. Who are we?
2. 2. How do we collect data?
3. 3. What data do we process?
4. 4. For which purposes and on which legal grounds will Personal Data be processed?
5. 5. To whom do we provide your Personal Data? Who can have access to your Personal Data?
6. 6. How long do we store the data?
7. 7. Your GDPR privacy rights
8. 8. Your Privacy Rights under U.S Privacy laws
9. 9. Transfer of Personal Data outside of the European Union
10. 10. Opt-out and withdrawing of consent (GPDR)
11. 11. How do we ensure the security of your Personal Data ?
12. 12. Essence of the joint controllership agreement between Equativ and its Clients

The International Advertising Bureau (“IAB”) Europe is the European-level association for the digital marketing and advertising ecosystem in which Equativ participates. The IAB Europe Transparency & Consent Framework (“TCF”) is a privacy and data protection oriented mechanism which provides end-users with a standardized experience when they make privacy choices. 

Equativ complies with its Specifications and Policies, our identification number within the Framework is ID45.

For more information regarding the processing of your Personal Data when navigating on our corporate website please read our Corporate Privacy Policy here. For more information on the cookies used when navigating on our corporate website, please check our Cookies Policy here.

2. 2. How do we collect data?

Equativ uses the technologies to gain access or store data on a user’s device, including:

• – Cookies or similar technologies: which are small text files that contain a string of characters, stored in the user’s device. They allow us to recognize and save the user’s browser, preferences and other information.
• – Tracking tags: which is a small piece of code that is inserted into a Client’s website source code, which allows them to process data that will be transferred to Equativ in order to use our services.
• – Pixels: which are transparent images, included in advertising creatives in order to allow our clients to measure the actions of the user’s interaction with the ad.

Please find below the list of our cookies:

3. 3. What data do we process?

When navigating on our Client’s websites, mobiles and/or application and/or on any connected devices (including connected TV) we may process:

• – Browser and device data (e.g. type of device, screen size, user agent);
• – Navigation data (e.g. IP address, timestamp, location data, longitude, latitude, connection type, , site/app and page names, etc.);
• – Advertising data (e.g. Advertiser and buyer names, characteristics of the placement, type and details of the ad, etc.);
• – Segment name or ID;
• – Keywords; 
• – Identifiers ( including alternative IDs);
• – Privacy signal .

The Maestro activation technology does not collect: 

• – Information that could directly identify you ( such as your name, your address, or your phone number…) 
• – Sensitive information as defined under the General Data Protection Regulation  (such as your religious affiliation, political opinions or health details).

Please note that Maestro activation technology does not enable our Clients to directly target children  as  defined under applicable laws.

Under U.S privacy laws, we may have access to sensitive personal information such as precise geolocation in accordance with such laws. 

4. 4. For which purposes and on which legal grounds will Personal Data be processed?

a. Purposes

When Equativ is joint controller with its Clients, we process Personal Data for the following purposes:

• – The collection of personal data through tracking devices by storing information or gaining access to an end-user’s terminal equipment ;
• – Retargeting advertising;
• – Conversion measurement; 
• – Reporting on campaign performance, including where and if applicable, Processing of Personal Data to allow Company or Equativ to use its own third party ad performance measurement tool; 
• – Frequency capping.

When Equativ acts as controller we may process Personal Data including for: 

• – The reception of bid requests; 
• – The analysis of privacy signals, 
• – Ensuring security, preventing fraud and debugging, 
• – The improvement of Equativ’s services , 
• – The management of the commercial relationship between the parties, 
• – Client support, 
• – Billing.

In Europe, the purposes linked to the provision of the advertising services provided by Equativ may correspond to the IAB TCF’s following terms: 

• – Store and/or access information on a device;
• – Use limited data to select advertising;
• – Create profiles for personalized advertising ;
• – Uses profiles to select personalized advertising;
• – Measure advertising performance;
• – Develop and improve services;
• – Ensure security, prevent and detect fraud, and fix errors.

b. Legal basis

We rely on either:

• – Your consent, when required; 
• – our legitimate interest in accordance with applicable laws; 
• – for the performance of our contract with our clients;
• – to comply with a legal obligation to which we are subject to.

1. 5. To whom do we provide your Personal Data? Who can have access to your Personal Data?

We may share information, including Personal Data, to our affiliates; trusted third parties such as Clients, Equativ service providers ( for example for hosting and internet connectivity, anti-fraud purposes). When permitted we may also share data with trusted business partners in order to perform or enhance our products and services.

We may also disclose information if:

• – We are required by national or international law to do so;
• – we must comply with an authorized and lawful request or demand;
• – it is necessary in order to defend our own rights or interests.

We may transfer your data to a successor entity in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change.

6. 6. How long do we store the data?

Unless otherwise required by applicable laws, Personal Data will be retained for a maximum of three months.

7. 7. Your GDPR privacy rights

You can address your request to exercise these rights either to the Client or to Equativ. The joint controller receiving your request shall respond to it itself, within the timeframes and according to the applicable legal requirements. However, if it is necessary to process your request or if the answer to the request implies the assistance of the other joint controller, Equativ and Client may cooperate on your request and its answer.

You may ask us at any time to:

• – Confirm your Personal Data is being processed and/or to provide you a copy of your Personal Data (access);
• – Rectify your Personal Data if it is inaccurate or incomplete;
• – Withdraw your consent;
• – Erase your Personal Data, for instance if it is unlawfully processed or if you withdraw your consent;
• – Opt out the process of any data;
• – Restrict the processing of your Personal Data, (i) if the information is inaccurate, (ii) the processing is unlawful, (iii) you need us to retain the information after the retention for a legal claim, or (iv) you have objected to the processing and a verification of our legitimate interests is pending;
• – To provide you with an electronic file of your Personal Data, or to transfer your Personal Data to a third party, if technically feasible (portability).

Your request should be addressed to privacy@equativ.com . We will respond within one month. If permitted under applicable law and/or if necessary due to the complexity and number of requests, we may extend the response period to two months. We will notify and explain the reasons for any extension to you. If we deny your request, we will inform you of the reasons for such denial.

If you consider your rights have been infringed upon according to applicable laws, you may lodge a complaint towards the French supervisory authority the CNIL. 

8. 8. Your Privacy Rights under U.S Privacy laws

This section of the Privacy Policy aims at providing information on the relevant U.S Privacy laws and particularly the rights therein. 

When you are navigating on our Client’s websites and/or using their apps on your devices, we may collect Personal Information, notably via the use of cookies or other tracking technologies as a Third Party, Processor, or Controller/Business as the case may be.

For information on the categories of personal data or information we collect, the sources from which such data or information is collected, the purposes of collecting such data or information and with whom we may share those, please refer to the sections above.

Under the U.S Privacy laws (by order of entry into force) you have the following rights:

US Privacy laws	Applicable Privacy Rights
California	The Right to know about the personal information we collect and how we use it. For more information, please refer to the ‘what data do we process’ section above or contact us directly.  The Right to Delete. Upon your request, we will delete the personal information we have collected about you, subject to applicable legal exceptions.  The Right to Opt-Out of the Sale or Sharing of your personal information. As we do not directly face End-Users, our client Publishers or Advertiser do, you will need to exercise such rights directly to such Publisher/Advertiser. The Right to Correct inaccurate personal information that we may have on you. The Right to limit the use and disclosure of sensitive personal information collected, where and if applicable. The Right to Non-Discrimination for the exercise of a Consumer’s Privacy Rights. We will not deny goods or services, charge you a different price, or provide a different level or quality of goods or services because you exercised your rights under the CCPA.
Virginia	The Right to Confirm if we are actually processing your personal data and to Access such personal data. The Right to Correct inaccuracies in your personal data that we have collected taking into account the nature of the personal data and the purposes of the processing. The Right to Delete personal data provided by you or obtained about you,  subject to applicable legal exceptions.  The Right to Obtain copies of the personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means. The Right to Opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data or, where and if applicable, profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
Colorado	The Right of Access and to Confirm whether the processing of your personal data concerning you. The Right to Correct any inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of such personal data.  The Right to Delete your personal data, subject to applicable legal exceptions.  The Right to Data Portability. When exercising the right to access personal data you also have the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, provided such transfer shall not be required to reveal any trade secret. Please note that under Colorado Privacy law, you may exercise such right no more than two times per calendar year.   The Right to opt out of targeted ads, the sale of their personal data, or, where and if applicable, profiling in furtherance of decisions that produce legal or similarly significant effects on you.
Connecticut	The Right to Confirm whether or not your personal data is being processed and Access such personal data, unless such confirmation or access would require us to reveal a trade secret.  The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Delete personal data provided by, or obtained about you. The Right to Obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret.  The Right to Opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or, where and if applicable, profiling in furtherance of solely automated decisions that produce legal or similarly significant effects on you.
Utah	The Right to Confirm the processing of your personal data and to Access your personal data.  The Right to Delete your personal data, provided legal exceptions.  The Right to Obtain a copy of your personal data, in a format that: (a) to the extent technically feasible, is portable; (b) to the extent practicable, is readily usable; and (c) allows you to transmit the data to another controller without impediment, where the processing is carried out by automated means.  The Right to Opt out of the processing of the your personal data for purposes of: targeted advertising or the sale of personal data. Nothing in the exercise of such rights should be construed as a requirement for us to disclose any trade secret.
Oregon	The Right to Confirm the processing of your personal data and to Access your personal data. At the controller’s option, you can obtain a list of specific third parties, other than natural persons, to which the controller has disclosed: (a) your personal data; or (b) any personal data; and (c) a copy of all of your personal data that other controller has processed or is processing. The Right to Delete your personal data obtained about you, including personal data you provided to the controller, personal data the controller obtained from another source and derived data. The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Obtain a copy of your personal data that the controller has processed or is processing. The Controller shall provide the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling you in furtherance of decisions that produce legal effects or effects of similar significance.
Florida	The Right to Confirm the processing of your personal data and to Access your personal data. The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Delete any or all personal data provided by or obtained about you.  The Right to Obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of a decision that produces a legal or similarity significant effect concerning you. The Right to Opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data. The Right to Opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature.
Texas	The Right to Confirm the processing of your personal data and to Access your personal data.  The Right to Delete your personal data provided by or obtained about you.  The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. If the data is available in a digital format, the Right to Obtain a copy of your personal data, that you previously provided to the controller,  in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of a decision that produces a legal or similarity significant effect concerning you.
Montana	The Right to Confirm the processing of your personal data and to Access your personal data, unless such confirmation or access would require the controller to reveal a trade.  The Right to Correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing. The Right to Delete your personal data. The Right to Obtain a copy of your personal data, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another controller without hindrance when the processing is carried out by automated means, provided the controller is not required to reveal any trade secret. The Right to Opt out of the processing of your personal data for purposes of: (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.
Iowa	The Right to Confirm the processing of your personal data and to Access your personal data.  The Right to Delete your personal data provided by you.  The Right to Obtain a copy of your personal data, except as to personal data that is defined as “personal information” pursuant to section 715C.1 that is subject to security breach protection, that you  previously provided to the controller (a) in a portable and, (b) to the extent technically practicable, readily usable format, (c) that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means. The Right to Opt out of the sale of personal data.
New Hampshire	The Right to Confirm the processing of your personal data and to Access such your personal data, unless such confirmation or access would require the controller to reveal a trade secret. The Right to Delete any or all personal data provided by or obtained about you.   The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Obtain a copy of your personal data, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data;or (c) profiling in furtherance of solely automated decisions that produces a legal or similarity significant effects concerning you.
Delaware	The Right to Confirm the processing of your personal data and to Access your personal data, unless such confirmation or access would require the controller to reveal a trade secret. The Right to Delete your personal data, provided by, or obtained about you. The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Obtain a copy of your personal data, by the controller, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of a decision that produces a legal or similarity significant effect concerning you. The Right to Obtain a list of the specific third parties to which the controller has disclosed your personal data see section.
Nebraska	The Right to Confirm the processing of your personal data and to Access your personal data.  The Right to Delete your personal data provided by or obtained about you.  The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. If the data is available in a digital format and the processing is completed by automated means, the Right to Obtain a copy of your personal data that you previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of a decision that produces a legal or similarity significant effect concerning you.
New Jersey	The Right to Confirm the processing of your personal data and to Access your personal data. Nothing shall require a controller to provide the data to in a manner that would reveal the controller’s trade secrets. The Right to Delete your personal data. The Right to Correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. The Right to Obtain a copy of your personal data held by the controller in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, provided that nothing in this paragraph shall require a controller to provide the data to the consumer in a manner that would reveal the controller’s trade secrets. The Right to Opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of a decision that produces a legal or similarity significant effects concerning you.

You can exercise your rights and address your request directly to Equativ by contacting us at privacy@equativ.com.

Please note that we do not directly face end-users, our Clients do, in such case, it may be appropriate for you to exercise your rights directly on the website of the concerned Client. For example, you can opt-out of the processing of your personal data or information for a sale, share or targeted advertising by clicking on the link “Do not sell or Share My Personal Information” or by directly contacting their privacy team.

To appeal our  decision regarding a request related to these rights, you may email us at privacy@equativ.com.

9. 9. Transfer of Personal Data outside of the European Union

Personal Data may be transferred to our affiliates or a partner located outside the EU/EEA including to third-countries for which the European Commission has not adopted an adequacy decision yet. With these partners, we ensure that appropriate safeguards are implemented to ensure an adequate level of protection including but not limited to the signature of standard contractual clauses adopted by the European Commission.

10. 10. Opt-out 

For the sake of transparency, Equativ has adopted a cookie opt-out policy, allowing each Internet user to opt out from our advertising network. This ensures that your browser will no longer be identified by our system. Please note that for us to acknowledge your desire to opt-out, one cookie will be placed on your device in order to ensure the performance of your opt-out. Moreover, this opt-out will only be available for the device on which it was created. If you wish to opt-out, click here. A blank page will open, confirming the opt-out process has been completed and Equativ will no longer place cookies on your device.

You can also accept or reject some or all cookies (for example, blocking all third-party cookies) directly on your browser by adjusting your browser settings. However, please note that some websites may not be accessible or function properly if you decide to opt-out from all cookies. If you do not know how to do this, the links below set out information about how to change your browser settings for some of the most commonly used web browsers:

• – Chrome
• – Safari
• – Firefox
• – Opera
• – Microsoft Edge

For mobile devices you can also refer to the following links:

• – Chrome
• – Safari

11. 11. How do we ensure the security of your Personal Data ?

In order to ensure and maintain the security of your Personal Data, we have implemented all technical and organizational measures at our disposal to prevent your data from being unintentionally and accidentally lost, used, altered, or made available to the public without your authorization.

Should such an event occur, we have implemented measures to react promptly and to inform you and the competent authorities when necessary.

12. 12. Essence of the joint controllership agreement between Equativ and its Clients

Pursuant to data protection regulations, Equativ and its Clients have determined their respective responsibilities for compliance with the obligations under the data protection regulations by means of an arrangement between them.

Equativ and Client

Equativ and its Client agreed on the legal basis of the processing. Equativ is responsible for the adequate declaration of the purposes, legal basis, types of data and duration storage of the data processing under joint controllership in the TCF of IAB Europe. The Client undertakes to comply with the TCF, and in particular to collect the consents or objections and other choices of data subjects regarding cookies and data processing.

Client alone

Client is responsible for the provision of information to end users, before any data processing, in accordance with data protection laws and standards on the data processing made under the joint controllership of Client and Equativ. 

Each of Client or Equativ 

Each joint controller shall comply with its obligations under applicable data protection laws and privacy standards (such as IAB Europe standards), including compliance with data protection principles such as purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability; data protection by design and by default. 

Each joint controller is responsible for the provision of the essence of the arrangement of the joint controllership in its own privacy policy.

Each joint controller ensures itself the confidentiality and security of the personal data it processes in the context of joint processing operations regarding the means, persons and legal bodies (including data processors) it controls in such context.

Each joint controller is responsible for the choice the data processors it works with for the processing of data under joint controllership and their compliance with data protection laws and standards.

Each joint controller is responsible of the compliance with data protection laws of any transfer of data outside the European Economic Area (EEA). Data transfers outside the EEA are governed by the provisions relating to such transfers in the joint controllers’ respective privacy policy for Equativ: see section 9).

You have the same rights as those described in the joint controllers’ respective privacy policy, for Equativ: see section 7 . The main point of contact for any data protection request is Equativ’s Data Protection Officer: dpo@equativ.com or privacy@equativ.com, but you can address your request to exercise these rights either to the Client or to Equativ. The joint controller receiving your request shall respond to it itself, within the timeframes and according to the applicable legal requirements. However, if it is necessary to process your request or if the answer to the request implies the assistance of the other joint controller, Equativ and Client may cooperate on your request and its answer.

Equativ alone or leading

Notification and communication regarding data breaches are carried out jointly by the two joint controllers according to a procedure set contractually between them in which Equativ is designated as the leading party on such data breaches notification and communication, as such breaches should necessarily impact Equativ’s platform.

Equativ has conducted a data protection impact assessment for the processing under joint controllership between Equativ and Client. Each joint controller establishes and maintains itself any other documentation necessary to demonstrate compliance with the personal data protection laws of the joint processing operations, in particular the recording of the joint processing operations in its own register of processing activities. If necessary, the joint controllers cooperate in good faith with each other and provide relevant information required to fulfil their accountability obligations or to address any data protection authority’s request on processing activities under their joint controllership.

13. 13. Amendment of this Privacy Policy

We reserve the right to update this Privacy Policy from time to time in order to reflect any change to our products or services or to comply with changes in our legal and/or regulatory obligations. Please check this page for any updates.

14. 14. More questions?

If you have questions about this Privacy Policy, you may e-mail us at privacy@equativ.com  or contact our DPO at dpo@equativ.com .

Last update: 21 February 2025