Adverteks is committed to full compliance with the General Data Protection Regulation (GDPR). This page explains our data practices, your rights as an EU/EEA data subject, how we process personal data within our programmatic advertising platform, and how to contact us with requests.
This GDPR Compliance page applies to all individuals located in the European Union (EU) or European Economic Area (EEA) who interact with the Adverteks platform in any capacity:
GDPR governs the processing of personal data of individuals in the EEA, regardless of where Adverteks (the data processor/controller) is located. If you are outside the EEA, our Privacy Policy still applies.
For publishers and advertisers using the Adverteks platform, Adverteks acts as a data controller — we determine the purposes and means of processing your account and billing data.
For end-user data collected during ad serving on publisher sites, Adverteks acts as both a data controller (for fraud detection and platform security) and data processor (processing data on behalf of publishers for ad delivery).
Data Protection Officer (DPO): Adverteks has designated a Data Protection Officer responsible for overseeing GDPR compliance. Contact our DPO directly at dpo@adverteks.com for any data protection concerns. We respond to all DPO inquiries within 5 business days.
| Contact Type | Response Time | |
|---|---|---|
| Data Protection Officer (DPO) | dpo@adverteks.com | 5 business days |
| Subject Access Requests (SAR) | privacy@adverteks.com | 30 days (extendable to 90) |
| General Privacy Inquiries | privacy@adverteks.com | 10 business days |
| Legal & Compliance | legal@adverteks.com | 10 business days |
When you register and use the Adverteks platform, we collect:
When Adverteks serves ads on publisher websites, we collect limited technical data from end users for ad delivery, fraud prevention, and targeting:
Minimization Principle: We apply data minimization throughout. End-user IP addresses are truncated before storage. Full IP addresses are only retained temporarily in security/fraud logs and deleted within 30 days. We do not build persistent individual user profiles without explicit consent.
GDPR requires a lawful basis for every data processing activity. The table below documents our processing activities and their legal basis under Article 6 GDPR:
| Processing Activity | Data Subjects | Legal Basis | GDPR Article |
|---|---|---|---|
| Account creation and management | Publishers, Advertisers | Contract performance | Art. 6(1)(b) |
| Payment processing and invoicing | Publishers, Advertisers | Contract performance | Art. 6(1)(b) |
| Tax compliance and record keeping | Publishers, Advertisers | Legal obligation | Art. 6(1)(c) |
| Fraud detection and prevention | All | Legitimate interests | Art. 6(1)(f) |
| Platform security and abuse prevention | All | Legitimate interests | Art. 6(1)(f) |
| Contextual ad serving (no behavioral profiling) | End Users | Legitimate interests | Art. 6(1)(f) |
| Behavioral/interest-based ad targeting | End Users | Consent (via publisher CMP) | Art. 6(1)(a) |
| Analytics and performance reporting | Publishers, Advertisers | Legitimate interests | Art. 6(1)(f) |
| Customer support communications | Publishers, Advertisers | Contract performance / Legitimate interests | Art. 6(1)(b)/(f) |
| Marketing and product updates | Publishers, Advertisers | Consent (opt-in) or Legitimate interests (existing customers) | Art. 6(1)(a)/(f) |
Where we rely on legitimate interests as a legal basis, we have conducted Legitimate Interests Assessments (LIAs) to ensure our interests do not override the rights and freedoms of data subjects. Documentation is available upon request from our DPO.
Adverteks uses cookies and similar tracking technologies for platform functionality, analytics, and (with consent) advertising. Our full cookie list is documented in the Cookie Policy.
Publishers deploying Adverteks ad tags on EEA-facing websites must implement a compliant Consent Management Platform (CMP) using the IAB Europe Transparency and Consent Framework (TCF v2.2). Our ad serving infrastructure:
Advertisers may implement conversion tracking via Adverteks pixel or postback URL. These tools only fire on advertiser-owned landing pages after ad click, and only where required user consent is present on the destination site.
Adverteks operates a Real-Time Bidding (RTB) exchange connecting publishers with DSP buyers. This is a core part of our business model with specific GDPR implications.
When a publisher's ad slot is available for auction, Adverteks broadcasts a bid request to DSP partners containing:
All DSP partners accessing our exchange are contractually required to:
Adverteks has executed GDPR-compliant Data Processing Agreements with all DSP partners and sub-processors. A list of our key sub-processors is available upon request to dpo@adverteks.com.
We retain personal data only as long as necessary for the purpose it was collected, or as required by law. The table below summarizes our standard retention periods:
| Data Type | Retention Period | Reason |
|---|---|---|
| Publisher/Advertiser account data | Duration of account + 7 years | Contract performance; tax/accounting obligations |
| Payment and billing records | 7 years from transaction date | Legal obligation (tax law) |
| Full IP addresses (fraud logs) | 30 days | Fraud detection; deleted automatically |
| Truncated IP addresses (geo-data) | 90 days aggregated | Analytics and optimization |
| Ad impression/click logs | 90 days (raw); 7 years (aggregated) | Reporting, fraud investigation, billing disputes |
| Cookie / advertising IDs | 13 months from last activity | IAB TCF standard; user opt-out honored within 24h |
| Support communications | 3 years from last interaction | Legitimate interests (service improvement) |
| Consent records (TC Strings) | 5 years | Legal obligation (consent audit trail) |
| Closed account data | 30 days post-closure (then deleted) | Dispute resolution window; then minimized |
Automated deletion processes run nightly. Data flagged for deletion is removed within 30 days of the scheduled date. You may request earlier deletion under your Right to Erasure (see Section 8).
EU/EEA data subjects have the following rights under GDPR. These rights apply to your personal data held by Adverteks as data controller:
Request a copy of all personal data we hold about you, including processing purposes, retention periods, and recipients.
Correct inaccurate or incomplete personal data. Account data can be updated directly in your profile settings.
Request deletion of your data where we have no compelling reason to retain it. Also known as the "right to be forgotten."
Request that we restrict processing of your data in certain circumstances, such as while accuracy is contested.
Receive your data in a structured, machine-readable format (JSON or CSV) to transfer to another service.
Object to processing based on legitimate interests, including direct marketing. We stop processing immediately on valid objection.
Not be subject to solely automated decisions with significant legal effects. Request human review of automated decisions that affect you.
Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of prior processing.
Response Timelines: We respond to all rights requests within 30 days. For complex requests, we may extend this to 90 days and will notify you within the first 30 days if an extension is needed. We never charge a fee for standard requests.
Submitting a Subject Access Request or exercising any other GDPR right is straightforward. Follow these steps:
For end users who are not Adverteks account holders, we can process requests related to data collected through our ad serving infrastructure. Note that we may have limited ability to identify end-user data without a cookie ID or device identifier.
Adverteks processes data in the United States and may transfer personal data to recipients outside the EEA. We ensure all international transfers are protected by appropriate safeguards:
Our infrastructure is hosted on Render.com (US-based) and uses Neon (US-based) for database hosting. Both processors have executed SCCs with Adverteks and maintain their own GDPR compliance programs. Transfer impact assessments are available from our DPO upon request.
Adverteks does not knowingly collect personal data from individuals under the age of 16 (or lower age where applicable national law provides). Our platform is a B2B advertising technology service not directed at children.
Publishers using Adverteks ad tags on content directed at children under 16 must:
If you believe a child has had their data collected through our platform, contact privacy@adverteks.com and we will delete it promptly.
If you are dissatisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with your local data protection supervisory authority.
EEA supervisory authorities include:
We always prefer to resolve complaints directly. Before filing a supervisory authority complaint, please contact our DPO at dpo@adverteks.com — we will work with you in good faith to find a resolution.