This Privacy Notice applies to personal information processed by Moloco Inc. (“Moloco,” “we,” “us,” and “our”) through our demand-side platform services that we offer to advertiser clients (“Advertising Services”).
About Moloco
Moloco provides a demand-side platform that allows buyers of digital advertising inventory (i.e., advertisements displayed in mobile applications) to achieve their mobile marketing goals through user acquisition and retargeting.
How it works
When a mobile application wants to provide in-app advertisements, it can work with ad exchanges and/or supply side platforms to reach potential advertisers. To do this, the mobile application will share certain device level data with the ad exchanges and/or supply side platforms when someone is using its mobile application and it wants to show them an advertisement. The ad exchanges and/or supply side platforms then make this device level information available to demand-side platforms in the form of “bid requests” (i.e., a request to bid on displaying an advertisement to the mobile app user).
Once a demand-side platform (e.g., Moloco) receives a bid request, it will help its advertiser clients decide how much to bid on displaying an advertisement based on a variety of factors.
Moloco determines this using various machine learning techniques. For example, we may use the event data provided to us by our advertiser clients (described below) to build lookalike targeting models that help our advertiser clients show advertisements to other mobile app users who are similar to their existing user base.
Using these insights allows us to help advertiser clients decide which mobile app users to target and how much to spend on advertisements. Whenever our advertiser client has the highest bid to display an advertisement, it will win the bid request and the mobile app user will see its advertisement.
Personal information we collect
A Quick Note:
Before we describe the types of information collected by the Advertising Services, it is important to understand that all information processed by the Advertising Services is solely at the device level and cannot, by itself, be used to identify a natural person in the real world. However, certain privacy and data protection laws still consider this device level data to be “personal information” which is why we use this terminology in our Privacy Notice.
Below are the types of information collected by the Advertising Services:
Event data
Moloco’s advertiser clients often provide us with device level data that they have collected about users of their mobile applications. This information provides insight into the activities that the users have engaged in on the advertiser client’s mobile application. Moloco uses this information to create models that help the advertiser client determine what sort of users it should target with advertisements online and how much it should spend on advertisements. Moloco is a “processor” or “service provider” of event data and may only use this data in accordance with our advertiser client’s written instructions.
Bid request data.
When Moloco receives a bid-request from an ad exchange or a supply side platform, we collect device level data contained in the bid-request which may include:
- Advertising IDs (IDFA/GAID);
- Device make, model and operating system;
- Device properties related to screen size & orientation, audio volume and battery, device memory usage;
- Carrier;
- Operating system;
- Name, properties, and other user info of mobile application through which a device interacts with the Advertising Services;
- Country, time zone and locale settings (country and preferred language);
- City- and/or country-level geolocation data;
- Network connection type and speed;
- IP Address; and
- Internet browser user-agent used to access the Advertising Services.
Impression data.
When an advertiser client wins a bid and has its advertisement displayed to the mobile app user, Moloco collects information related to this transaction including the Advertising ID (IDFA/GAID) which was shown the ad.
How we use personal information
We use personal information for a variety of business purposes, including:
- Providing the Advertising Services;
- Developing machine learning models;
- Serving tailored ads on behalf of our advertiser clients;
- Measuring the performance of and optimizing advertising campaigns on behalf of our clients;
- Analyzing trends;
- Deriving insights;
- Pursuing legitimate interests, such as fraud prevention, frequency capping, research and development (including marketing research), and network and information security;
- Generating de-identified and/or aggregated data;Improving the Advertiser Services;
- Developing new products and services;
- Ensuring internal quality control and safety;
- Enforcing our agreements;
- Complying with our legal obligations; and
- As you otherwise consent.
Disclosing your information to third parties
We may share personal information with the following categories of third parties:
Advertiser clients
If we deliver an advertisement to a mobile application user on behalf of an advertiser client, we may share information related to that transaction with our advertiser client and/or its mobile measurement partners. Your personal information may be subject to the advertiser client’s and/or its mobile measurement partner’s privacy policy. We are not responsible for the advertiser client’s or the mobile measurement partner’s processing of your personal information.
Service providers
We may share any personal information we collect about you with our third-party service providers that help us provide the Advertising Services.
Affiliates
We may share personal information with Moloco’s affiliated entities.
Disclosures to protect us or others
We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.
Disclosure in the event of merger, sale, or other asset transfer.
If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.
International data transfers
All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, Belgium, Taiwan, the United States, or other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.
Your choices
Personalized Advertisements. You may limit ad tracking in mobile application environments by following the instructions for Android, iOS and others. For the most effective and up-to-date limit ad tracking methods, you should consult instructions provided by your device manufacturer.
Your privacy rights
In accordance with applicable law, you may have the right to: (i) request confirmation of whether we are processing your personal information; (ii) obtain access to or a copy of your personal information; (iii) receive an electronic copy of personal information that you have provided to us, or ask us to send that information to another company (the “right of data portability”); (iv) object to or restrict our uses of your personal information; (v) seek correction or amendment of inaccurate, untrue, incomplete, or improperly processed personal information; (vi) withdraw your consent; and (vii) request erasure of personal information held about you by us, subject to certain exceptions prescribed by law. If you would like to exercise any of these rights, please contact us as set forth below.
We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request.
Please note that because we are unable to authenticate any individuals whose device level data we receive from ad exchanges and/or supply side platforms, we are unable to fulfill such requests. In addition, we are not able to fulfill requests we receive where we act as a “processor” or “service provider” of personal information as our advertiser clients are the “controller” or “business” of this information and responsible for managing these requests.
Data retention
We store the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, provide our Advertising Services, resolve disputes, establish legal defenses, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
SUPPLEMENTAL CALIFORNIA PRIVACY NOTICE
This Supplemental California Privacy Notice only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA provides California residents with the right to know what categories of personal information Moloco, in its capacity as a business, has collected about them and whether Moloco disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding 12 months. California residents can find this information below:
Category of Personal Information Collected by Moloco
- Identifiers
- Commercial information
- Internet or other electronic network activity
- Inferences drawn from other personal information to create a profile about a consumer
Categories of Third Parties Personal Information is Disclosed to for a Business Purpose
- Service providers
The categories of sources from which we collect personal information and our business and commercial purposes for using personal information are set forth above.
“Sales” of Personal Information under the CCPA. For purposes of the CCPA, Moloco does not “sell” personal information, nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.
Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.
Children's information
The Advertising Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.
SUPERVISORY AUTHORITY
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law.
CHANGES TO OUR PRIVACY NOTICE
We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you by posting an updating notice online.
CONTACT US
If you have any questions about our privacy practices or this Privacy Notice, please contact us at:
Attn: Privacy Group
Moloco Inc.
601 Marshall St., 5th Floor
Redwood City, CA 94063
[email protected]
UK GDPR Representative: Moloco UK Limited, with registered address No.1 London Bridge, London, SE1 9BG
EU GDPR Representative: Moloco Germany GmbH, with registered address Am Zirkus 2, 10117 Berlin
EXHIBIT A
Supplemental Terms for the Standard Contractual Clauses
If you are a company (“Company”) that has entered into a commercial agreement with Moloco (“Agreement”), and the Agreement incorporates by reference Module One’s obligations set forth in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“Standard Contractual Clauses”), and expressly references this Exhibit A, this Exhibit A forms part of the Agreement and supplements the Standard Contractual Clauses.
Moloco and Company agree that the following terms will supplement the Standard Contractual Clauses:
- Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the applicable data protection laws of Switzerland. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to such laws.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) the optional text in Clause 11 is deleted; and (v) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
- Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data Exporter: Company.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: As set forth in the Agreement.
Role: Controller.
Data Importer: Moloco.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: As set forth in the Agreement.
Role: Controller.
B. Description of the Transfer:
Categories of data subjects whose personal data is transferred: End users of data exporter’s or its publisher clients’ digital properties.
Categories of personal data transferred: Personal data that is transferred under the Clauses including, but not limited to, device ID and related Bid Request Data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: To the parties’ knowledge, no sensitive data is transferred.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard functionality of data exporter’s services, or as otherwise agreed upon by the parties.
Nature of the processing: As set forth in the Agreement.
Purpose(s) of the data transfer and further processing: As set forth in the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer may retain personal data in accordance with the Moloco Privacy Notice.
C. Competent Supervisory Authority: The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.
D. Additional Data Transfer Impact Assessment Questions:
Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Standard Contractual Clauses? For example, FISA Section 702. If yes, please list these laws: As of the effective date of the Agreement, no court has found data importer to be eligible to receive process issued under the laws contemplated by this question, including FISA Section 702, and no such court action is pending.
Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain: No.
Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain: No.
E. Data Transfer Impact Assessment Outcome: Taking into account the information and obligations set forth in the Agreement and, as may be the case for a party, such party’s independent research, to the parties’ knowledge, the personal data originating in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the Standard Contractual Clauses to a country that has not been found to provide an adequate level of protection under applicable data protection laws is afforded a level of protection that is essentially equivalent to that guaranteed by applicable data protection laws.
- Annex II. Annex II of the Standard Contractual Clauses shall read as follows:
Data importer shall implement and maintain commercially reasonable technical and organisational measures designed to protect personal data.
- Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:
The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.
- Clarifying Terms. The parties agree that the termination right contemplated by Clause 14(f) and Clause 16(c) of the Standard Contractual Clauses will be limited to the termination of the Standard Contractual Clauses.
.webp)
