VECTAURY PRIVACY POLICY

Last updated January 2021

Preamble

VECTAURY is a company specialised in digital marketing on mobile phones more specifically in the area of drive-to-store advertising and advertising adapted to the geographical position of smartphone users (hereinafter the "Users"). VECTAURY also offers its clients marketing studies to help them make decisions, for example concerning the opening of new points of sale or to better position themselves in relation to competing points of sale. VECTAURY also offers its clients the possibility of measuring the impact of their mobile or OOH/DOOH advertising campaigns on traffic in their points of sale, whether these campaigns were displayed by VECTAURY or a third party.

1- Identity of the data controller

The data controller is VECTAURY, a simplified joint-stock company with a shared capital of €250,000, registered with the Paris Trade and Companies Register under number 799 256 730, whose registered office is located at 42 rue de Maubeuge 75009 Paris, France

2- Contact details of our data protection officer

In accordance with the requirements of Article 37 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter "the GDPR"), VECTAURY has appointed a Data Protection Officer (hereinafter "DPO").

You may contact our DPO if you have any question regarding the processing of personal data implemented by VECTAURY and request the exercise of your rights set out in Article 8 of this Privacy Policy by writing to the following address:

  • VECTAURY, for the attention of the Data Protection Officer, 42 rue de Maubeuge 75009 Paris, France
  • or by sending an e-mail at legal@vectaury.io .

3- Processing of personal data collected on mobile applications

3.1- Categories of data collected

In order to implement the purposes of processing (i.e. the activities carried out by VECTAURY and, more specifically, the purposes for which the personal data collected is processed) described below, VECTAURY collects data via two means of collection :

  • Thanks to its proprietary SDK (Software Development Kit) technology integrated into the applications of partner publishers, the SDK is comparable to a cookie on a mobile phone
  • Thanks to the mechanism of buying advertising space via real-time auctions on the Real Time Bidding (RTB) market in order to acquire from different SSP (Supply Side Platform) partners advertising space available in mobile applications to display advertising campaigns on behalf of our clients

The personal data collected via these two mechanisms are as follows:

Data collected Data retention period
Advertising ID of the user's smartphone Immediately deleted (in less than a second) after transformation into an internal identifier which is kept for 12 months
Data about the user's smartphone from which data is collected: brand, phone model, version, phone language, OS type, OS version, truncated IP address. 12 months from collection
Advertising execution context data: Application identifier, application name and type, application IAB category, application version, timestamp. 12 months from collection
On the “mini site” to which the user is redirected when he clicks on an advertisement displayed by VECTAURY: page views, various actions, timestamps, etc. 12 months from collection
Geolocation data: GPS position immediately transformed into a 600m² surface area. The GPS positionss are immediately deleted (in less than a second) and the surfaces are kept for 12 months from the date of their collection

3.2- Data processing purposes

VECTAURY collects the personal data set out above for the purpose of displaying advertisements adapted to the User's geographical position within the mobile applications opened by him.

In order to be able to display advertisements adapted to the interests of these Users, VECTAURY carries out profiling processing in order to deduce information relating to the centres of interest of Users, but also socio-demographic data such as their gender, age group, living and working locations

This profiling processing is a necessary prerequisite for VECTAURY to implement its purpose of carrying out marketing studies. Although the report provided to its customers only contains aggregate statistical data, VECTAURY must have the information mentioned above in order to provide its customers with studies to enable them to better understand the profile of their visitors at points of sale and to have access to relevant geomarketing information.

At last VECTAURY collects data via its SDK and the advertising space purchasing system via real-time auctions in order to offer its customers the performance measurement of advertising campaigns displayed by VECTAURY or third parties.

3.3- Legal basis of the processing operation

In order to carry out processing operations for the purposes of profiling, displayof targeted advertising adapted to the location of Users and their centres of interest, carrying out marketing studies and measuring the effectiveness of media campaigns, VECTAURY uses the legal basis of the User's Consent.

In order to collect the consent of Users, VECTAURY ensures that its partner publishers integrating its SDK validly collect the consent of Users thanks to a Consent Management Platform registered within the transparency and consent framework of the IAB (the Interactive Advertising Bureau). Publishers integrating the VECTAURY SDK contractually guarantee that they have validly informed Users and collected compliant consent. To do so, they can integrate the VECTAURY CMP or a third party CMP once VECTAURY has audited and considered this CMP compliant thanks to an audit grid validated by the CNIL (the french data protection authority).

The CMP is a consent management tool that enables VECTAURY to collect the consent of Users so that VECTAURY can implement its activities legally and collect free, specific and informed consent. VECTAURY has decided to use only CMPs referenced within the Transparency and Consent Framework of the IAB Europe, which it has previously audited and whose compliance has been validated, to collect Users' consent.

The CMP allows application vendors to collect user consent in a fair manner. Thanks to this CMP, the user is informed, as soon as the application is opened, of the personal data collected, the purposes of processing and can also access the partners receiving his data as well as their purposes of processing and their privacy policy. The CMP allows users to consent or not to consent to the collection of their personal data for each of the stated purposes. They can, from the first page, configure their choice by purpose or accept or refuse all the purposes

In order to collect valid consent from users when VECTAURY collects data through the purchase of advertising space via the Real time bidding system, VECTAURY ensures that the CMPs through which users have given their consent genuinely allow valid consent to be collected. To this end, VECTAURY has implemented a process enabling it to audit the CMPs used and to collect data only from those considered to be legally compliant. VECTAURY detects the IAB ID number of the CMP on which the user has made his or her consent choices, which then enables it to retrieve and audit it using the audit grid mentioned above.

The Consent strings associated with the data collected in the advertising requests allow VECTAURY to respect the consent of the users.

VECTAURY respects the requirement of consent traceability by storing the consent strings generated when the user sets his choices on the CMP.

4- Processing of personal data collected on the VECTAURY website www.vectaury.io

4.1. Data filled in the contact form

On our website, you can contact our team by clicking on the "contact us" tab. You will then be directed to a contact form asking you to fill in the following information: your name, first name, email address, company for which you work and optionally your telephone numbers and quality.

This data is only used to respond to your request, and/or to contact you about our products and services and is kept for 1 year from receipt. You may at any time request their deletion or access to these data by exercising your rights as explained in Article 8 hereof.

4.2 Cookies used on the Vectaury website

Apart from the data provided in the contact form, VECTAURY may collect data via cookies placed on the www.vectaury.io website. A cookie is a tracer deposited or read on the user's terminal (e.g. a computer or smartphone), for example when consulting a website, reading an e-mail or installing or using a software or mobile application.

If you accept the placing or reading of cookies on our website, we may collect certain personal data via so-called "first party cookies", i.e. cookies placed and read by our website.

Some third party cookies may also be deposited and read by servers of a domain name distinct from our website and collect data. The data collected via first party cookies are intended for internal use only. The cookies for which your consent is requested are those listed in the table below:

COOKIES TO IMPROVE THE INTERACTIVITY OF THE SITE

Cookie name why we use the cookie link to privacy policy cookie lifetime
Cookie first party
Google Analytics
_ga
_git
Cookie dedicated to the analysis of the navigation, the audience and the uses of the website by the users https://privacy.google.com/businesses/adsservices/ 12 months from the deposit of the cookie
Cookie Third party
Youtube it is a cookie deposited by Youtube's servers that makes it possible to play the videos published on our website https://policies.google.com/privacy?hl=fr&gl=fr see in their privacy policy

Other cookies are deposited and read on our website to allow its proper functioning, these are the following cookies:

REQUIRED COOOKIES FOR THE OPERATION OF THE SITE

Cookie name why we use the cookie link to privacy policy cookie lifetime
Cookie first party
Cookie Bar Cookie to save your cookie consent choices https://cookie-bar.eu/privacy/ 12 months from the deposit of the cookie
Cookie third party
CloudFlare it is a cookie deposited by the Cloud Flare servers allowing the proper functioning of our website: it ensures the functioning of the sliders, for example https://www.cloudflare.com/fr-fr/cookie-policy/ See in their privacy policy

The categories of data collected by the cookies deposited or read on the VECTAURY website are connection data such as identifiers, logs, data relating to pages viewed, country of the device, language of the device, ...

5- Processing of personal data collected on the Vectaury Solution platform

First party Cookies are also deposited on the Vectaury Solution platform through which we are likely to collect your data, these are the following cookies:

Cookie name why we use the cookie link to privacy policy cookie lifetime
Session Cookie User authentication cookie used for the operation of the tool. If it is not accepted, the user will not be able to connect and use our services. This cookie is installed once the user connects to his account. Cf. Vectaury's privacy policy The authentication system expires after 12 hours of inactivity.
Google Analytics Cookie tool installed on our platform dedicated to the analysis of navigation, audience and user usage. https://privacy.google.com/businesses/adsservices 12 months from the deposit of the cookie
Cookie Crisp Tool installed on our platform dedicated to customer relations and user support https://crisp.chat/fr/privacy/ 12 months from the deposit of the cookie
Axeptio Сookie used to save the platform users' choices regarding consent to cookies https://www.axeptio.eu/en/legal-mentions 6 months from the deposit of the cookie

The categories of data collected by the cookies deposited or read on the platform are in particular a session identifier for the Session Cookie and the Cookie Crisp and then connection data for the other cookies such as identifiers, logs, data relating to pages viewed, country of the device, language of the device, etc.

6- Recipients of the personal data collected

6.1. Personal data collected on mobile applications

(i) Internal Recipients
The personal Data collected through our SDK and through the system of purchasing advertising space in real time on mobile applications is accessible internally by certain authorised employees of our technical team, who are subject to an obligation of confidentiality. Only employees who need access to this data for their professional activity are entitled to access this data

(ii) External recipients

a- Data processor

For the needs of our activity, we use a data processor with whom we have verified that it offers sufficient guarantees regarding the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the Regulation on the protection of personal data (Law No. 78-17 of 6 January 1978, known as the Data Protection Act and the EU Regulation (EU) No. 679/2016 General Data Protection of 27 April 2016) and guarantees the protection of your rights. Access by our data processor to your personal data is based on contracts concluded with VECTAURY that mention the obligations of the data processor in terms of data protection, security and confidentiality of personal data. Our data processor whose identity is indicated below, is also prohibited from using your personal data for purposes other than those specified by us and from transmitting your data to any third party.

Hosting provider : OVH SAS, company of french law, domiciled at 2 rue Kellermann 59100 Roubaix, et inscrite au RCS de Lille Métropole au numéro B424 761 419.

b- Partners

Our advertiser and retailer clients for whom we display advertising campaigns within mobile applications require that the performance of our advertising campaigns be monitored by companies commonly referred to as "trusted third parties". These companies to whom we may share your personal data verify the good impression of the campaigns as well as the effectiveness of the campaigns on the traffic generated in their points of sale. To this end, we have concluded contracts with these companies in order to supervise the processing they carry out using the personal data we make available to them to study the effectiveness of our advertising campaigns.
Each of the companies mentioned below acts as data controller and is contractually bound to VECTAURY. As such, they are subject to regulations relating to the protection of personal data and, more specifically, to the obligations specific to those of the data controllers. These companies are prohibited from processing your data for purposes other than those mentioned above and are subject to strict obligations in terms of the confidentiality and security of your personal data. They are also prohibited from transmitting this data to third parties.

We may share your personal data with commercial partners such as HAPPYDEMICS, a simplified joint stock company, registered with the Paris Trade and Companies Register under number 810 129 478 and having its registered office at 73 rue de la Plaine, 75020, Paris. This company acts at the request of our clients and displays questionnaires to users who have been exposed to advertising displayed by VECTAURY in order to carry out marketing studies and evaluate the performance of our advertising campaigns

6.2. Data collected on the VECTAURY website www.vectaury.io

The personal data collected on the VECTAURY website is accessible to our internal teams and more particularly to employees who need to know this data in order to carry out their professional activity and who are subject to an obligation of confidentiality. This data is used to better understand how visitors to the VECTAURY website use it and to respond and communicate with the people who have used the contact form.

As indicated in article 4 of this privacy policy, the website www.vectaury.io uses the Google analytics cookie from Google to analyse your use of our website, the CloudFlare cookie to enable it to function properly and the Youtube cookie to enable the videos published on the website to be played.

As such, the data generated by these cookies placed on your terminal (computer, smartphone, tablet, etc.), are collected by the following companies so that they can provide us with the service for which the cookie is set (see Article 4):

6.3. Data collected on the Vectaury Solution platform solution.vectaury.io

The personal data collected on the VECTAURY SOLUTION platform is accessible to our internal teams and more particularly to employees who need to know it in order to carry out their professional activity and who are subject to an obligation of confidentiality. This data is only used to improve our VECTAURY SOLUTION platform and to study our Clients' browsing on it.

Like the website, the VECTAURY SOLUTION platform uses the Google analytics cookie (see article 5 of this privacy policy) as well as the Crisp cookie. The data generated by these cookies placed on your terminal (computer, smartphone, tablet, etc.) are collected by the following companies so that they can provide us with the service for which the cookie is set (see Article 5):

  • Crisp : Crisp IM SARL is a company registered at 2 Boulevard de Launay, 44100 Nantes, France (registration number : 833085806)
    Link to privacy policy:
    https://crisp.chat/fr/privacy/
  • Google: Google Ireland Limited, a company incorporated under the laws of Ireland and registered in Ireland (under number 368047) Gordon House, Barrow Street , Dublin 4, Ireland
    Link to the privacy policy for Google analytics:
    https://privacy.google.com/businesses/adsservices

7- Transfer of data outside the European Union

The processor mentioned in Article 6 (ii) b- is located in Belarus, so there is a transfer of your personal data outside the European Union. As such and to ensure an optimal level of protection of your personal data and in accordance with the Regulation, our processor is subject to the obligations set out in the standard contractual clauses validated by the European Commission and establishing a level of data protection similar to that of the GDPR

The Subcontractor in question is the company CEDON BLR located at 25-203 Yanki Kupaly Street, 220030 Minsk BIELORUSSIA, represented by Mr Ongan Mordeniz.

No other transfer of personal data is carried out by VECTAURY outside the European Union, as the data is hosted in France.

8- Your rights as a person concerned by the processing of personal data

8.1. Your rights relating to the processing of your personal data

In accordance with the GDPR, you have rights to your personal data:

  • right to information,
  • right to access your personal data;
  • right to withdraw your consent / to object to the processing of your personal data;
  • right to request the deletion of your personal data;
  • right to request the correction of your personal data in the event that they are out of date or incorrect;
  • right to limit the processing of personal data;
  • right to the portability of personal data;
  • right to define post-mortem guidelines on your personal data;
  • right to appeal to the CNIL

You may exercise these various rights by going to VECTAURY's privacy centre accessible via the clickable (i) information present on the advertisements displayed to you by VECTAURY in mobile applications or directly on VECTAURY's website via the following link: https://creative.v3ty.com/vectaury/201704/campaign1/www/page/index2.html

You may also exercise these rights by writing a letter to VECTAURY's postal address or by sending an e-mail to the following address: legal@vectaury.io.

You may withdraw your consent to the processing of your personal data for the purposes of profiling and displaying targeted advertisements adapted to your location at any time. You may simply withdraw your consent to the processing of your data for location-based advertising purposes by VECTAURY via the Consent Management Platform ("CMP"), which is accessible in the application settings. Furthermore, the CMP is accessible at any time in the application settings, so you can change your consent choices at any time.

The user is validly informed of the purpose of the processing, the identity of the data controller, the data collected and the possibility of withdrawing consent by means of the CMP used by our partner publishers and publishers monetizing the advertising spaces available in their applications via the real-time auction system. VECTAURY ensures that users are validly informed so that they can give specific free and informed consent to the processing of their personal data by auditing the CMP as explained in article 3.3.

Users may also access, via the CMP used in the application concerned, VECTAURY's privacy policy in order to obtain further information on the processing activities carried out. They may also access via the list of partners to whom the data are sent, the purposes of the processing and their privacy policy

8.2. Resetting your Advertising identifier and enabling limited ad tracking

Android and Apple allow Users to control their privacy in the settings, making it impossible to link their ad history to their future browsing.

The personal data collected by VECTAURY is linked to the advertising identifier. Each mobile phone has its own advertising identifier which enables advertisers to display targeted advertising. It can be reset at any time by the user:

  • On iOS: go to "Settings", then to "Privacy", then to "Advertising" and then to "Reset the advertising ID";
  • On Android: go to "Google Settings" (or "Settings" then "Google"), then to "Ads"

The User will probably receive the same amount of ads but they will be less relevant

In addition, the User can activate the function "limited ad tracking" or "disable ad tracking" :

  • on iOS, the User must follow the instructions here :
  • on Android, the user must follow the instructions here.

8.3. Disabling cookies

If you do not want cookies to be placed on your terminal while you are browsing our website or platform, you can follow the instructions below to disable cookies:

9- Personal Data Security

VECTAURY implements appropriate technical and organisational security measures to ensure the security and confidentiality of the personal data processed. The same level of security is imposed on our processors.
The security measures implemented are set out in VECTAURY's Information Systems Security Policy and the technical and administrative teams ensure that these measures are scrupulously respected.

10- Modification of this Privacy Policy

We may need to modify the content of this Privacy Policy to update our practices and the applicable Regulations. In this regard, we advise you to consult it regularly; you can easily determine the last date on which this policy was updated at the top of the document.

We inform you that in the event of any contradiction between the French and English versions of the Privacy Policy, the French version shall prevail.