Collective UK Privacy Policy

The Introduction
Welcome to the Collective’s Privacy Policy. Please read this Privacy Policy carefully, it will only take you approximately 10 minutes to read.
Collective Europe Limited (Collective or we) provide media and creative services (the Services) to advertisers and household brands (our Customers). Whilst we provide a number of services, one of our key offerings to Customers is the placement of digital adverts on advertising space made available by website owners and publishers (the Publishers). Our aim is to help our Customer to provide you with digital adverts that we think you want to see and this allows our Customers to promote their products and services. In this Privacy Notice we will use the following phrases:

 
● Ads meaning digital advertisements;
● Digital Advertising or Ad Placement are phrases used to describe of our key Services; and
● Ad tech to describe the wider digital advertising industry and a shortened version of “advertising technology”.

 
Collective Europe Limited is a company established in England with its registered address at 3rd Floor, 161 Marsh Wall, London E14 9AP (company number 07423750). We are registered with the ICO as a data controller.

 
This statement was last updated on 11 November 2019. Please check back regularly as we may need to make periodic changes to this statement to reflect updated guidance and requirements when they become available.

 

Purpose of this privacy policy

The purpose of this privacy policy is to provide you with important information about how your personal data is collected and processed, and to help you to understand the part Collective plays in the wider ad tech industry. We recognise that you want to have confidence in how your data is being used and processed.

 
There are a number of organisations that play a part in the Ad tech industry, from the advertisers and the brands (our Customers) on one side (we call this the Demand Side to reflect the “demand” for advertising space), to the Publishers on the other (the Supply Side to reflect the Publishers’ role in “supplying” advertising space).

 
In the course of providing our services to our Customers we do not always determine or influence how your personal data is processed, and in the majority of cases we only process your data on the instructions of our Customers or other parties in the ad tech process. For the purposes of data protection law, when we are only processing your data on the instructions of our Customers we act only as “data processors”. However, where we do influence or determine the data processing we act as “data controllers”. We have set out below the small number of activities where we believe we act as a data controller.

 
It is important to understand that even though we may determine or influence a small number of processing activities, we very rarely store or retain any personal data, for example we do not maintain a dataset or have any information which would allow us to identify you in the real world.

 

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our data
privacy manager using the email address atailor@collectiveuk.com.

 
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

 

How does Online Advertising Work?

You may not have given any thought to how digital adverts appear on the websites and Publisher sites you visit, but behind the scenes is a sophisticated system that delivers digital advertising in milliseconds. A number of the Ads you see have been specifically selected for you, based on your interests and browsing activities, but you may also be presented with ads that have no personalised content but simply reflect, for example, current product or market trends.

 
In order to provide you with specifically selected Ads the parties involved in the Ad tech/Ad Serving process require information to be collected and processed. This commonly includes information about the devices you use (such as laptops and mobile phones), your location and information obtained from your browsing activities. This information is used within the Ad tech industry to try and determine and understand your interests.

 
This information is collected using cookies and other similar technologies such as tag pixels and device identifiers which are deployed on, or collected from, your device when you land on a website or through a mobile app. None of the data that we process either for our own purposes, or on behalf of our Customers, includes any information which directly identifies you in the real world, such as your name, email address, address or phone number. Neither do we collect any special categories of personal data about you (this includes details about your race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions and affiliations or any health, genetic or biometric data) or any information about criminal convictions and offences.

 
We may also collect, use and share aggregated data such as statistical or demographic data for a number of purposes including for example calculating how many times an Ad has been viewed. Aggregated data does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

 

Where Collective acts as a Data Controller

As set out above we have identified a very small number of activities where our view is that Collective acts as a Data Controller. In practice we do not have any access to, or store your personal data on our systems, we are however influencing the way your personal data is processed by other organisations within the ad tech/ad serving process.

 

 Activity

Type
of Data

Lawful
basis for processing including basis of legitimate interest

Where we make a decision on what Publishers to use for a particular
advertising campaign (i.e. where we decide which websites should
feature our customer’s Ads).

None.

Necessary
for our legitimate interests

(to deliver
the best and most effective Ad performance).

Where we build the creative advert for our Customers and include
personalised content.

(a) Device Location

(b) Browsing
History Data

Necessary
for our legitimate interests

(to deliver
the best and most effective Ad performance) and where you have
given your consent to the Publisher.

Where we use aggregated historical data to make a decision on what Publishers
to use for a particular advertising campaign.

(a)
Aggregated historical Campaign Data

Necessary
for our legitimate interests

(to deliver
the best and most effective Ad performance).

Where we licence data from other third parties to improve our Ad
performance.

(a) Device Location

(b) Browsing History Data

(c) Device
Data

Necessary
for our legitimate interests

(to deliver
the best and most effective Ad performance).

Where deploy
technologies that allow us to measure the success of an
advertising campaign (including independent research) and to
ensure we do not place ads on unsuitable websites.

None

Necessary
for our legitimate interests

(to measure
ad performance and ensure we work within brand safety measurements
and guidelines).

 
Where we rely on legitimate interest this means we act in the interest of our business or the legitimate interests of our Customers. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we influence and determine the manner in which we process your personal data for our legitimate interests.

 

How is your personal data collected?

 
Collective does not directly collect personal data from you but we may make decisions (as set out above) using the information collected about you by other parties in the ad tech industry. We do not control the deployment or use of these cookies or similar technologies. In the final section of this policy we have provided additional information about our partners that will allow you to read their privacy statements.

 
However, if you contact us by post, phone, email or otherwise, we will retain your contact details on our systems to allow us to deal with your enquiry, but for no other purpose.

 
We do not use your data for any direct marketing purposes.

 

Opting out

 
Collective only works with Publishers that engage with the IAB TCF Framework (the TCF). The TCF is a cross-industry framework to help publishers, technology vendors, advertising agencies and advertisers meet the transparency and user choice requirements under the General Data Protection Regulation. It has been developed by IAB Europe in collaboration with organisations and professionals in the digital advertising industry. More information is available on the IAB website: https://www.iabeurope.eu/

 
Every time you visit a Publisher website you have the opportunity to change cookie settings to prevent data being collected about you. It will not stop Ads being shown but will stop the underlying data being collected and used to target you with personalised or targeted advertising.

 
Collective are also registered as a vendor with The IAB Europe Transparency and Consent Framework.

 

International transfers

 
We do not transfer your personal data outside the European Economic Area (

 

Data security

 
To the extent that we have access to or store your personal data (as set out above, these circumstances are extremely limited) we have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.

 
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are required to do so under applicable laws.

 

Data retention

 
To the extent that we retain any personal data about you we will only hold it for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

 
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

 

Your Data Protection Rights

 
Where Collective act as a data controller you have the following data protection rights. However, as set out above, in practice we are unlikely to hold or store any of your personal data and we do not process data that allows us to identify you as an individual (e.g. your name, email address). If you have any questions please contact us by email on; hello@collectiveuk.com

 

Right
of Access

Commonly known as a “data subject access request” this enables you to
receive a copy of the personal data we hold about you and to check
that we are lawfully processing it.

Right
of Correction

This enables
you to have any incomplete or inaccurate data we hold about you
corrected.

Right
of Erasure

This enables
you to ask us to delete or remove personal data where there is no
good reason for us continuing to process it or where you have
successfully exercised your right to object to processing.

Right
to object to processing

Where we are
relying on a legitimate interest (or those of a third party) and
there is something about your particular situation which makes you
want to object to processing on this ground as you feel it impacts
on your fundamental rights and freedoms.

Right
to request restriction of processing

This enables
you to ask us to suspend the processing of your personal data in a
number of specific scenarios including; where you want to
establish the data’s accuracy and  where you wish us to
hold it our use of the data is unlawful but you do not want us to
erase it, where you need us to hold the data even if we no longer
require it as you need it to establish, exercise or defend legal
claims and where you have objected to our use of your data but we
need to verify whether we have overriding legitimate grounds to
use it.

Right
to Transfer

We will
provide to you, or a third party you have chosen, your personal
data in a structured, commonly used, machine-readable format. Note
that this right only applies to automated information which you
initially provided consent for us to use or where we used the
information to perform a contract with you.

 

Who do we Share your Data With?

 
We may share your personal data with other companies within the wider TI Media Group and who are based in the UK and own and manage over 40 media brands. In rare circumstances we may be required to share your data with our professional advisors and with regulators and other authorities.

 
As part of the provision of our services and due to the nature and complexity of the Ad tech and Ad tech Serving process, we may share information (which may or may not directly identify you) with our Customers, ad servers, ad networks and content recommendation services to select and deliver advertising and content, and target and personalise advertising and content as instructed by our Customers. All of these third parties form part of the wider ad tech industry and will have their own legal responsibilities as data controller and data processor.

 
We could merge with or be acquired by another business. If this happens we share the information that relates to you. You will be sent notice of such an event where possible and where required by applicable laws.

 
In the unlikely event that it is necessary, we reserve the right to disclose your personal data in order to comply with the law, applicable regulations and government requests. We also reserve the right to use such information in order to protect our operating systems and integrity as well as other users.

 

Partner Name

Purpose

Link to
Privacy Notice

Xandr /
Appnexus

Used to
place advertising on websites

https://www.appnexus.com/platform-privacy-policy

Google –
DV360

Used to
place advertising on websites

https://policies.google.com/privacy

Improve
Digital

Used to
place advertising on websites

https://www.improvedigital.com/platform-privacy-policy/

Sizmek

Used to
create online ads

https://www.sizmek.com/privacy-policy/

Celtra

Used to
create online ads

https://www.appnexus.com/platform-privacy-policy

Flashtalking

Used to
create online ads

https://www.flashtalking.com/privacypolicy

Google –
Doubleclick Studio

Used to
create online ads

https://policies.google.com/privacy

Moat

Used for
analysis and ad validation

https://www.oracle.com/uk/legal/privacy/services-privacy-policy.html

IAS

Used for
analysis and ad validation

https://integralads.com/uk/privacy-policy/

Differentology

Used to
measure advertising effectiveness

https://www.differentology.co.uk/privacy-policy/

Nielsen

Used to
measure advertising effectiveness

https://www.nielsen.com/eu/en/legal/privacy-statement/

Millward
Brown

Used to
measure advertising effectiveness

http://www.millwardbrown.com/footer/privacy-terms

ResearchNow
/ Dynata

Used to
measure advertising effectiveness

https://www.dynata.com/privacy-policy/

OnDevice

Used to
measure advertising effectiveness

https://ondeviceresearch.com/GDPR

IRI

Used to
measure advertising effectiveness

https://www.iriworldwide.com/en-PR/Company/Global-Privacy-Statement/Privacy-Policy