Index Exchange, Inc. (“Index Exchange”) believes in all Internet users’ rights to privacy. This Policy explains the information collection, use, and disclosure practices of Index Exchange. It applies to all information received by Index Exchange whether in electronic, paper or verbal format.
The Index Exchange Business
The Index Exchange Online Advertising Exchange (“Index Platform”) prides itself on providing an atmosphere that is non-disruptive to Internet users. Our proprietary targeting methodologies enable advertisers to effectively target their campaigns to the audience(s) they are looking to reach without engaging in profiling practices. Services offered by Index Exchange include a Web-based advertising exchange marketplace that enables publishers, advertisers, and ad networks to efficiently market, buy and sell digital and mobile advertising and ad inventory.
Index Exchange prides itself on conducting business in a transparent and open manner. In line with those values, we support efforts for self-regulation in the internet-based advertising industry.
Index Exchange is a member in good standing of the Network Advertising Initiative (NAI), a cooperative of online marketing and analytics companies committed to responsible data collection for digital advertising, building consumer awareness, and establishing responsible business and data management practices and standards. Index Exchange adheres to the NAI Code of Conduct in all its operations.
Index Exchange adheres to the standards and practices outlined by The Digital Advertising Alliance of Canada, a consortium of the leading national advertising and marketing trade associations, promoting a self-regulatory program for online interest-based advertising. More information on the program can be found here.
Information Collection, Use, and Sharing
In general, like most standard website servers, Index Exchange uses log files to track transactions. These log files include internet protocol (IP) addresses, browser types used, the internet service provider (ISP) utilised, referring/exit pages, platform type, date/time stamps, and number of clicks. This information is then used to analyze trends, administer the site, aggregately track user movement, and target advertisements to users accordingly. Index Exchange does not collect a website user’s Personally Identifiable Information (PII) as defined under United States federal law. However, in the course of and for purposes of conducting its business, Index Exchange may collect and process the following consumer information that is considered Personal Information (PI) under the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) or Personal Data under the European Union’s General Data Protection Regulation (GDPR):
(1) browser and device information received from publishers is shared with advertisers and agencies for responding to requests for advertisements, forecast advertising inventory and troubleshooting any operation issues related to the Index Platform;
(2) IP addresses, including both IPv4 and IPv6 are used to bid on advertising inventory;
(3) geo-location data is used to bid on advertising inventory;
(4) Precise Location Data (data obtained from a device about the physical location of the device) is used to bid on advertising inventory;
(5) GPS coordinates, where available;
(6) unique Index Exchange UserIDs, stored in browser cookies, are used for profiles on the ad server;
(7) mobile device identifiers are used to track mobile traffic and are shared with advertisers and agencies to tailor the advertising experience;
(8) Pixel Data (data obtained through or in connection with the placement of any pixel mechanism) is used as part of the user matching process;
(9) people identifiers provided by Index Exchange’s partners are associated to audience segments, and shared with advertisers and agencies;
(10) data on whether a user viewed or clicked on an Ad is shared with advertisers and agencies.
Index Exchange’s internal processes treat personal data in accordance with regulatory requirements and applicable privacy laws to ensure that information is stored securely and used only for allowed and intended purposes.
Index Exchange may combine information that does not directly identify an individual with data collected from other sources to provide publishers, advertisers and ad networks with information to improve the relevance of advertising presented to users and determine whether to bid on ad inventory. Any information shared with advertisers and publishers within the Index Exchange Online Advertising Exchange is done so in an aggregate fashion. This means that clients only receive information about users targeted by advertisements in a format with broad percentages.
In addition, although Index Exchange does not directly engage in Cross-App Advertising, our technology may collect and/or pass through Mobile Device IDs (the unique identifier assigned to a device by the manufacturer) or Advertising IDs (for iOS 6 and later), instead of cookies, to recognize you.
Do Not Track Signal
Index Exchange does not honor the ‘DNT’ browser signal. Instead, we utilize the cookie based opt-out mechanisms to allow users to opt-out of all advertising. For more information, please see the “Your Choices” section below.
Cross-Device Linking is the process of making assumptions that certain devices are related to each other, i.e. they belong to the same user/household. Index Exchange may engage in Cross Device Linking for personalized advertising, ad delivery, and reporting. If you would like to opt-out of having Cross-Device Linking used by Index Exchange on your devices, please see the “Your Choices” section below.
A cookie is a small amount of data, which often includes a unique identifier that is sent to your browser from a website’s computer and stored on your computer’s hard drive. Index Exchange uses both session and persistent cookies on our website. These are needed for site navigation and to perform aggregate analysis of what is viewed on our site. Cookies are considered Personal Data under the General Data Protection Regulation.
- To inform the Index Platform if an advertisement has been served to the same computer before, and if so, when the advertisement was served. These cookies are not used by Index Exchange to build a profile of a user’s behavior nor are they used by Index Exchange for the purposes of behavioral tracking or behavioral targeting.
- To facilitate retargeting at a campaign level. Retargeting is the process of serving an ad from a particular advertiser to a user, based on the fact that the user has previously visited the advertiser’s website. Retargeting occurs within the confines of a user-to-advertiser relationship, and is not available for general targeting on Index Exchange. Retargeting is not available for Sensitive Data as defined by the General Data Protection Regulation.
Personally Identifiable Information and Personal Data of Index Exchange Members
Registering to become a member of the Index Platform, either as an advertiser or a publisher, requires the submission of PI, PII or Personal Data to Index Exchange. This can include the full name, mailing and/or billing address, email address, company name, and website URL. Index Exchange uses this information to service its accounts and respond to inbound inquiries related to sales or technical support requests. Communications to business users are related to the Advertising Exchange. All such information submitted is held by Index Exchange in strict confidence and as prescribed by corresponding regulatory authorities.
Index Exchange does not engage in any form of distribution or sale of PII, PI or Personal Data to third parties for their own promotional use. Index Exchange does not sell, supply, or otherwise make user PII, PI or Personal Data available to any third party under any circumstances, unless ordered to do so by a court of competent jurisdiction.
Information Obtained from Third Parties
Web Browser Option to Opt-Out
Some of the ads you see on the internet or in applications on your mobile device are tailored to your interests and based on your activity online or in the applications on your mobile device. This type of ad tailoring — sometimes called “interest-based” or “online behavioral” advertising — is enabled through various technologies, including browser cookies, mobile advertising identifiers as well as other non-cookie technologies. Tailored digital ads help support the free products, services and content you enjoy online. To help protect your privacy, Index Exchange (along with other NAI members) has voluntarily agreed to abide by high NAI standards including offering an opt-out mechanism.
Opting out of interest-based advertising means that you will no longer be shown ads that have been tailored to your interests. It does not mean you will no longer see advertising online. When you opt-out, an opt-out cookie will be stored in your web browser signaling your opt-out preference to NAI members including Index Exchange.
Please note that if your browser is configured to block third-party cookies, then the opt out cookie may not work. If you delete your browser cookies, you will need to opt out again. The opt-out will not apply to the specific browser in which you set it. The opt-out process must be repeated for each different browser.
Access to information
Applicable privacy laws may allow you the right to access and/or request the correction of errors or omissions in your personal data. You may also have the right to have personal data deleted. To make a request, or if you need assistance with this process, please contact us. If you have a complaint regarding a response to your request to access information, please contact our Data Protection Officer:
Lucid Privacy Group
Attn: Index Exchange Data Protection Officer
Lucid Privacy Group
1556 Shrader Street
San Francisco, CA 94117
Index Exchange follows strict Information Security policies to protect personal data submitted to us, both during transmission and once we receive it. Although we take steps to secure your information, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
In the unlikely event of a confirmed security breach, Index Exchange will investigate and contact impacted persons within 72 hours of the breach.
We reserve the right to disclose your personal data as required by law, in response to a subpoena or similar investigative demand, a court order, or a request for cooperation from a law enforcement or other government agency; when we believe that disclosure is necessary to protect or exercise our legal rights; or to defend against legal claims.
EU and Swiss Residents
Index Exchange transfers data from the European Union and Switzerland to the United States in accordance with the EU-US and Swiss-US Privacy Shield Frameworks. More information on the Privacy Shield program set forth by the U.S. Department of Commerce can be found at https://www.privacyshield.gov/eu-us-framework.
Index Exchange is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission for any violations of the EU-US or Swiss-US Privacy Shield Framework. Index Exchange may be held responsible if third party controllers to whom it transfers personal information or third party agents it engages to process this data on its behalf, act in a manner inconsistent with the Privacy Shield Principles. Index Exchange is required to disclose personal information in response to lawful requests to meet national security or law enforcement requirements.
Individuals residing in the European Union or Switzerland have the right to access any of their Personal Data retained by us. You also have the right to have the data corrected, amended or deleted where it is inaccurate or processed in violation of the Principles. Please refer to the “Access to Information” section above.
If you have any questions or complaints regarding Index Exchange’s compliance with the EU-US or Swiss-US Privacy Shield framework, please contact us. If we are unable to resolve your complaint, you may submit the matter to the ICDR-AAA, an independent dispute resolution body designated to addressing such complaints and providing appropriate recourse free of charge to you. You may also invoke, under specific conditions laid out by the EU-US and Swiss-US Privacy Shield, the right to binding arbitration to resolve your complaint.
To inquire about privacy concerns, please contact Index Exchange by mail, as detailed below, or using our online form.
74 Wingold Avenue
Toronto, Ontario M6B1P5 Canada
Designated Privacy Officer
Last Updated: March 15, 2018