Last Updated: January 13, 2020
Index Exchange, Inc. (“Index Exchange”) believes in all Internet users’ rights to privacy. This Policy explains the information collection, use, and disclosure practices of Index Exchange. It applies to all information received by Index Exchange whether in electronic or paper format.
THE INDEX EXCHANGE BUSINESS
The Index Exchange Online Advertising Exchange (“Index Platform”) prides itself on providing an atmosphere that is non-disruptive to Internet users. Our proprietary ad personalization methodologies enable advertisers to effectively direct their campaigns to the audience(s) they are looking to reach. Services offered by Index Exchange include a Web-based advertising exchange marketplace that enables publishers, advertisers, and ad networks to efficiently market, buy and sell digital and mobile advertising and ad inventory.
Index Exchange prides itself on conducting business in a transparent and open manner. In line with those values, we support efforts for self-regulation in the digital advertising industry.
Index Exchange is a member in good standing of the Network Advertising Initiative (NAI), a cooperative of online marketing and analytics companies committed to responsible data collection for digital advertising, building consumer awareness, and establishing responsible business and data management practices and standards. Index Exchange adheres to the NAI Code of Conduct in all its operations.
Index Exchange also adheres to the standards and practices outlined by The Digital Advertising Alliance, a consortium of the leading national advertising and marketing trade associations, promoting a self-regulatory program for online interest-based advertising. More information on the program can be found here.
INFORMATION COLLECTION, USE, AND SHARING
Index Exchange does not collect a website user’s Personally Identifiable Information (PII) as defined under United States federal law. However, in the course of and for purposes of conducting its business, Index Exchange may collect and/or receive and process the following consumer information that may be considered Personal Information (PI) under the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) or the California Consumer Privacy Act (CCPA) or Personal Data under the European Union’s General Data Protection Regulation (GDPR):
(1) browser and device information received from publishers is shared with advertisers and agencies for responding to requests for advertisements, forecasting advertising inventory and troubleshooting any operation issues related to the Index Platform;
(2) IP addresses, including both IPv4 and IPv6 received from publishers are shared with downstream parties to be used for responding to requests for advertisements;
(3) geo-location data received from publishers may be shared with downstream parties to be used for responding to requests for advertisements;
(4) Precise Location Data (data obtained from a device about the physical location of the device) received from publishers may be shared with downstream parties to be used for responding to requests for advertisements;
(5) GPS coordinates, where available;
(6) unique Index Exchange UserIDs, stored in browser cookies, are used for profiles on the ad server;
(7) mobile device identifiers received from publishers are used to understand mobile traffic and are shared with advertisers and agencies to personalize the advertising experience;
(8) Pixel Data (data obtained through or in connection with the placement of any pixel mechanism) is used as part of the user matching process;
(9) people identifiers provided by Index Exchange’s partners are associated to audience segment identifiers , and shared with advertisers and agencies;
(10) data on whether a user viewed or clicked on an Ad is shared with advertisers and agencies.
Index Exchange’s internal processes treat personal information in accordance with regulatory requirements and applicable privacy laws to ensure that data is stored securely and used only for allowed and intended purposes.
Index Exchange may combine information that does not directly identify an individual with data collected from other sources to provide publishers, advertisers and ad networks with information to improve the relevance of advertising presented to users and determine whether to bid on ad inventory. In addition, although Index Exchange does not directly engage in Cross-App Advertising, our technology may collect and/or pass through Mobile Device IDs (the unique identifier assigned to a device by the manufacturer) or Advertising IDs (for iOS 6 and later), instead of cookies, to recognize you.
Do Not Track Signal
Index Exchange does not honor the ‘DNT’ browser signal. Instead, we utilize the cookie based opt-out mechanisms to allow users to opt-out of all advertising. For more information, please see the “Your Choices” section below.
Cross-Device Linking is the process of making assumptions that certain devices are related to each other, i.e. they belong to the same user/household. Index Exchange may engage in Cross Device Linking for ad delivery and reporting. If you would like to opt-out of having Cross-Device Linking used by Index Exchange on your devices, please see the “Your Choices” section below.
Cookies (HTTP Cookies and HTML5 Cookies or Local Storage)
An HTTP cookie is an object that stores a small amount of data on behalf of a browser on a given device. By saving information in a cookie, websites can remember preferences or recognize browsers from one visit to another or from one website to another. Index Exchange uses both session-only and persistent cookies. More specifically, Index Exchange uses certain cookies that last only for the duration of a user’s internet session and expire when that user closes his or her browser, as well as certain other cookies that are used to remember a user when he or she returns to a website and will last for longer.
HTML5 cookies, also known as HTML5 Web Storage, or local storage, is a technology that allows a website or application to store information locally on a user’s computer or mobile device. Index Exchange uses HTML5 cookies, or local storage, in connection with its platform and website to support publisher monetization objectives and speed up page load time.
Index Exchange collects and stores IDs from a variety of domains, including adsrvr.org and casalemedia.com. These IDs are stored in either Index Exchange’s domain (casalemedia.com) or the publisher’s first party domain.
PII, PI, and Personal Data of Index Exchange Clients/Partners
Registering to become a member of the Index Platform and use of the Index Exchange User Interface, either as an advertiser or a publisher, requires the submission of PI, PII or Personal Data to Index Exchange. This can include the full name, mailing and/or billing address, email address, company name, and website URL. Index Exchange uses this information to service its accounts and respond to inbound inquiries related to sales or technical support requests. Communications to business users are related to the Advertising Exchange. The Index Exchange User Interface also uses Google Analytics technology to monitor traffic on the UI. All such information submitted is held by Index Exchange in strict confidence and as prescribed by corresponding regulatory authorities.
Index Exchange does not engage in any form of distribution or sale of PII, PI or Personal Data to third parties for their own promotional use. Index Exchange does not sell, supply, or otherwise make user PII, PI or Personal Data available to any third party under any circumstances, unless ordered to do so by a court of competent jurisdiction.
Information Obtained from Third Parties
YOUR PRIVACY CHOICES
Web Browser Option to Opt–Out
Some of the ads you see on the internet or in applications on your mobile device are tailored to your interests and based on your activity online or in the applications on your mobile device. This type of ad tailoring — sometimes called “interest-based” advertising — is enabled through various technologies, including browser cookies, mobile advertising identifiers as well as other non-cookie technologies. Tailored digital ads help support the free products, services and content you enjoy online. To help protect your privacy, Index Exchange (along with other NAI members) has voluntarily agreed to abide by high NAI standards including offering an opt-out mechanism.
Opting out of interest-based advertising means that you will no longer be shown ads that have been tailored to your interests. It does not mean you will no longer see advertising online. When you opt-out, an opt-out cookie will be stored in your web browser signaling your opt-out preference to NAI members including Index Exchange.
Please note that if your browser is configured to block third-party cookies, then the opt out cookie may not work. If you delete your browser cookies, you will need to opt out again. The opt-out will not apply to the specific browser in which you set it. The opt-out process must be repeated for each different browser.
INDEX EXCHANGE INC. OFFERS INDIVIDUALS THE OPPORTUNITY TO CHOOSE WHETHER AN INDIVIDUAL’S PERSONAL DATA (OR SOMETIMES OTHERWISE REFERRED TO AS PERSONAL INFORMATION OR PERSONALLY IDENTIFIABLE INFORMATION) IS TO BE DISCLOSED TO A THIRD PARTY OR TO BE USED FOR A PURPOSE THAT IS MATERIALLY DIFFERENT FROM THE PURPOSE(S) FOR WHICH IT WAS ORIGINALLY COLLECTED OR FOR A PURPOSE THAT IS MATERIALLY DIFFERENT THAN ANY PURPOSE(S) SUBSEQUENTLY AUTHORIZED BY SUCH INDIVIDUAL.
IN THE EVENT THAT YOU WOULD LIKE TO EXERCISE YOUR CHOICE (I.E. OPT-OUT) TO SPECIFY THAT INDEX EXCHANGE INC. MAY NOT DISCLOSE YOUR COOKIE DATA TO A THIRD PARTY, PLEASE VISIT THE NAI’S OPT-OUT PAGE BY FOLLOWING THE LINK BELOW.
IF INDEX EXCHANGE INC. USES YOUR PERSONAL DATA (AS SOMETIMES OTHERWISE REFERRED TO AS PERSONAL INFORMATION OR PERSONALLY IDENTIFIABLE INFORMATION) FOR A PURPOSE THAT IS MATERIALLY DIFFERENT FROM THE PURPOSE(S) FOR WHICH IT WAS ORIGINALLY COLLECTED OR SUBSEQUENTLY AUTHORIZED, INDEX EXCHANGE INC. WILL OFFER YOU THE OPPORTUNITY TO OPT OUT OF SUCH USES AND/OR DISCLOSURES.
Index Exchange follows strict Information Security policies to protect personal data submitted to us, both during transmission and once we receive it. Although we take steps to secure your information, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
In the unlikely event of a confirmed security breach, Index Exchange will investigate and contact impacted persons within 72 hours of the breach.
We reserve the right to disclose your personal data as required by law, in response to a subpoena or similar investigative demand, a court order, or a request for cooperation from a law enforcement or other government agency; when we believe that disclosure is necessary to protect or exercise our legal rights; or to defend against legal claims.
Effective January 1, 2020, the California Consumer Privacy Act (CCPA) provides additional privacy protections for California residents. These protections include your right to: (1) access the personal information collected about you; (2) delete the personal information collected about you; and (3) opt-out of the sale of your personal information (the transfer of your personal information to third parties).
If you are a California consumer and would like to exercise any of these rights, you may do so either by using the mechanisms outlined in the “Your Privacy Choices” section above or through our User Access Rights portal. Please note, we do not discriminate against you for exercising any of your CCPA rights. We will fulfill all requests we are able to verify so long as we are not prohibited from doing so by applicable law.
EUROPEAN UNION, UNITED KINGDOM, AND SWISS CONSUMERS
Index Exchange is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission for any violations of the EU-US or Swiss-US Privacy Shield Framework. Index Exchange may be held responsible if third party controllers to whom it transfers personal information or third party agents it engages to process this data on its behalf, act in a manner inconsistent with the Privacy Shield Principles.
Index Exchange is required to disclose personal information in response to lawful requests to meet national security or law enforcement requirements.
Access to and Deletion of Personal Data
Individuals residing in the European Union or Switzerland have the right to access any of their Personal Data retained by us. You also have the right to have the data corrected, amended or deleted where it is inaccurate or processed in violation of the Principles.
You can make a request to access or delete your Personal Data via Index Exchange’s User Access Request portal.
Data Protection Officer
If you have a complaint regarding the response to your request to access or delete information, please contact our Data Protection Officer:
Attn: Index Exchange Data Protection Officer
Legal Army, S.L.
María de Molina, 60 4th
28006 Madrid (Spain)
If you have any questions or complaints regarding Index Exchange’s compliance with the EU-US or Swiss-US Privacy Shield framework, please contact us. If we are unable to resolve your complaint, you may submit the matter to the ICDR-AAA, an independent dispute resolution body designated to addressing such complaints and providing appropriate recourse free of charge to you. You may also invoke, under specific conditions laid out by the EU-US and Swiss-US Privacy Shield, the right to binding arbitration to resolve your complaint.
Attn: Privacy Team
74 Wingold Avenue
Toronto, Ontario M6B1P5 Canada
Residents of the European Union can make a request to access or delete their Personal Data via Index Exchange’s User Access Request portal.