Dentsu Spartan Privacy Notice

 

Dentsu UK Limited (“our”, “us”, “we”), whose registered office is at 10 Triton Street, Regent’s Place, London, NW1 3BF, is part of the dentsu group (“dentsu”). We are a global digital and media advertising agency. Our core business is to help our clients improve how they advertise and market, whether by print, post, email or on websites. Information provided by people like you is therefore important to our business.

Spartan Technology

Dentsu’s advertising technology, Spartan, helps our clients (“Advertisers”, “Clients”) display digital or online ads for their goods and services. To do this, Advertisers will contract with us to use our Spartan technology to deliver their ads on their own website or, third-party websites. We refer to those third parties who own third party websites and who sell advertisement space to Advertisers as a “Publisher”.

We engage with Publishers using Supply Side Platforms (a software tool that allows Publishers to sell their advertising space to Advertisers in an automated and efficient manner) (“SSPs”). As part of delivering our services to Advertisers, personal data may be collected from you when you visit an Advertiser’s website using our Spartan technology or, via a Publisher’s SSP, when you visit a Publisher’s website.

About this Notice

The purpose of this privacy notice (“Notice”) is to inform individuals (“you”) about the types of personal information we collect from you and third parties, where that personal data comes from, how we use your personal data, how we share your personal data, the legal basis we rely on for processing your personal data, how we protect your personal data, how long we keep your personal data and what your rights are in relation to your personal data.

Dentsu is responsible, as controller, in respect of certain personal data described in this Notice, for example, the personal data we collect when you visit a Publisher’s website. Dentsu may also act as processor in respect of certain personal data described in this Notice, for example, when processing personal data on behalf of Advertisers using our Spartan technology.

This Notice does not cover:

  • our website activities (please see here for our Website Privacy Notice);
  • other data processing activities of our affiliates and/or other dentsu products;
  • the data processing of our clients.

1.    Types of personal data we may collect

When you visit a website, we collect certain information about your visit. For example, SSPs engaged by a Publisher of that website sends us a request to show you an ad. We collect certain information about ad inventory and you and your device to help inform our Advertiser’s decision to serve an ad. We also collect information through our Advertiser’s websites that use our Spartan technology.

·      User ID: we may collect your user ID, a unique identifier assigned to you.

·      Device ID: we may collect your device’s unique identifier, known as a device ID.

·      Advertisement ID: we may collect your device’s advertisement ID, which is a unique identifier assigned to your device for advertising purposes.

·      Internet Protocol (IP) Address: we may collect your IP address which is a numerical identifier assigned to your device by your internet service provider.

·      Non-Specific Location Data: we may collect non-specific geographic location data as derived from the collection of your IP address, for example, the city you are located in.

·      Privacy Choices: we will process users’ signals or part of it as defined by the policies or specifications sent by a consent management platform, to decide on the extent of processing we may perform on your personal data to enable our ad logic and performance tracking, and also communicate it across to other vendors engaged in services for our client so they may do the same. Those choices include but are not limited to, information about the transparency, consent, and/or objection status of a vendor and/or purpose, the opt-in status of a special feature, and Publisher restriction.

·      Device ID: each time you visit a website of one of our Publishers / SSPs or clients, we receive a request which includes certain device information, including your browser’s User Agent String (a text identifier that a browser sends to each website you visit) and/or information including your device’s brand name, operating system name and version, browser name and version.

2.    Types of data we collect from third parties

We also obtain your consent string data from Publisher’s or, Advertiser’s that are using our Spartan technology.

·      Consent String Data: before you see an ad on a website and/or when you visit a website for the first time, the Publisher and/or Advertiser obtains your consent for our processing activities via their consent management platform. If you provide your consent or objection to that Publisher and/or Advertiser, we will receive your consent string which shall provide us with your preferences in respect of our processing activities.

3.    How we use your personal data

In the table below we have set out further information about the purposes for which we use your personal data and the legal basis we rely on for its use.

Categories of personal data involved

Processing purpose

Legal basis

User ID

To prevent you from seeing the same ad multiple times and to target you with ads relevant to your interests.

This may also be used to record how many users have clicked through an ad and reached a certain point on an Advertiser's website.

Consent (based on the consent you provide to Publisher’s and/or Advertisers using our Spartan technology via their consent management platform)

Advertisement ID

To track your interactions with ads you encounter, including clicks and views.

Consent (as above)

IP Address

Device ID

 

To check and log your approximate region of origin and to check against a database of active fraudulent bots.

 

We also use your IP address to determine whether you are based in the EEA so that we can ensure that your personal data remains in the EEA.

Legitimate interests

It is in our legitimate interests to process this information for these purposes to ensure that Advertisers and Publishers are not being defrauded or paying for ads that have not been seen by a real person.

It is also in our and your legitimate interest to keep your data within the EEA so that we can ensure that your data is processed in compliance with applicable data privacy laws.

Non-Specific Location Data

For ad targeting purposes.

Legitimate interests

It is in our legitimate interests to show some ads in some general geographical locations but not others, for example, so that we can deliver location-based content and targeted advertisements relevant to your region.

Non-Specific Device Information

For ad targeting purposes.

Legitimate interests

It is in our legitimate interests to show different ad formats to different device types to better fit their sizes and characteristics, as well as for troubleshooting potential issues happening on specific device types.

Consent String Data

To determine the extent to which we are permitted to process your personal data, including the types of ads we can select and serve to you based on the consent preferences you provide to a Publisher and/or Advertiser.

Legitimate interests

It is in our legitimate interests to use Consent String Data so that we can understand your consent preferences and ensure compliance with data protection laws.

 

4.    Special category data and children’s data

We do not knowingly process any special category data. We do not knowingly process the personal data of individuals under the age of 16. If you have any concerns about your child’s privacy in relation to our services, or if you believe that your child may have provided personal data via our Spartan technology without appropriate consent, please contact us at dpo@dentsu.com.

5.     Sharing your personal data

We share anonymous and aggregated reports, using server log data, about the advertising campaigns that we have delivered with the relevant Advertiser and with SSPs. We share these reports to demonstrate to Advertisers that we have delivered their advertisements in accordance with our contract with them. We share these reports with SSPs should there be a dispute about payments and charges of advertisement slots. The reports that we provide will not enable either the Advertiser or the SSPs to identify you or communicate with you in future for any purpose.

We also share your consent preferences with other media and advertising partners for the purposes of third-party ad verification and attribution (as instructed by our clients to ensure the results from our reports are accurate and leading to the client’s desired business outcomes) and allowing them to establish a legal basis for processing your personal data.

We will share your personal data if we think we have to in order to comply with the law or to protect ourselves, our clients and others. We may share any or all categories of personal data to respond to a court order or subpoena. We may also share this personal data if a government agency or investigatory body requests it. We might share your personal data in order to enforce our agreements and to protect our rights and/or the rights of others. We might share your personal data when we are investigating potential fraud.

We may share your personal data as part of a transaction, financing, with a successor to all or part of our business, or for other business needs.  For example, if we sell or merge any of our businesses (including any of our affiliates, divisions, and business units) or assets, we may disclose your personal data as a part of that transaction, including to the prospective buyer or partner, lender or bank, as the case may be. We may also share your personal data if there is a similar change to our corporate structure. We may also share your information with others as part of certain due diligence processes.

We may share your personal data within our group of companies and with third parties for the purpose of management and administration of our business, including sharing information to those third parties that provide services to us. For example, we may share your personal data with our software technology partners for the purposes of facilitating the delivery of the Spartan technology.

We may share personal data for other reasons we may describe to you from time to time or as permitted by law. 

6.    How long we keep your personal data

We will keep your personal data for as long as is necessary for the purposes described in this Notice, and in accordance with our legal obligations. After this time, your personal data will be securely and automatically deleted.

7.    How we protect your personal data

Our safeguards include robust systems and processes designed to ensure that we collect only the minimum personal data necessary to pursue the purposes for which we process your personal data, and that only those who need to view your personal data can see it.

Under dentsu’s Chief Information Security Officer, there is a group-wide security function tasked with understanding security threats. Policies have been implemented to help keep your personal data secure. These policies are aligned to applicable regulations and industry standards including ISO27001 and NIST and are applicable to all parts of dentsu. 

8.    Transferring your personal data overseas

Your personal data is kept on servers in servers located within the EEA. We may transfer your personal data to countries where dentsu group companies or clients are located so that they may review and use the personal data for the purposes described in this Notice. When we transfer data, we take appropriate steps to ensure compliance with UK and EU data protection law. These steps might include, for example, transferring the personal data to a country which the UK Information Commissioner or the European Commission (as appropriate) has decided provides adequate protection for personal data, or to a company which has signed standard contractual clauses, or an international data transfer agreement approved by the European Commission/UK Information Commissioner respectively.

9.     Your rights in relation to your personal data

You have rights (with some exceptions and restrictions) to:

  • object to our processing of your personal data, including profiling. You can object, on grounds relating to your particular situation, at any time. In which case, we shall stop processing the data that your objection relates to, unless we can show compelling legitimate grounds to continue that processing;
  • access your personal data. If you make this kind of request and we hold personal data about you, we are required to provide you with information on it, including a description and copy of the personal data and why we are processing it;
  • request that we provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format;
  • request erasure of your personal data in certain circumstances;
  • request correction or updating of the personal data that we hold about you and that is inaccurate;
  • request the restriction of our processing of your personal data in some situations. If you request this, we can continue to store your personal data but are restricted from processing it while the restriction is in place;

·       complain to your local data protection authority about our collection or use of your personal data. For example, in the UK, the local data protection authority is the UK Information Commissioner's Office.

To exercise your rights, you can directly contact the organisation with whom you shared your personal data – in this case you should refer to their respective privacy notices. Alternatively, you can contact us directly using the contact details set out below. If you choose to exercise the rights described above, we may ask you to provide additional information so that we can satisfy ourselves of your identity before we take further action.

 

10.  How to contact us

If you have any questions about this Notice or would like to exercise any of the rights mentioned above, you can contact our Data Protection Officer in any of the following ways:

Address: Data Protection Officer, Dentsu UK Limited, 10 Triton Street, Regent’s Place, London, NW1 3BF

Telephone: (+44) (0) 207 070 7700

Email: dpo@dentsu.com

11.  IAB Europe

A picture containing screenshot, graphics, circle, graphic design

Description automatically generated

Dentsu UK Limited is a vendor (Vendor ID: 122) on the IAB Transparency and Consent Framework (“TCF”). TCF offers transparency to users about which vendors are operating as a first party (such as a Publisher), what purposes they process personal data for, and a clear mechanism for opting out of the vendor's purposes. For more information please visit: https://iabeurope.eu/transparency-consent-framework/

12.  Cookies

What are “cookies”?

Cookies are small packets of information stored by your browser when you visit certain websites. Cookies are generally used by websites to improve your user experience by enabling that site to ‘remember’ you, either strictly for the duration of your visit (using a “Session” cookie which is erased when you close your browser) or for repeat visits (using a “Permanent” cookie). Cookies set by us are called first-party cookies. We also use third party cookies which are cookies from a domain different to the domain of the website you are visiting.

How to manage third party cookies

If you do not want to consent to third party cookies, it is possible to change your browser settings and delete existing cookies from your browser. Most web browsers allow some control of cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.

Find out how to manage cookies on popular browsers:

Withdrawing your consent

If you do not provide your consent for the use of dentsu’s cookies used in Spartan technology, it may result in certain limitations to your ad experience. Specifically, without the use of cookies, we may not be able to tailor advertisements to your preferences or interests effectively. Cookies also help us limit the number of times you see the same ad, ensuring a diverse and engaging ad experience.

If you do consent and later wish to withdraw your consent to the use of cookies at any time, please click here.

Our Spartan technology uses the following types of cookies:

Targeting Cookies

These cookies may be set by our platform based on a visit to one of our Advertiser’s sites, or one of the Publisher sites we place advertising on in their behalf. They may be used by us to build a list of users who have interacted with a specific Advertisers page or have seen/interacted with a specific advertisement on a Publisher page, to then show you a specific ad as part of a sequence. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Cookie Subgroup

Cookies

Cookies used

Lifespan

metadsp.co.uk

ruiid, ruuid_lu, c,

Third Party

364 Days

 

Performance Cookies

These cookies allow us to accurately track specific events that happen after you see one of our Client’s ads. They are set when you view the Client’s ad and are checked when you visit a specific section of our Client’s page (under their control) to be counted in an aggregated report. This helps our Client’s optimise their spends towards the circumstances that provide them the best return for their advertising spends, based on specific events or information you are exposed to, either on the site where you saw the ad or on that Client’s site (but not everywhere in the web). The cookies do not contain any personal information, nor do they allow us to track your browsing data, patterns or behaviour. If you do not allow these cookies we will not be able to show you ads for campaigns where our Clients require it.

Cookie Subgroup

Cookies

Cookies used

Lifespan

metadsp.co.uk

landing, pcc, pvc

Third Party

364 Days

 

Strictly Necessary Cookies

These cookies are necessary for a website to function and cannot be switched off in our systems. They are only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personal data.

Cookie Subgroup

Cookies

Cookies used

Lifespan

metadsp.co.uk

ruiid=opt-out

First Party

365 Days

 

SUPPLEMENTARY INFORMATION

We may occasionally update this Notice from time to time to reflect changes in our practices, technologies or legal requirements. We encourage you to review this Notice periodically to stay informed about how we are processing your personal data.

In this Supplementary Information section, we explain some of the terminology used in the Notice.

  • "controller" – the person or company that controls the purposes and means of processing personal data.
  • "EEA” – the European Economic Area, which comprises the current countries in the European Union plus Iceland, Liechtenstein and Norway.
  • "personal data" – any information that relates to you (or from which you can be identified).
  • "processing" – doing anything with personal data. For example, collecting it, storing it, disclosing it and deleting it.
  • processor” – a person or company that processes personal data on behalf of the controller.