Business contact personal information
Under California law, certain types of business contact information are considered California PI. Thus, in addition to the other data types previously described in this policy, we collect business to business California PI about individuals, including the following categories of information:
- Identifiers, such as real name, alias, email address, online identifiers, and IP address.
- Commercial information, including services obtained from Xandr.
- Professional information.
- Sensitive personal information, including platform account login credentials.
We collect this information from the following sources:
- Directly from you – such as contact and billing info and customer service interactions.
- Generated by your use of our services – such as technical and usage information.
- Other companies – such as vendors and marketing firms.
- Publicly available sources – such as public records.
Business contact California PI is used for the following purposes:
- Perform services on behalf of the business, such providing our products and services, customer service, processing or fulfilling orders, and processing payments.
- Deliver marketing and advertising.
- Internal research, analytics, and development – e.g., user-preference analytics.
- Protect and enforce our agreements and property rights.
- Comply with court orders, legal processes, or respond to regulatory or other similar requests.
We disclose the following categories of business contact California PI for our own business purposes to third parties:
- Identifiers, such as real name, alias, email address, online identifiers, and IP address.
- Commercial information, including services obtained from Xandr.
- Professional or employment related information.
- Sensitive personal information, including platform account login credentials.
We disclose business contact California PI for our own business purposes to the following categories of third parties:
- Product and services delivery companies.
- Marketing services companies.
- Cloud storage companies.
- Billing and payment processing companies.
- Analytics companies.
Additionally, business contact personal information may be retained as long as necessary for business, tax, or legal purposes. After that, we destroy it by making it unreadable or indecipherable.
Your right to access, correct, and delete information collected and shared
Subject to certain exceptions, California consumers have the right to request from Xandr the following information with respect to their California PI, including business contact California PI:
- The categories and specific pieces of your California PI that we’ve collected.
- The categories of sources from which your California PI was collected.
- The purposes for collecting, sharing, or selling your California PI.
- The categories of third parties with whom we shared your California PI.
You can also submit a request to us for the following additional information:
- The categories of California PI we’ve shared or sold about you, the categories of third parties to whom we’ve shared or sold that California PI, and the category or categories of California PI shared or sold to each third party.
- The categories of California PI that we’ve disclosed to third parties for a business purpose, such as to those who provide services for us; the categories of third parties to whom we’ve disclosed that California PI; and the category or categories of California PI disclosed to each third party.
Further, you may request that Xandr perform the following with respect to California PI we have collected about you:
- Correct your inaccurate California PI.
- Delete your California PI.
To exercise your right to request the disclosure, correction, or deletion of your California PI that we collect or share, click here. These requests for disclosure are generally free. However, it is important to note that, except for business contact personal information, we do not generally collect or retain information that directly identifies an individual. Therefore, it is generally not feasible for us to verify individuals’ identities to provide, correct, or delete data that is tied to their identities, and as a result, we will deny most consumer requests in this regard. Further, we may retain your California PI in situations when that information is necessary for us to: provide you with a good or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; comply with or exercise rights provided by the law; or use the information internally in ways that are compatible with the context in which you provided the information to us, or that are reasonably aligned with your expectations based on your relationship with us.
Your right to ask us not to sell or share your California PI
You can always tell us not to “sell” or “share” your California PI by clicking here.
Once we receive your request, we will not “sell” or “share” your California PI, which in part means that we will not use your California PI for cross-context behavioral advertising (as defined by the CPRA), unless you later allow us to do so. We may ask for your permission to resume “sale” or sharing” of your California PI at a later date, but we will wait at least 12 months before doing so.
Your right to opt-out of our processing of your sensitive California PI
You may also instruct us not to process your sensitive California PI by clicking here.
Once we receive your request, which is connected to our “sale” and “sharing” opt-out process, we will not use your sensitive California PI except as requested by you or as otherwise permitted by California law, such as to review and respond to a data access, correction, or deletion request, to deliver non-personalized advertising, or to help ensure the security and integrity of our advertising platform.
Do-not-track signals
Our advertising platform will honor the Global Privacy Control browser signal (GPC) for California consumers where the users’ web browsers support this signal. In particular, when a California consumer uses GPC to indicate that they do not want their California PI “sold”, “shared”, and/or tracked, Xandr will not process on our platform any California PI sourced from that consumer’s web browser for any “sale” or “sharing” purposes, so long as the GPC opt-out signal remains present and readable by Xandr. Xandr does not currently honor any other “do not track” browser-based signals.
Authorized agents
You may designate an authorized agent to submit requests on your behalf. Your agent will need a valid power of attorney or written permission signed by you.