PRIVACY POLICY
==============
This Privacy Policy provides an overview of how esome advertising technologies GmbH (“esome”) processes your personal data.
The first section (Section I) of our Privacy Policy contains general information, such as our contact details, your rights as a data subject, and information about the processing of your data when you apply for a job with us, communicate with us, or register for our newsletter or other services.
The second section (Section II) contains information about data processing when you visit our website, www.esome.com (“Website”).
As a provider of digital advertising services, esome supports its customers in delivering and measuring the performance of advertising campaigns, including on connected TV, for example in video streaming services, on social media platforms, on websites on the open internet, and on other digital services that can be used for advertising purposes (“esome Services”). The nature and scope of esome’s data processing in connection with the esome Services are described in the third section (Section III).
This Privacy Policy is provided for your information. Further information about the tracking technologies, such as cookies, that we use on our Website can be found in our privacy settings.
I. GENERAL INFORMATION
1. Controller
-------------
esome advertising technologies GmbH
Managing Directors:
Benjamin Bunte, Lennart Mohr
Caffamacherreihe 7
20355 Hamburg
Germany
Telephone: +49 40 600 288 100
Email: info@esome.com
2. Data Protection Officer
-------------------------
If you would like to contact our Data Protection Officer, you can reach them at:
heyData GmbH
Schützenstraße 5
10117 Berlin
Germany
Website: www.heydata.eu
Email: datenschutz@heydata.eu
3. Contact and Feedback
----------------------
You can send us messages and feedback by email to info@esome.com. In this case, we store the information you provide, in particular your email address, the subject and content of your message, and the date and time you contacted us.
The data is processed for the purpose of handling your enquiry. If your enquiry relates to taking steps prior to entering into a contract with you or to performing a contract with you, the legal basis is Article 6(1)(b) GDPR. For other enquiries, processing is based on our legitimate interest in handling and responding to your message pursuant to Article 6(1)(f) GDPR. Where we obtain your consent for a particular processing activity, the legal basis is Article 6(1)(a) GDPR.
4. Business Correspondence, Newsletters, Mailings and Registration for esome Services
------------------------------------------------------------------------------------
4.1 Data Processing in Connection with Registration for Mailings, Product Updates and esome Services, and Appointment Bookings
4.1.1 Data Processing by Perspective Software GmbH
esome offers interested parties the opportunity to register for updates on certain services and products via contact and enquiry forms. For this purpose, we use the external service provider Perspective Software GmbH, Mailbox 659770, 96035 Bamberg, Germany (hereinafter “Perspective”).
Perspective processes your data exclusively on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR. Perspective has implemented appropriate technical and organisational measures to protect your rights.
Perspective itself stores your contact details on European servers. However, your data may be accessible to entities in the United States of America, as Perspective uses subprocessors based in the United States.
Transfers of data to the United States comply with the GDPR requirements for transfers to third countries. In particular, these transfers may be based on the European Commission’s Standard Contractual Clauses, supplemented by additional safeguards where necessary, or on the EU–US Data Privacy Framework (DPF). A transfer based on the DPF requires the respective recipient to be appropriately certified and the transfer to fall within the scope of that certification.
When you use a Perspective contact form, the following data is transmitted to Perspective’s servers:
- Date and time of access;
- Websites from which you accessed our website (“referrer”);
- Contextual information, such as button clicks or selections made on the pages;
- The contents of all completed text fields, such as contact details including your name or address, and other personal data depending on the question asked;
- Files uploaded by you.
The purpose of this data processing is to enable the communication you have requested. Where you give your consent for this purpose, processing is based on Article 6(1)(a) GDPR. If the enquiry form is used to take steps prior to entering into a contract with you, the legal basis is Article 6(1)(b) GDPR.
Your personal data is stored for as long as necessary to fulfil the purpose of processing. Where processing is based exclusively on your consent, the data will be deleted after you withdraw your consent, unless statutory retention obligations prevent this.
4.1.2 Data Processing by LinkedIn
esome also advertises its services on the B2B platform LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter “LinkedIn”), and uses LinkedIn’s lead generation feature for this purpose.
If you register with esome via the LinkedIn contact form for the purpose specified there, LinkedIn stores your data as part of these campaigns on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR. LinkedIn has implemented appropriate technical and organisational measures to protect your rights.
LinkedIn itself stores your contact details on European servers. However, your data may be accessible to entities in the United States of America, as LinkedIn uses subprocessors based in the United States.
Transfers of data to the United States comply with the GDPR requirements for transfers to third countries. In particular, these transfers may be based on the European Commission’s Standard Contractual Clauses, supplemented by additional safeguards where necessary, or on the EU–US Data Privacy Framework (DPF). A transfer based on the DPF requires the respective recipient to be appropriately certified and the transfer to fall within the scope of that certification.
When you use the LinkedIn contact form, the following data is transmitted to LinkedIn’s servers:
- Date and time of access;
- The contents of all completed text fields, such as contact details including your name or address, and other personal data depending on the question asked;
- Files uploaded by you.
The purpose of this data processing is to enable the communication you have requested or to provide the services offered. Where you give your consent for this purpose, processing is based on Article 6(1)(a) GDPR. If the enquiry form is used to take steps prior to entering into a contract with you, the legal basis is Article 6(1)(b) GDPR.
Your personal data is stored for as long as necessary to fulfil the purpose of processing. Where processing is based exclusively on your consent, the data will be deleted after you withdraw your consent, unless statutory retention obligations prevent this.
4.1.3 Data Processing by Wix.com Ltd.
esome offers interested parties the opportunity to register for webinars and updates on certain services and products via contact and enquiry forms. For this purpose, we also use the external service provider Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel (hereinafter “Wix”).
Wix processes your data exclusively on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR. Processing is carried out on the basis of a corresponding data processing agreement. Wix has implemented appropriate technical and organisational measures to protect your personal data.
When you use the contact and enquiry forms provided via Wix, the following data is transmitted to Wix’s servers:
- Date and time of access;
- The contents of all completed text fields, such as contact details including your name, email address or postal address, and other personal data depending on the information provided in the respective form.
The purpose of this data processing is to enable the communication you have requested or to provide the services you have requested. Where you give your consent for this purpose, processing is based on Article 6(1)(a) GDPR. If the enquiry relates to taking steps prior to entering into a contract with you or to performing a contract with you, the processing necessary for this purpose is based on Article 6(1)(b) GDPR.
Wix stores your data on servers in Israel. The European Commission has adopted an adequacy decision for Israel pursuant to Article 45 GDPR (Decision 2011/61/EU).
Where Wix uses subprocessors in other countries outside the European Economic Area, the corresponding data transfers are carried out in compliance with the applicable legal requirements. In particular, these transfers are based on relevant adequacy decisions or the European Commission’s Standard Contractual Clauses, supplemented by additional safeguards where necessary.
For recipients in the United States, a transfer may be based on the EU–US Data Privacy Framework, provided that the respective recipient is appropriately certified and the transfer falls within the scope of that certification.
Your personal data is stored for as long as necessary to fulfil the respective purpose of processing. Where processing is based exclusively on your consent, the data will be deleted after you withdraw your consent, unless statutory retention obligations prevent this.
Further information about your rights and the withdrawal of your consent can be found in Section I.8.
4.2 Appointment Booking Using meetergo
To make it easier for you to book appointments with us, we use the online appointment scheduling tool provided by meetergo GmbH, Hansaring 61, 50670 Cologne, Germany (hereinafter “meetergo”). The tool is integrated into our Website. We also link to the service in our email correspondence when appointments need to be arranged.
When you access the booking page or arrange an appointment with us via meetergo, the following personal data is processed on meetergo’s servers:
- Date and time of access;
- IP address;
- Websites from which you accessed the booking page (“referrer”);
- If an appointment is booked: first and last name, email address or telephone number, the subject of the appointment, and any additional data you voluntarily provide during the booking process.
Processing is based on our legitimate interest in straightforward appointment scheduling pursuant to Article 6(1)(f) GDPR. If arranging the appointment is necessary in connection with taking steps prior to entering into a contract with you or with an existing contract with you, the legal basis is Article 6(1)(b) GDPR.
meetergo processes your data exclusively on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR. meetergo has implemented technical and organisational measures to protect your rights and stores your data on servers in Germany.
Your personal data is stored for as long as necessary to fulfil the purpose of processing. Statutory retention obligations remain unaffected.
4.3 Promotional Mailings and Business Correspondence
To manage and further process contact details, we use the Salesforce CRM system provided by salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany.
In Salesforce, we store the contact details necessary for initiating and conducting business relationships.
Where you have given us your consent for this purpose, processing is based on Article 6(1)(a) GDPR. Where processing is necessary to take steps prior to entering into a contract with you or to perform a contract with you, it is based on Article 6(1)(b) GDPR. Where statutory obligations apply, in particular obligations to retain business records, the legal basis is Article 6(1)(c) GDPR.
Salesforce processes the data on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR.
4.4 Newsletter Distribution
In addition to using your contact details for initiating and conducting business relationships, we process your email address, with your separate consent, to send you our newsletter. The newsletter informs you about developments in the digital advertising market and news about esome and our products.
To distribute our newsletter and to send our own promotional mailings and information about our services, we use the BREVO service provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (hereinafter “Sendinblue”).
Sendinblue processes your data for distribution purposes on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR. Sendinblue has implemented appropriate technical and organisational measures to protect your rights.
By integrating pixel tags into newsletters and mailings, the service provider helps us determine, on a pseudonymised basis, how many recipients have opened our newsletters and mailings and which links they have clicked.
When these pixels are retrieved, technical information is collected, in particular information about the browser and system, the IP address, and the time of retrieval. This information is used to improve the services technically and to analyse reading behaviour, for example using approximate access locations that can be determined from the IP address, or access times.
This processing is based on your consent pursuant to Article 6(1)(a) GDPR. Where it involves access to information on your device or the storage of information on your device that requires consent, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies.
The distribution service provider may use this data in pseudonymised form to optimise or improve its services, for example to technically optimise distribution and presentation or to conduct statistical analyses of recipients’ origins. Pseudonymised data may still constitute personal data.
You may withdraw your consent at any time with effect for the future. In particular, you can use the unsubscribe link in the respective newsletter or the contact option specified in Section I.8.
5. Social Network Presences
--------------------------
Facebook Fan Page and Page Insights
We operate a Facebook fan page at https://www.facebook.com/esomeadvertising to provide visitors and interested parties with information about esome and to communicate with them.
Facebook is a service provided by Meta Platforms Ireland Limited (“Meta”), based at 4 Grand Canal Square, Dublin 2, Ireland.
In connection with the provision of our fan page, Meta provides us with Page Insights. These are aggregated data that give us an understanding of how users interact with our fan page. Page Insights may be based on personal data collected in connection with a visit to or interaction with our fan page and its content.
Meta and esome act as joint controllers in this context and have entered into an agreement pursuant to Article 26 GDPR for the joint processing of Insights data. This agreement is available at:
https://www.facebook.com/legal/terms/page_controller_addendum
The legal basis for processing Page Insights is our legitimate interest in using interactions on our fan page to respond more effectively to visitors’ interests, pursuant to Article 6(1)(f) GDPR.
You may object to processing based on our legitimate interests under the conditions set out in Article 21 GDPR. To do so, you can contact us using the contact details provided in Section I.1.
If you provide us with personal data, such as your name, email address or similar information, via Facebook’s communication channels so that we can, for example, respond to an enquiry, we also handle that enquiry in our own systems. This data is stored there for 30 days.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to communicate with you and answer your questions. Where your enquiry relates to taking steps prior to entering into a contract with you or to performing a contract with you, the legal basis is Article 6(1)(b) GDPR.
Online Presences on Other Social Media
In addition to our Facebook fan page, we maintain online presences on other social networks and platforms to communicate with customers, interested parties and users who are active there and to inform them about our services.
When you access the respective networks and platforms, the terms and conditions and privacy notices of their respective operators apply.
Unless otherwise stated in this Privacy Policy, we process users’ data when they communicate with us on social networks and platforms, for example by posting on our online presences or sending us messages. Processing is carried out to handle this communication on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR or, in the case of contract-related enquiries, on the basis of Article 6(1)(b) GDPR.
6. Job Applications
-------------------
If you apply for a job at esome, we process the information we receive from you during the application process.
For the application process and the management of our job advertisements, we use the external service provider softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, Germany (hereinafter “Softgarden”).
Job advertisements displayed on our Website are loaded from external servers operated by Softgarden. Softgarden processes your data exclusively on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR and has implemented appropriate technical and organisational measures to protect your rights.
To display the content correctly, Softgarden processes the following browser and system information:
- IP address;
- User agent;
- Browser type and version;
- Websites from which you accessed our website (“referrer”);
- Operating system.
The legal basis for this processing is our legitimate interest in displaying our job advertisements pursuant to Article 6(1)(f) GDPR.
The information processed by us and Softgarden in connection with your application includes, in particular:
- Your contact details;
- Information in your cover letter, in particular about your education and qualifications;
- Your CV;
- Certificates and references;
- Correspondence;
- Information provided by telephone or verbally.
We refer to this information below as “Applicant Data”.
We use your Applicant Data to review, manage and conduct the respective application process and, if your application is successful, to establish, carry out and terminate an employment relationship with esome.
Processing is based on Section 26 of the German Federal Data Protection Act (BDSG) and, where applicable, Article 6(1)(b) GDPR, insofar as it is necessary to decide whether to establish an employment relationship or to carry out or terminate that relationship.
If, following an unsuccessful application, you choose to allow us to consider your Applicant Data for future vacancies, this further processing is based on your separate consent pursuant to Article 6(1)(a) GDPR.
Further information about data processing in connection with your application, in particular the applicable retention periods, will be provided to you separately during the application process.
7. Retention Period
-------------------
We process your personal data for the purposes specified in this Privacy Policy.
The retention period depends on how long the data is required for the respective purpose. Once the purpose has been fulfilled or no longer applies, we delete your personal data unless statutory retention obligations or other legal grounds require or justify continued storage.
Where data must continue to be stored due to statutory retention obligations, its processing is restricted accordingly to the permitted purposes.
Specific information about retention periods in individual sections of this Privacy Policy takes precedence over this general information. Your ability to exercise your rights as a data subject remains unaffected.
8. Rights of Data Subjects
-------------------------
Where the statutory conditions are met, you may exercise the following rights against us as the controller:
- Right of access pursuant to Article 15 GDPR;
- Right to rectification pursuant to Article 16 GDPR;
- Right to erasure pursuant to Article 17 GDPR;
- Right to restriction of processing pursuant to Article 18 GDPR;
- Right to data portability pursuant to Article 20 GDPR;
- Right to object pursuant to Article 21 GDPR.
In connection with rectification, erasure or restriction of processing, the notification obligations and the right to information under Article 19 GDPR also apply.
Withdrawal of Your Consent
You may withdraw your consent at any time with effect for the future pursuant to Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
In particular, you can send your withdrawal by email to data-protection@esome.com.
You can manage and withdraw your consent to the storage of information on your device or access to information already stored on it, for example through cookies and similar tracking technologies, and to the associated further data processing, at any time in the privacy settings in the footer of our Website:
[Insert link to privacy settings]
Right to Object
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation. This also applies to profiling based on that provision.
Where your personal data is processed for direct marketing purposes, you may object to this processing at any time. This also applies to profiling insofar as it is related to such direct marketing.
Automated Decisions
Under the conditions set out in Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
In connection with our Website and the esome Services described here, we do not make any such decisions based solely on automated processing. The creation and use of advertising profiles described in Section III must be distinguished from such decisions.
Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement.
The supervisory authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Current contact details are available at:
https://datenschutz-hamburg.de
II. DATA PROCESSING WHEN YOU VISIT OUR WEBSITE
In addition to the information above, this section explains the extent to which esome processes your personal data when you visit our Website.
1. Information We Receive Automatically When You Visit Our Website
------------------------------------------------------------------
When you visit our Website, the following data is initially processed and stored:
- IP address;
- Remote host;
- Volume of data transferred;
- Referring page (“referrer”);
- Date and time of access.
At least temporary processing of this information is technically necessary to provide you with our online offering, including the necessary content and functions.
In addition, we store your IP address for up to 30 days to ensure the stability of our online offering, troubleshoot errors, and protect against hacking attacks or other unauthorised or abusive access.
Cloudflare
We use the content delivery network (CDN) provided by Cloudflare Inc., 101 Townsend Street, San Francisco, USA (hereinafter “Cloudflare”), to improve the security of our Website and enable its delivery without long loading times.
For this purpose, parts of our Website are hosted worldwide. Cloudflare processes the personal data generated in this context on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR.
Wix and Fastly
We also use Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel (“Wix”), to host our Website.
Wix processes the personal data generated in connection with the provision of the Website on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR.
Wix uses the content delivery network (CDN) provided by Fastly Inc., 475 Brannan St., Suite 300, San Francisco, CA 94107, USA, to improve the security of the Website and enable its delivery without long loading times.
For this purpose, parts of the Website are hosted worldwide. In particular, the technical access data specified in this section may be processed in this context.
Information about data transfers to Israel and other third countries can be found in Section I.4.1.3 and, additionally, in Section II.4.
Legal Bases
The processing of personal data for the technical provision of our Website and to ensure its stability and security is based on our legitimate interest in a secure and functional online offering pursuant to Article 6(1)(f) GDPR.
Where information is stored on or read from your device and this is strictly necessary to provide a digital service expressly requested by you, this takes place on the basis of Section 25(2), point 2, TDDDG.
For any additional access and processing requiring consent, the information in Section II.2 applies.
2. Information About Cookies and Similar Technologies
----------------------------------------------------
We use cookies and similar technologies on our Website. Cookies are small text files stored in your browser or on your device. They may be used, for example, to provide technical functions, save settings or analyse the use of our Website.
Where storing information on your device or accessing such information is strictly necessary to provide a digital service expressly requested by you, this takes place on the basis of Section 25(2), point 2, TDDDG.
We only use cookies and similar tracking technologies that are not strictly necessary with your consent. In these cases, the legal basis for storage or access is Section 25(1) TDDDG. The associated processing of personal data is based on Article 6(1)(a) GDPR.
We use the information for the purposes specifically identified in the respective consent, for example to better understand how our Website is used and to adapt our offering to users’ needs.
An overview of the cookies and similar technologies used, including their providers, purposes and durations, is available in our privacy settings. This also includes the technologies used as part of the Wix functions we use.
[Insert link to cookie overview]
You can give, change or withdraw your consent with effect for the future at any time via our consent management platform (“CMP”) or the privacy settings on our Website.
PIWIK Pro
For website analytics and consent management, we use “PIWIK Pro”, a service provided by Piwik Pro GmbH, Knesebeckstraße 62/63, 10710 Berlin, Germany.
If you consent to the use of analytics cookies, we use PIWIK Pro to analyse the use of our Website. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Cookies documenting your choice may also be used to store and manage your consent decision. Where these are strictly necessary to provide consent management, storage or access takes place on the basis of Section 25(2), point 2, TDDDG.
Personal data processed to demonstrate that consent has been given is processed to comply with our statutory obligations to provide such evidence pursuant to Article 6(1)(c) in conjunction with Article 7(1) GDPR. In all other respects, your privacy settings are managed on the basis of our legitimate interest in legally compliant and user-friendly consent management pursuant to Article 6(1)(f) GDPR.
PIWIK Pro processes your data on our behalf and in accordance with our instructions as a processor pursuant to Article 28 GDPR and has implemented appropriate technical and organisational measures to protect your rights.
3. Data Recipients and Other Integrated Services
-----------------------------------------------
Service Providers and Other Recipients
To ensure that our Website functions technically and operationally, we use external service providers that support us in providing it. Where they process personal data on our behalf and in accordance with our instructions, this takes place on the basis of a data processing agreement pursuant to Article 28 GDPR.
Further information about the services we use from Wix.com Ltd., Cloudflare, PIWIK Pro, Softgarden and meetergo, and about the Fastly content delivery network used by Wix, can be found in the relevant sections of this Privacy Policy. The information in Section I.4.1 also applies to the use of contact forms.
In addition, personal data may be disclosed to public authorities and other recipients where there is a statutory obligation or another legal basis for doing so. These may include, in particular, tax authorities, tax advisers, law enforcement authorities and legal advisers.
SalesViewer®
This Website uses SalesViewer® technology provided by SalesViewer® GmbH to collect and store data for marketing, market research and optimisation purposes.
For this purpose, JavaScript-based code is used to collect and use company-related data. According to the described technical implementation, the data collected is pseudonymised using a non-reversible one-way function (“hashing”) and is not used to personally identify visitors to this Website. Pseudonymisation is not the same as anonymisation.
Where consent is not required for the specific technical processing, processing is based on our legitimate interest in analysing company-related website visits and optimising our offering pursuant to Article 6(1)(f) GDPR. Where the technology used requires consent under Section 25(1) TDDDG or the GDPR, it is only used after the corresponding consent has been given; processing is then based on Article 6(1)(a) GDPR.
The data stored through SalesViewer® is deleted as soon as it is no longer necessary for its intended purpose and no statutory retention obligations prevent deletion.
You may object to the collection and storage of data with effect for the future by visiting the following link:
https://www.salesviewer.com/opt-out
An opt-out cookie will then be stored on your device to prevent future collection. If you delete the cookies in your browser, you must submit your objection again using this link.
Where the use of this technology is based on your consent, you can also withdraw that consent via our privacy settings.
4. Data Processing Outside the European Economic Area
----------------------------------------------------
Where recipients outside the European Economic Area (“EEA”) process your personal data in connection with the provision of our Website and its integrated services, this takes place in compliance with the statutory requirements for transfers to third countries.
In particular, a transfer may be based on an adequacy decision adopted by the European Commission pursuant to Article 45 GDPR. Such a decision exists for Israel. For recipients in the United States, the EU–US Data Privacy Framework may serve as the basis, provided that the respective recipient is appropriately certified and the transfer falls within the scope of that certification.
Where no relevant adequacy decision exists, appropriate safeguards pursuant to Article 46 GDPR are put in place, in particular the European Commission’s Standard Contractual Clauses. Additional safeguards are implemented where necessary.
You can request further information about the respective transfer mechanisms and a copy of the relevant safeguards using the contact details provided in Section I.1.
III. DATA PROCESSING IN CONNECTION WITH THE PROVISION OF ESOME SERVICES
This section explains the role in which esome acts and the extent to which esome processes personal data when providing the esome Services.
1. esome as a Processor
----------------------
Where esome processes personal data on behalf of its customers as part of its services, the processing associated with the commissioned delivery and performance measurement of advertising campaigns is carried out in accordance with instructions.
The basis for this is a corresponding data processing agreement pursuant to Article 28 GDPR between esome and the respective customer.
Please note that, in these cases, the respective advertising customer, rather than esome, is the controller responsible for processing. Requests to exercise your rights as a data subject should therefore generally be addressed to the respective customer. If we receive such requests, we assist the respective controller in handling them within the scope of our statutory and contractual obligations.
2. esome as a Controller
-----------------------
a) Data Processing Under IAB TCF v2.2
Subject to the consent you give to our selected partners, these partners provide us with personal data. esome processes this data as a controller within the meaning of Article 4(7) GDPR for the purposes described below.
An overview of our data partners is available here:
[Insert link to partner list]
In particular, the following types of personal data are processed for the purposes listed below:
- Pseudonymous identifiers linked to a user’s device;
- Device information;
- Information about user behaviour.
We do not collect names or addresses for these purposes. Pseudonymous data may also constitute personal data.
IAB Processing Purpose 2:
Use Limited Data to Select Advertising
Legal basis:
Consent pursuant to Article 6(1)(a) GDPR.
Explanation:
The advertising presented to you by advertisers as part of the services offered by esome on websites, in apps, on connected TV and on social media platforms may be based on limited data.
This may include, for example:
- The website or app you are using;
- Your approximate location;
- Your device type;
- Content with which you interact or have interacted.
This information may be used, for example, to limit the number of advertisements presented to you.
IAB Processing Purpose 3:
Create Profiles for Personalised Advertising
Legal basis:
Consent pursuant to Article 6(1)(a) GDPR.
Explanation:
Information about your activities on websites or in apps where our data partners collect information for advertising purposes may be stored and combined with other information about you or similar users.
This may include, for example, content you view and information about previous activities on the same or other websites and apps.
This information is used to create a profile about you or to improve an existing profile. Such a profile may include possible interests and personal aspects.
The profile may also be used at a later time to present advertising that appears relevant to an advertiser on the basis of your possible interests.
IAB Processing Purpose 4:
Use Profiles to Select Personalised Advertising
Legal basis:
Consent pursuant to Article 6(1)(a) GDPR.
Explanation:
The advertising we present to you on behalf of our advertising customers on websites, in apps and on social networks may be based on your advertising profiles.
These advertising profiles are created in particular by our data partners and are based on your activities on websites or in apps, such as the content you view. They may reflect possible interests and personal aspects.
Further information about the creation of these profiles can be found under Processing Purpose 3.
IAB Processing Purpose 7:
Measure Advertising Performance
Legal basis:
Consent pursuant to Article 6(1)(a) GDPR.
Explanation:
Information about which advertisements are shown to you and how you interact with them may be used to measure the effectiveness of our advertising customers’ advertisements and to determine whether the objectives of an advertising campaign have been achieved.
This includes, for example, information about:
- Whether an advertisement was loaded in your browser;
- Whether you clicked on an advertisement;
- Whether you played an advertising video;
- Whether an advertisement prompted you to visit an advertiser’s website or purchase the advertised product.
These analyses help us and our advertising customers understand the relevance and effectiveness of advertising campaigns.
IAB Processing Purpose 10:
Develop and Improve Services
Legal basis:
Consent pursuant to Article 6(1)(a) GDPR.
Explanation:
Information we collect when delivering advertisements may be used to improve advertised products and our advertising customers’ associated websites, and to develop new products and offerings.
This includes, for example, information about whether you click on an advertisement or play an advertising video, as well as insights into user interactions and the type of audience being targeted.
This purpose does not include the development or improvement of user profiles and identifiers.
Additional Functional Processes
Where covered by the consent you have given to our partners, the processing activities described above may also include the following functional processes:
- Matching and combining with offline data;
- Linking different devices;
- Receiving and using automatically sent device characteristics for identification;
- Actively scanning device characteristics for identification.
Where separate consent is required, the respective function is only used if that consent has been given. Section 25(1) TDDDG also applies to the storage of information on your device or access to information on your device where consent is required.
Information about your rights, in particular the withdrawal of your consent, can be found in Section I.8. You can also withdraw consent given through a partner’s consent management system via that partner’s corresponding settings.
b) Disclosure of Your Data
Where a valid legal basis exists, the pseudonymised data described above is disclosed to other recipients in connection with the provision of our esome Services.
An overview of these recipients is available here:
[Insert link to recipient list]
Data is disclosed only within the scope of the respective permitted purposes and in compliance with the applicable data protection requirements.
3. Data Recipients Outside the European Economic Area
----------------------------------------------------
If your personal data is processed by us or by the recipients specified above outside the European Economic Area, we comply with the statutory requirements for transferring personal data to third countries.
In particular, the following may serve as a basis:
- An adequacy decision adopted by the European Commission pursuant to Article 45 GDPR;
- The EU–US Data Privacy Framework for appropriately certified US recipients, provided that the respective transfer falls within the scope of that certification;
- Appropriate safeguards pursuant to Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, supplemented by additional safeguards where necessary.
Taking our data protection obligations into account, we have entered into the necessary agreements with the respective recipients to protect your personal data.
If you would like further information about the respective transfer mechanisms or a copy of the relevant safeguards, you can contact us using the contact details provided in Section I.1.
4. Retention Period
-------------------
We process your personal data only for as long as necessary for the respective purpose described in Section III.2.
The data is then deleted unless statutory retention obligations or other legal grounds require or justify continued storage.
Where processing is based exclusively on your consent, it will cease after you withdraw your consent. Statutory retention obligations remain unaffected.
Your ability to exercise your rights as a data subject also remains unaffected.
VERSION AND CHANGES
===================
Date of this Privacy Policy:
[Insert publication date]
We reserve the right to amend this Privacy Policy with effect for the future, in particular in the event of changes to our services, the technologies used or statutory requirements. Where a change requires new consent, we will obtain that consent separately.
CONTACT
=======
esome advertising technologies GmbH
Caffamacherreihe 7
20355 Hamburg
Germany
Telephone: +49 40 600 288 100
Email: info@esome.com
For data protection enquiries and withdrawal of consent:
data-protection@esome.com