Privacy Policy

We, at the RASTRO STUDIO (“Company”, “we”, “us” or “our”), understand that your privacy is important to you. This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information collected through our web-based, connected-TV and other services.

If you have any questions, please contact us at privacyrights@rastro-studio.com.

1. The Company and our Services

The Company operates several platforms and services that comprise our “Services.”

As further described below, through our Services, we work with websites, web services, content publishers, mobile applications, and various platforms (such as connected TVs, aka “CTV” platforms) that provide services for those types of organizations to help them display personalized and more engaging ads on their properties. In many cases, providing personalized ads help businesses of all sizes (including small and mid-sized businesses) to get their name out, and help website operators, content publishers, app developers and platform owners to subsidize the cost of their content – often, allowing them to provide consumers with some or all of their content for free.  We also work with advertisers (and their service providers) – brands, retailers, entertainment companies, non-profits and others – to help them advertise in a way that is efficient and relevant to both them and the consumer.   We use data in a variety of ways to help support these businesses, and likewise provide a variety of ways for consumers to control how data is used to market to them.  The purpose of this Privacy Policy is to explain what that data is, how it is used, and what those choices are.

2. The Information We Collect and Use in Providing Our Services

We help advertisers and publishers provide more relevant content and targeted advertising by collecting certain information about you, including when you interact with our Services.  This may include your interactions with our customers, which include:

(a) advertisers and other ad partners (collectively, “Advertisers”) to show you ads that we think may interest you, on our Services and on other companies’ websites, apps, and devices; and

(b) publishers, app developers and other customers who CTVs, web and mobile apps or other online services (collectively, “Publishers”).

In this Privacy Policy, when we use the term “Customers”, we are referring to both Advertisers and Publishers, as described above.

Sometimes we work with other marketing or advertising services, demand partners, service providers or data platforms who provide certain services (such as measurement and analytics solutions) to us as well as Customers; we refer to these companies as “Partners.”

We (or our Customers or Partners) may provide relevant content and targeted advertising to consumers by using automated technologies such as cookies, including non-HTTP cookies, pixel tags, mobile identifiers and SDKs, each of which we describe below, and in  Section 3  below titled, “Cookies, Pixel Tags, SDKs and Similar Technologies”.   These technologies often generate or collect unique identifiers, such as cookie IDs or mobile advertising IDs.

We describe below these and other categories of information that we receive from consumers’ operating systems, browsers and devices, as well as from Customers, Partners, advertising platforms and networks, and data resellers. Some companies may fit into more than one such category. We have tried to describe the information that we collect or receive in a way that is easy to understand:

a. Information that you provide to us directly

We collect certain information that you provide to us, including your contact and other information – for example, when you visit our site or when you contact us.

You may also interact with and provide information to us in other ways, including but not limited to when you complete a survey, enter a contest, giveaway, or sweepstakes, connect with us at a tradeshow, or choose to hear from us or participate in our marketing or promotion campaigns. When you do so, we collect the information you provide to us.

If you submit to us a request to access or delete your information, we will collect your contact information and other information, as needed, to respond to your request.

b. Identifiers automatically collected from website and app sources,whether directly or through other content and information platforms, including:

• Online cookie IDs;
• Mobile advertising identifiers (e.g., IDFAs, Ad IDs) and other mobile device or browser identifiers;
• IP addresses;
• Wi-Fi access points;
• Product model numbers;
• Chipset IDs; and
• Identifiers related to the device used, such as CTVs (e.g. name of device and any “friendly name” assigned by you to the device)

We refer to all of the above as “IDs.“

c. Online usage information or “log” information

We collect data about your interactions with our site and the Services. Such data is generally related to the above IDs and include:

• Language and region settings;
• Data related to or describing a web browser, operating system, and device, such as the name and version of your browser, as well as hardware and software version of the app;
• Connection data, including current IP address, from which location may be inferred;
• Online usage data including websites visited, websites visited prior to a web visit, date/time stamp;
• Information related to interactions with ads and marketing, such as consumer engagement with an ad (i.e. ads that you view and click);
• Information related to interactions with websites, such as whether a consumer was “referred” through another website or a shared link;
• TV viewership data (including information about the content and programs viewed, and amount of time spent viewing Smart TV content, as further described in this Section 2 on “Viewing Data” below); and
• We may link any of the above to our own or our Partners’ and Customers’ IDs.

We receive the above information from Customers and Partners, advertising platforms and networks, and data resellers.

d. Demographic and Interest-Based Information

• We may collect, use, or create “audience segments” (also referred to as “data segments), which are generally used to tailor advertising and marketing to consumers and to analyze consumer interaction with such ads.  Audience segments are interest-based or demographic-based groupings of large numbers of users, generally in aggregated form, tied to the above IDs.  For instance, an inference that Ad ID X35%979J is interested is “Sports” might be drawn from the fact that the browser often views sports-related content.  Or, an inference that Cookie ID 4Qj7e9!x may be interested in a new car may be drawn from the corresponding browsers frequent search of new automobile reviews. Actual IDs are generally much longer strings of code; the above are simply used for illustration.
• Sometimes these inferences are made from “offline data” that is coded and linked to cookies and IDs (and further linked to our own cookies and IDs) by Partners that create “hashed” (coded) values to replace “real-world” identifiers such as email addresses.
• Sometimes these inferences are made from demographic information (“protected classifications” for purposes of the California Consumer Privacy Act).
• Sometimes, these audience segments are associated with the likelihood to have a particular health condition. A list of our standard health segments is here. (We endeavor to update the list frequently, but the list may not be current to the precise date.)   In addition, we may sometimes create “custom” health-related segments, or work with Customers or Partners who use such segments.  Those “custom” segments change over time, but a representative sample is included. Note that such information is only collected/processed at an aggregate level and solely in the U.S. and Canada.

e. Transactional information from our Customers

Our Customers may provide us with their own proprietary or licensed information, including “audience segments” described above, to help us better perform or deliver our Services.

f. Geolocation Information

The mobile information we collect or receive from our Partners and Customers also may include geolocation information, that may help us or our Customers to target ads or tailor content to your location. For instance, if we believe that you are often near a particular store in Northern New Jersey, we might send you an ad targeted to that store, rather than another store in the general area.

g. Viewing Data

We provide advertising services to certain Smart TV and connected devices (like Hisense and VIDAA Smart TVs), which, like many CTVs, are equipped with Automatic Content Recognition (“ACR”) functionality that (when enabled) allow us to collect certain information from the device in order to provide personalized advertising and measurement based on the programming  or ads watched on those devices and other devices connected to the same IP address.

What is Viewing Data?

When enabled on the Smart TV device, we will use audio-based ACR technology to collect information about the programming content (e.g. TV channels and shows, movies, and advertisements watched) playing on the device, including content from any media players, gaming consoles, over-the-air broadcast, or other audiovisual sources playing through the Smart TV. We call this information the “Viewing Data” and this also includes information such as timestamp, IP address, and Smart TV device identifier.

The ACR technology captures a “fingerprint” from the Smart TV, and the fingerprint is mapped against a content repository and ad catalog to identify what was played through the TV. Content or ad ID, IP address, device ID, and other metadata are appended to the audio fingerprint. These identifiers are ingested into the Company’s platform and mapped to a Household ID, and then aggregated with other data sources.  The ACR process will associate the data collected with the device’s IP address, but otherwise does not utilize directly identifiable personal information for the purposes of personalized advertising or measurement.

For example, we may collect TV viewing information such as the programs, commercials, and channels you view, the date, time and duration of the viewing. It may also include information about the TV or display, including IP address and SmartTV device ID.

How is Viewing Data used and shared?

• To create audience segments: We use Viewing Data, such as the content, programs or ads watched on your Smart TV, to include you and your household in relevant audience segments for interest-based advertising, as described below. A segment is a grouping of consumer profiles by one or more attributes (e.g. food fans, sports enthusiasts, sitcom fans, etc.). Individuals are identified by a digital identifier (like an IP address) in these segments but are not identifiable by name or other personal information that directly reveals their identity. We also share these audience segments with our Partners for their own purposes, including to enable their interest-based advertising activities.
• Targeting Personalized Ads: We use Viewing Data to help us, and our Partners, target and show you personalized ads that we think may interest you or other members of your household (a practice known as “interest-based advertising“) across your devices, based on the audience segments created from your Viewing Data (as described above). These ads may be shown to you on your Smart TV or other linked devices sharing the same IP address.
• Audience Measurement: We use Viewing Data to generate measurement reports to help us and our Partners understand the effectiveness of ad campaigns, including the audience that saw their ads and how they responded.  We collect information such as the creative and placement ID, IP address, and whether you viewed or interacted with an ad.
• Linking devices for household targeting: With the assistance of our third-party service providers, we use the IP address collected from your Smart TV to identify “households” (a group of linked devices sharing the same IP address broadcast by a modem). This allows us and our Partners to deliver personalized advertising to you and other members of your household across various devices (such as mobile phones and tablets) and browsers based on audience segments associated with your household. If you do not enable, or if you otherwise opt-out of personalized advertising on your Smart TV, we will no longer collect and use your Smart TV IP address to identify your household for personalized advertising purposes. However, once you opt out of personalized advertising, you may continue to see personalized advertising on devices that were previously targeted based on Viewing Data that was shared when personalized advertising was still enabled on your Smart TV, prior to the opt-out.
• Our Partners: More information about each of our Partners and how they may use data about you and your household is available at: https://rastro-studio.com/acr-data-partners

How can I turn OFF or ON the Viewing Data (ACR) feature?

The option to enable ACR (and related functionality) is presented during the initial setup of the Smart TV and can also be accessed at any time via the Settings of the Smart TV. You can disable ACR (and related functionality) at any time via the Settings of the Smart TV. Turning the Viewing Data feature off or on will affect only the Smart TV where you have made that selection. Please refer to the device’s Privacy Notice and the Enhanced Viewing Service Privacy Notice of your Smart TV for more information on Viewing Data and your choices.

h. Further Description of Technologies

For additional explanation of the technologies through which IDs and other data are collected, please see Section 3 further below regarding cookies, pixel tags and SDKs.  We may use cookies, pixel tags, SDKs and similar technologies to collect the above information, or to associate certain types of information with each other.

i. Information collected from other sources

We also may obtain other behavioral and demographic data from trusted third-party data sources. We may use this data to draw inferences about your preferences, choices, and interests to provide you with customized ads about products and services tailored to your individual interests. We may collect and combine information about your online activities over time and across devices, apps, websites and online services to provide you with customized ads.

3. Cookies, Pixel Tags, SDKs and Similar Technologies

The Company (along with our Partners and Customers) uses a variety of technology to collection information.  These are listed and described below.

a. Pixels

A tracking “pixel” is a transparent graphic image (usually a 1 x 1 pixel) that is placed on a web page and allows for the collection of information regarding the use of the web page that contains the tracking pixel. The Company collects technical and usage information through the use of tracking pixels.

b. Cookies

A “cookie” is a string of stored code used by a website to send some data to a user’s device.  Depending on the settings of the device or web browser this data may be stored on the user’s device so that the device can later return that data to the same website.  Cookies can be used with online services, such as websites, email deliveries or advertising technologies, to recognize an Internet or mobile-connected device that they have encountered before.  We use cookies to, among other things, “remember” you, track user trends, and collect information about how you use Customer’s sites or interact with the advertising we (or others) deliver on their behalf. We likewise use cookies to provide relevant content to you and replace non-relevant ads with ads that better match your interests. We also use cookies when you visit our site.

c. Mobile Device Identifiers and SDKs

We also sometimes use, or partner with, Publishers or Publisher-facing and app developer platforms that use mobile SDKs to collect information, such as mobile identifiers (e.g., IDFAs and Android Advertising IDs), and information connected to how mobile devices interact with our Services and those using our Services.  A mobile SDK is the mobile app version of a pixel tag or beacon (see “Pixels,” above).  The SDK is a bit of computer code that app developers can include in their apps to enable ads to be shown, data to be collected, and related services to be implemented.  We may use this technology to deliver certain advertising through mobile applications and browsers based on information associated with your mobile device. If you’d like to opt-out from having ads tailored to you in this way on your mobile device, please follow the instructions in Section 6 (“Your Choices”) below.

d. Third Party Suppliers and Vendors

The Company works with third party technology or service providers that provide us with hosting, serving, general campaign or site analytics, ad serving data, or demographic and other audience data about the use and viewership of our Customers’ advertising, or websites that display such advertising. Such third-party providers may utilize pixels, cookies, flash cookies, web beacons and/or similar technologies that may be activated when our advertising Customers’ advertisement is encountered on a Publisher. In all instances where the use, collection and disclosure of information is by one of these third-party providers, their privacy policies governs and this Privacy Policy does not apply.

e. Disabling Cookies

Most Web browsers are set up to accept cookies. You may be able to set your browser to warn you before accepting certain cookies or to refuse certain cookies. However, if you disable the use of cookies in your web browser, some features of our Services may be difficult to use or inoperable.  In addition, we may use (or work with certain third-party companies that use) techniques other than or in addition to HTTP cookies to recognize your computer or device and/or to collect and record information about your web surfing activity, including those integrated with our Services.  These technologies may rely on the collection and analysis of “non-cookie” information from your browser or device, such as your operating system, plug-ins, system fonts, resolution, and other data, for purposes of creating a unique profile or “fingerprint” of your browser or device.    We (or other third parties) may use this profile to understand and analyze how you interact with the Services, to customize content or advertising to you through the Services, to monitor against fraud or misuse of the Services, or in other ways consistent with this Privacy Policy.  Please note that your web browser may not permit you to block the use of these techniques, and those browser settings that block conventional cookies may have no effect on such techniques.

4. The Business Purposes For Which We Use and Share the Information We Collect

a. Our Purposes Generally

Principally, we use the information described in Section 2 to operate, provide, develop and improve our Services.   This involves facilitating various types of advertising and marketing to make them more effective, more relevant, and more likely to engage and interest consumers.

b. Personalized Advertising

This includes facilitating and providing behavioral advertising, i.e., tailoring advertising and content using the types of “audience segments” or “data segments” (and other, related types of information) we describe in Section 2 above.   As we also describe in Section 2, these audience segments may be based on your activity across multiple websites or mobile apps over time, on your transactions, on your location, or on coded or “hashed” data derived from offline demographic and interest data.  Generally, the tailoring of ads to devices and browsers (and sometimes through other channels) based on this type of data is called “interest-based” or “personalized” advertising. Please go to Section 6 to learn about what choices you have to control how you are marketed to in this way.

c. Other Advertising and Analytics Purposes

We also use the information to analyze, measure the effectiveness of, frequency-cap or sequence advertising.   For instance, we may use the information we collect to compare how many “clicks” the recipients of one ad campaign receive vs. a different ad campaign.  Or, we may track which users have seen which ads, to avoid a user being shown the same ad repeatedly.

d. Syncing Identifiers

We sometimes integrate our information with Partners, to allow Advertisers to access our information across other platforms (and their information across our platform), in order to allow Advertisers to reach more consumers across various channels.  This may include online, offline, social media or television advertising.

e. Identity Graphing

We may also create or help our Customers or Partners to create “identity” graphs, to help locate users across various channels, such as based on common personal, device-based, or network-based identifiers (e.g., IP address).

f. Statistical information

We may use statistical information about you or your devices such as generalized location and estimated age group. We obtain this statistical information from commercially available sources (as permitted by law) such as our third-party service providers. We only work with third-party service providers who ensure that this information has been obtained in accordance with applicable law and can be provided to us for use and disclosure.

g. Other Business Purposes

We also may also use the information we collect for internal research, internal operations, auditing, detecting and preventing security incidents, anti-fraud purposes, debugging, short-term and transient use, quality control, and legal compliance.

5. Why And With Whom We Share the Information We Collect

a. To Provide our Services

Generally, we share the information that we collect in order to perform our Services, including for purposes of targeting advertising, performing analytics on ads, and measuring ad performance.

• We share the information we collect with our Customers, who are a wide range of businesses, retailers, content publishers, non-profit entities, business-to-business service companies and other consumer brands, as well as their ad agencies and service providers.
• We also share information with our Partners and other companies that provide services to us. For example, we use email or other contact information to resolve Customer support inquiries, and IP address and advertising identifiers with service providers.
• We may share personal information we collect with our service providers, which may include providers involved in tech or customer support, operations, web or data hosting, billing, accounting, security, marketing, data management, validation, enhancement or hygiene, or otherwise assisting us to provide, develop, maintain and improve our Services.

b. For Legal Purposes

We may share any information we have with third parties in order to: (a) comply with legal process or a regulatory investigation (e.g. a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts, or to investigate potential violations thereof; (c) protect the rights, property or personal safety of us, our platform, our Customers, our agents and affiliates, our users and/or the public.  We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, spam/malware prevention, and similar purposes.

c. In the Event of a Corporate Transaction

We may also share personal information in the event of a corporate transaction, including, for example, a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.

d. With Corporate Affiliates

We share information within the  RASTRO STUDIO in order to operate our site and Services, perform data analytics, design and execute advertising and marketing campaigns, conduct product management, and/or engineer or improve and develop new products or services.

e. With Partners

We share information collected, including IP address and advertising identifiers, with Partners to assist in our advertising and marketing efforts and show ads that may interest you. The Advertisers we use (including their service providers) may rely on pixel tags and similar technologies to collect information from or about you to tailor advertisements, measure advertising effectiveness, and enable other enhancements. We may also compile and provide reports, including in aggregated or de-identified forms, to Advertisers about the reach, viewership and effectiveness of their campaigns. We use information to help our Customers to reach the desired audience and improve their ad campaigns.

• Summary Analytics and Reports. We may, with our Customers and Partners, analyze Viewing Data to create summary reports to help deliver relevant information and advertising to interested groups of consumers.  These summary reports are built from automated analysis of data elements, without connecting the information to any known natural person.  For example, a Customer who is an Advertiser may want to measure the effectiveness of their promotions in the aggregate.  Thus, a Partner may identify another device that shares an IP address or display and analyze: (a) whether a particular website was viewed or commercial location was visited by a device with location tracking enabled (e.g., a smartphone) after a related promotion was viewed, and (b) whether a particular program was viewed following exposure to a promotion for that program.  In addition, some Partners may use a third-party data aggregator to identify demographic or other attributes or traits (such as gender or age range or income range or behavioral data) associated with the IP addresses collected, and then send to Customers the demographic information associated with those addresses.
• Personalized Advertisements. As further described in Section 2 above, audience segments may be shared with Customers and Partners for the purpose of targeting and tailoring the advertising you see on certain Smart TV and connected devices, including other devices associated with your IP address or device ID on the basis of Viewing Data. Viewing Data may also be enhanced with household demographic data and data about digital actions (e.g., digital purchases, location, and other consumer behavior taken by devices associated with the IP address collected) for the purpose of delivering relevant advertising that are likely to be useful or timely.
• We may work with Google to deliver advertising opportunities to its clients. You can consult Google’s policies to learn more about Google’s processing policies.

f. With advertising measurement providers and services

We share information collected, including IP address and advertising identifiers, with Partners and their service providers in order to help us and our Advertisers understand information about the content and ads viewed, and the effectiveness of ad campaigns, including the audience that saw their ads, how they engaged or responded, determine which programs are most popular, how many people watch a program to its conclusion, and whether and how often people watch commercials.

The measurement providers we use collect or receive information about your viewing of or interaction with content and ads, including ads that you view on your Smart TV and ads you view on other websites, mobile apps, and connected devices (including Smart TVs) to which we provide advertising services. We also share demographics data and audience segments (e.g., food fans, sport enthusiasts, sitcom fans, etc.) with advertising measurement providers and their service providers. Viewing Data may also be combined with other demographic and similar information, including by working with data aggregators.

Measurement providers use such information to create statistics about what content and ads are being watched – for example, to help them and their clients understand the audience viewing the content or ads, and to measure the effectiveness of the ads.

Through our advertising services, we provide measurement and analytics solutions to other companies. In providing these services, we analyze and reorganize ad campaign data from these companies and provide analytics reports to help them better understand the audience that viewed the company’s ads and whether those viewers belong to the same household.

6. Your Choices: How To Opt-Out of Tracking (Interest-Based Advertising) on Web Browsers and Mobile Devices

a. Opting Out of Interest-Based Advertising

We follow the Digital Advertising Alliance industry privacy standards for online behavioral advertising. To learn more about the program and its principles, visit the Digital Advertising Alliance (DAA). We are a member of, and adhere to, the industry standards of the Digital Advertising Alliance of Canada (DAAC). To learn more about the program please visit the DAAC.”We are a member of, and adhere to, the self-regulatory principles of the European Digital Advertising Alliance (EDAA). To learn more about interest-based advertising or to opt-out of this type of interest-based advertising by those third parties that are members of DAA’s opt-out program, please go to https://www.aboutads.info/.

We are a member of the Network Advertising Initiative (NAI), an association dedicated to responsible data collection use in digital advertising.  To learn more about the NAI and its members, or to opt out of interest-based advertising facilitated by NAI members, visit http://optout.networkadvertising.org/?c=1.  You may also opt out of our own interest-based advertising on those same web pages, or you can simply visit our Opt-Out Page. We make no representation about the accuracy or effectiveness of other providers opt out mechanisms, including those listed on the above industry websites.

You can also opt-out of targeted advertising based on data collected via your browser by using  (i) the DAA’s opt-out tool, which can be found here; (ii) the DAAC’s opt-out tool, which can be found here; or (iii) the EDAA’s opt-out tool, which can be found here.

You may always opt out of our targeted advertisements by clicking on the opt-out button on the relevant device. Such opt-out will affect only the device where you have made that selection. After you opt out, we will no longer collect this information to deliver targeted ads on such device. Ads may continue to be served based on information available in the Internet environment, such as the content of a web page, browser type, time of day and operating system. If you have opted out of our advertising cookies and other similar tracking technologies on a device and subsequently delete the “opt out” cookie from your browser on such device, change your browser, or buy a new computer/device, you will need to repeat this process and opt out again. When you opt out, we will stop (a) collecting information about your interests via your browser and (b) serving you targeted advertising based on the data collected via your browser. We will subsequently place a piece of data in your browser’s cookie that tells us that you have opted out – it does not contain any data about you except for the fact that you have opted out. We need this cookie in place so that we know not to collect information about your interests and serve you targeted advertising based on your interests in the future.  Our “opt-out” cookie has a 13-month expiration date.

Anyone who has provided personal contact information through our site may e-mail us at privacyrights@rastro-studio.com to update, delete, and/or correct their personal information.

b. In-App Data Opt-Out

You may opt out of the continued collection of mobile app interest-based advertising through your mobile device settings, as applicable to most (but not necessarily all) mobile devices.   Please go to the NAI “Mobile Choices” web page for further information about how to do this.  When you do this, we will no longer use information collected through your mobile apps to deliver behaviorally targeted advertising to your device. Please note that you will continue to receive advertising after you opt-out, but it may not be tailored to your interests.

c. Viewed Content Advertising and Smart TVs

If you choose to activate this functionality, we may collect certain information on certain Smart TV and connected devices equipped with automatic content recognition (ACR) functionality in order to provide personalized advertising based on the programs or ads being watched on those devices, other devices with the same IP address, or browsers. We refer to the information collected as “Viewing Data” in this Policy. If you have opted-in to activating ACR on such device, the ACR functionality will continuously analyze audio from any onscreen content accessed or displayed on your Smart TV at that moment, including content from any set-top-boxes, media players, gaming consoles, over the air broadcast, or other audiovisual sources playing through your Smart TV.  For more information, see Section 2 above on “Viewing Data”.

The option to enable ACR is presented during the initial setup of the Smart TV and can also be accessed at any time via the Settings of the Smart TV. You can disable ACR at any time via the Settings of the Smart TV. Please refer to the device’s Privacy Notice and the Enhanced Viewing Service Privacy Notice of your Smart TV for more information.

7. Do Not Track

Although certain of our technology honors “do not track” (DNT) signals and similar mechanisms transmitted by web browsers or mobile device operating systems, we are not responsible, and shall not be liable, for the acts of third parties, such as ad networks, with respect to such third parties’ tracking policies. We make no representation about the accuracy or effectiveness of other providers’ opt out mechanisms, including those listed on the above industry websites.

8. Children

Our site and Services are neither developed for, nor directed at, children under the age of 16.  We do not knowingly collect personal information from nor employ or offer targeting towards children under the age of 16.  If you believe your child, who is under the age of 16, has provided us with personal information, please contact us at privacyrights@rastro-studio.com and we will use reasonable efforts to remove that information from our records.

9. Where We Store Personal Data

We are a global company with affiliates, varied business processes, management structures and technical systems around the world. Information that we collect or that is collected on our behalf may be stored on connected devices (including Smart TV) to which we provide advertising or measurement and analytics services, or on our servers, and may be transferred to, accessed from, or stored and processed globally in any other country where we or our service providers maintain facilities or call centers, including jurisdictions that may have different data privacy laws from those in your home country. The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfillment of your order or the provision of support services. We strive to transfer your information where there are appropriate measures and controls in place, and we strive to ensure that all information you provide to us is stored on secure servers.

10. For European Residents: About your GDPR Privacy Rights

If you are located in Europe, you may have certain right under European privacy law, principally the General Data Protection Regulation (GDPR).   This Section of the Privacy Policy is intended solely for, and is applicable only as to, such consumers, i.e., “data subjects”; if you are not an EEA resident (or otherwise located in an EEA country), this does not apply to you and you should not rely on it.

RASTRO STUDIO participates in the IAB Europe Transparency & Consent Framework and complies with its Specifications and Policies. RASTRO STUDIO operates Consent Management Platform with the identification numbers 23 and 36.

a. Our legal bases for using personal information

All organizations need a legal reason to use your personal information. There are a number of legal grounds that enable data processing. Below are the most relevant grounds of which you should be aware.

• With your consent

There are some activities where we process personal information with your consent. For example, where we want to send you marketing messages by email, we would ask your permission first and you could opt out at any time.

• For a legitimate interest

We may use your information where there is a legitimate interest to do so. For example, we may use your information where it would help achieve our business objectives or to facilitate a benefit to you or someone else.  Our legitimate interests in processing personal data include:

• to develop, deliver and maintain relevant and engaging products, services and/or advertising;
• understanding when audiences engage with our Customers’ ads;
• to build a clearer understanding of who our Customer’s audiences are in order to better serve more relevant advertising to those audiences, for the benefit of both individuals and our Customers;
• to maximize advertising revenues for publishers and therefore help to maintain a diverse ecosystem of online independent publishers of content for users to enjoy and educate themselves;
• to support individual and societal rights to receive information;
• to improve user website experience by delivering brand safe, high quality advertising to all of the publishers of online content with which we work;
• to carry on the business of a commercial organization;
• to demonstrate that we provide services and products to agreed industry standards; and
• sharing information with the RASTRO STUDIO companies for analysis, audience insights, business efficiencies, content personalization and to deliver relevant advertising.
• To comply with legal obligations

There may be situations where we need to use your information to comply with legal and regulatory obligations or to defend claims.

b. Exercising Your Data Subject Rights Under the GDPR

If you are a resident of the European Economic Area, you have the following data protection rights:

• If you wish to access, correct, update or request deletion of your personal data, you can do so at any time by contacting us at privacyrights@rastro-studio.com or you may visit our Manage User Data page, where you may make an “access” or “right to know” request, or request that we “opt out” your personal information from our active database.
• In addition, you can object to the processing of your personal data, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us at privacyrights@rastro-studio.com
• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us at privacyrights@rastro-studio.com.
• Similarly, if we have collected and process your personal data with your consent, then you can withdraw your consent at any time, by contacting us at privacyrights@rastro-studio.com or (as to information that we use in our Services), by going to [your data page].  Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

External EU and UK Data Protection Officer

ePrivacy GmbH

represented by Prof. Dr. Christoph Bauer

Burchardstraße 14, 20095 Hamburg, Germany

For all request concerning the security of your data you can contact our privacy team and data protection officer at privacy@rastro-studio.com.

If you have a particularly sensitive request, please contact our data protection officer by postal mail. The communication by email can always be flawed by security gaps.

11. Updates to this Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

12. Data Retention

Personal information we collect may be retained for as long as needed to fulfill legitimate business purposes. The Company expires certain cookies, including cookies directed to European users, after 12 months. Except as permitted by law, we may retain aggregated and anonymized user information (e.g., to create group-level data), for an indefinite period but usually no more than 2 years.

13. Information Security

We take measures to protect against unauthorized access to or unauthorized alteration, disclosure, or destruction of data we collect and store.  These may include internal reviews of our data collection, storage, firewalls and processing practices and security measures.  Of course, no security system is perfect.   Thus, while we do take measures to safeguard against unauthorized access to, or alteration of data we collect and store, we cannot guarantee that it will not be disclosed or accessed inadvertently or through the unauthorized acts of others.

14. California “Shine the Light” Law

California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits California residents to request and receive, once per calendar year and free of charge, information about our sharing of your personal information (if any) with third parties for their own direct marketing use.  We do not share the information subject to that law for those covered purposes.   For information about other California privacy rights you may have, please see the below sections.

15. Privacy Rights and Information for Residents of California and Other Applicable States

The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to residents of California. Other states’ laws (upon becoming effective) provide similar (though not identical) rights to their own residents – including residents of Colorado, Connecticut, Utah and Virginia (“Other Applicable States”).  This Section of the Privacy Policy applies if you are a natural person who is a resident of one of those states, or of California (“California Consumer”), when we act in the capacity as a business or controller as defined by the laws of such states.   This Addendum supplements the information and disclosures in the Privacy Policy for residents of those states that recognize these particularized rights.

The following sets forth the categories of information we collect and purposes for which we may use Consumers’ personal information. (Examples provided for each category are merely examples found in the statute, and do not indicate that we necessarily collect that type of information or identifier.)

• Our Collection of Consumer Personal Information

Depending on how you interact with us, we may collect about you the categories of information summarized in the table below. The following table also describes how we collect and use such categories of information.  We do not knowingly collect consumer information deemed “sensitive” under the CCPA, such as information that reveals race, religion, ethnicity, sexual orientation or information about specific medical conditions.

• Our Disclosure, Sale and Sharing of Personal Information 

We may share and sell the information collected from and about you as discussed above for various business purposes, with service providers and with third parties including our Customers, advertising platforms, and those advertising platforms’ customers.  These business purposes often involve cross-context behavioral advertising, also known as “targeted” advertising.

The table below describes how and with whom we share or disclose personal information, and whether we believe we have “sold” or “shared” a particular category of information in the prior 12 months.   “Sharing” information is a concept defined under California privacy laws (but not necessarily other states’ privacy laws) and includes using (or permitting others to use) the information we collect for cross-context or “targeted” advertising.  (In our case – because we often earn money in exchange for making available information for advertising purposes – we may be involved in both a “sale” and a “share” of that information.)

For maximal transparency, we have been deliberately inclusive in our terminology, by including within categories both types of third parties (e.g., “retailers”) and types of platforms through which those third parties might access data (e.g., “advertising networks”). We reiterate that examples provided for each category are merely examples found in the statute, and do not indicate that we necessarily sell, disclose, and/or share that type of information or identifier.

Please see the below sections to learn the purposes for which we collect and share personal information.

• Our Business for Selling and Sharing Personal Information

• We collect and share the personal information that we collect for the below purposes, as we also have described in our Privacy Policy and/or our website.  Online targeting, for example: Creating or helping to create defined audience segments based on common demographics and/or shared (actual or inferred) interests or preferences (e.g., households with prospective students).  These audience segments may be based on the collective website behavior of consumers and indicate whether a consumer is likely to want to make a particular type of purchase or engage in a particular type of commercial behavior.   We also sometimes work with a data partner that “matches” our or other Information through coded identification techniques (such as through coded data “hashing”) with online cookies and other identifiers to target and measure ad campaigns online across various display, mobile and other media channels.We also create or assisting customers in creating or enhancing “identity” graphs to help locate consumers across various channels, such as based on common personal, device-based, or network-based identifiers (e.g., IP address, email address)We also use the personal information we collect or receive online to provide related services, such as for measuring the effectiveness of and otherwise analyzing ad campaigns.  We use personal information for other internal purposes, for example: For internal research, internal operations, auditing, detecting security incidents, debugging, short-term and transient use, quality control, and legal compliance.We sometimes use the personal information collected from our own website, from social networks, from other “business to business” interactions (such as at trade shows) or from data compilers for the above purposes, as well as for our own marketing purposes. We also may share any of the personal information we collect for other legal, corporate or operational purposes. Sharing for legal purposes.  For instance, we may share personal information with third parties in order to: (a) comply with legal process or a regulatory investigation (e.g. a subpoena or court order); (b) enforce our Terms of Service, legal rights, this Privacy Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; and/or (d) protect the rights, property or personal safety of us, our platform, our customers, our agents and affiliates, its users and/or the public.  Sharing to prevent consumer harm or fraud.  We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, spam/malware prevention, and similar purposes.Sharing for purposes of a corporate transaction.  We may also share personal information in the event of a major corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.Sharing With Service Providers: We share any personal information we collect with our service providers, which may include (for instance) providers involved in tech or customer support, operations, web or data hosting, billing, accounting, security, marketing, data management, validation, enhancement or hygiene, or otherwise assisting us to provide, develop, maintain and improve our services.  Sharing of Aggregate Information:  We may aggregate and/or de-identify any information collected so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including, without limitation, for research and marketing purposes, and we may also share such data with any third parties, including advertisers, promotional partners, and sponsors, in our discretion.
• Our Retention of Information

We retain personal information as a “business” or “controller” under applicable state privacy laws if it is relevant and useful for purposes of our products and services or we have a legal or compliance reason to do so, and provided the information is not subject to a valid request for deletion.  (We may retain information after deletion where legally permitted or required for a legal compliance, auditing or accounting reason.)

• Your Privacy Rights and Choices

As noted above, residents of certain U.S. states have particular privacy rights, including residents of California and (upon various “effective” dates occurring during 2023) Colorado, Connecticut, Utah and Virginia (“Applicable State Residents”).  The scope and nature of these rights vary in each state, so we have sought to explain these rights in the most transparent and uniform terms, below.

Without being discriminated against for exercising these rights, California residents, as well as residents of the Applicable States, have the right to request that we disclose what personal information we collect from you, to delete that information, and to opt-out of the sale of your personal information, subject to certain restrictions.  If you are a resident of such a state, you also have the right to designate an agent to exercise these rights on your behalf (so long as your state of residence continues to recognize that right).

This section describes how to exercise those rights and our process for handling those requests.  (To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.)

We may withhold these rights to the extent that the law in your state of residence does not recognize or no longer recognizes these rights.

Note that sometimes, we act only as a “service provider” or “processor” to our customers (for instance, if they provide information to us solely to use our marketing or data management tools), in which case any consumer requests for opt-out, deletion or access to data must be made through that client: we therefore will forward any such requests to a named client, where feasible.

a. The right to access, correction and disclosure 

You may have the right to request, twice during a twelve-month period, the following information about the personal information we have collected about you during the past 12 months:

• the categories and specific pieces of personal information we have collected about you;
• the categories of sources from which we collected the personal information;
• the business or commercial purpose for which we collected or sold the personal information;
• the categories of third parties with whom we shared the personal information; and
• the categories of personal information that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose.

You also may request correction of your personal information, such as if you believe we have incorrect information pertaining to you.

b. The right to deletion 

You may have the right to request that we delete the personal information we have collected from you.  Certain information may be exempt from such requests under applicable law.  We need certain types of information so that we can provide our Services to you, and may retain certain information for important business purposes, such as fulfilling our legal obligations, or for security, auditing or de-bugging purposes.

c. How to exercise your access and deletion rights

California residents and residents of Other Applicable States may exercise their access or deletion rights by accessing our “Manage user data” page or by sending an email to privacyrights@rastro-studio.com.

For security purposes, we will verify your identity – in part by requesting or automatically capturing certain information from you — when you request to exercise your applicable privacy rights.  For instance, you may need to provide your email address. To request that we provide you with the specific pieces of personal information we have from you or to delete personal information we have collected from you, we may also need to ask you for additional information to verify your identity.  Once we have verified your identity (and your agent, as applicable), we will respond to your request as appropriate.

• Where you have requested the categories of personal information that we have collected about you, we will provide the information you have requested, except where not permitted under applicable law or otherwise exempted by the CCPA or other applicable law.
• Where you have requested specific pieces of personal information, we will provide the information you have requested, except where not permitted under applicable law or otherwise exempted by the CCPA or other applicable law.
• Where you have requested that we delete personal information that we have collected from you, we will delete any information about you that is not necessary for the purposes indicated above or another permissible business, security or legal purpose.  Certain information may be exempt from such requests under applicable law.

If we are unable to complete your requests fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request.

d. The right to nondiscrimination

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.

e. The right to “opt-out” of the sale of your personal information 

You have the right to opt out of the “sale” of your personal information.  California law (for instance) broadly defines sale such that it may include, for example, allowing third parties to receive and use certain information, such as cookies IP address and/or browsing behavior, to deliver targeted advertising.

If you wish to “opt out” of our “sale” of your information, i.e., for purposes of personalized advertising, we recommend employing the options we provide and explain in Section 6.   However, you may also visit the interactive form that we make available at to exercise your data subject rights https://yourdata.rastro-studio.com

f. Authorized Agent

You may also designate an agent to make requests to exercise your rights, where applicable state law (such as the CCPA) permits you to do so.   In such case, we will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a validly executed power of attorney.

g. Right to Appeal

In some states you have a right to appeal our decision about how or whether we honor your privacy rights request(s).  In the event that we inform you that we will not, or believe we cannot, honor a particular consumer request (for instance, if we have determined we cannot verify your identity, or if we believe you are not entitled to the scope of deletion you request), and you live in such a state, you may appeal our determination by emailing us at privacyrights@rastro-studio.com. Opt-out of sale requests are often effectively accomplished through automated suppression methods, either by a consumer causing another website (such as a content publisher) to avoid selling browser-related data, or by deploying our opt-out cookie located at https://yourdata.rastro-studio.com as well as on various industry opt-out pages.  Opting out in these ways causes data associated with a consumer’s device to be effectively disassociated from their device and/or suppressed from usage.

Annual Data Requests

The table below sets forth additional privacy disclosures with respect to our processing of data subject rights requests. Between January 1, 2023 and December 31, 2023, across the United States, we processed the following data subject requests of consumers:

*Data subject could not be verified. 
** Indicates maximum response time based on fulfillment across all states. 

Texas Data Broker Disclosure:

THE ENTITY MAINTAINING THIS WEBSITE IS A DATA BROKER UNDER TEXAS LAW. TO CONDUCT BUSINESS IN TEXAS, A DATA BROKER MUST REGISTER WITH THE TEXAS SECRETARY OF STATE (TEXAS SOS). INFORMATION ABOUT DATA BROKER REGISTRANTS IS AVAILABLE ON THE TEXAS SOS WEBSITE. https://www.sos.state.tx.us/index.shtml

16. How to Contact Us

If you have any questions, concerns or requests please contact us by email at privacyrights@rastro-studio.com or +1 323 405 11 44