PRIVACY POLICY – SERVICES

PRIVACY POLICY FOR KARGO GLOBAL, INC.

1. Introduction to Our Services Privacy Policy

Kargo is committed to transparency concerning its data practices.  Our goal is to provide you with clear and meaningful information on the data we collect, use and share and make sure you understand and can exercise your rights concerning your personal data.

This privacy policy (“Policy”) describes how Kargo Global, Inc. (“Kargo”, “we,” “our,” or “us”) collects, uses, and discloses information, which may include personal data or personal information protected by applicable laws, in connection with our services related to digital advertising (“Services”). This Policy also describes the choices you can make about the information we collect in connection with the Services. This Policy does not describe how we collect and use information from our corporate websites, such as Kargo.com. For information on how Kargo uses information collected from our corporate websites, please click here: https://kargo.com/websiteprivacy.

As part of its commitment to consumer privacy, Kargo is a member of the Network Advertising Initiative (NAI) and adheres to the NAI Code of Conduct.  Kargo also adheres to the Digital Advertising Alliance (DAA) Self-Regulatory Principles.  In addition, Kargo has implemented and follows the specifications and policies of the IAB EU Transparency & Consent Framework (TCF) as part of our compliance with EU data protection law. See https://iabeurope.eu/tcf-2-0/ for more information. Kargo’s vendor identification number within the TCF is 972.

2. Introduction to Kargo

When we refer to “Kargo,” “we,” or “us” in this Privacy Policy, we mean the Kargo entity that acts as the controller or processor of your information, as explained in more detail in Section 6 below.

Through its Services, Kargo facilitates the buying and selling of digital ads for our business partners, which include advertising partners, brands, advertising agencies, marketing companies, and online publishers (“publisher partners”). The collection, use and sharing of data may enable these partners, using the Services, to conduct interest-based advertising. Interest-based advertising involves showing you ads on the websites you visit that may be of interest to you based on your browsing history.  Ads will appear on the websites you visit whether or not the ads are interest-based.  Digital publishers of all sizes, from bloggers to international news organizations, rely on advertiser revenue to support their content.  Click here to learn more about interest-based advertising. Alternatively, we may use previously collected data to predict the types of ads that we believe visitors to websites may be interested in, so that we can display relevant ads without needing to use data relating to the current visitor. We also provide a range of related services to our customers, including measurement of ad performance, media strategy, or brand surveys.

3. Information We Collect

Our goal is to provide you with relevant, engaging advertising content in a way that respects your right to privacy. As described below, we deliver the Services using device data and browsing history. We do not collect or know your name, address, email, date of birth, phone number, or other personal identifying information unless you choose to provide it to us (e.g., if you contact us with an inquiry).

Through the Services, we collect information that allows us to make inferences about your interests for advertising purposes.  This data may constitute personal information or personal data protected by applicable laws. Collecting the types of information described below allows us to work with our business partners to show you interest-based advertisements and to measure the success of those advertisements.

Technical Identifiers We use certain types of technical identifiers to identify your device, including:

• Kargo-developed proprietary identifiers

• Cookies (small text files)

• Mobile advertising identifiers (such as Apple IDFA and Google AAID)

• IP address 

• Non-personal data inferred from an IP address or other technical identifier, such as non-precise geo-location data, which may include inferred longitude/latitude 

• Device-related data such as phone-type, browser, operating system, connection type.

Online Behavioral Information We collect information about your online browsing activity to determine what types of activities and products you may be interested in. This includes:

• Websites and content viewed 

• Mobile applications used

• Dates and times of visits to partner websites

• Engagement with advertisements (e.g. views, clicks, whether a full video was viewed)

• Survey responses

Client and Partner IDs Our clients and business partners sometimes create technical identifiers for their own purposes. We may use information from different sources to associate these identifiers with additional information.

Location Information We may collect and process information about your general location. The information we collect may tell us which country, city or zip code you are in, but it does not tell us your precise location.

De-Identified Information Kargo may use de-identified information to support our interest-based advertising activities. We do not retain any personal information connected with the de-identified information.

You do not have to provide any personal information to Kargo, and if you previously consented to providing the data, you can manage your data choices as set out in Section 8 below.

If you opt-out of providing personal data, you will still see advertising on webpages you visit. Without the use of your data, any advertising delivered on our Services may be less relevant to your interests.

4. How We Collect Information

To collect the information described above, we and our business partners may use cookies, which are small text files that online services often store on device hard drives or mobile devices of visitors to their sites. A cookie contains a unique number, which is used to recognize your device when a user of your device returns to a website that it has visited previously.

We use cookies to enable us and our business partners to present you with more relevant advertising by collecting information about your online activities over time and across our business partners’ websites and mobile properties, from which we may be able to infer the topics, products and services that may interest you. We also use cookies to collect information about how visitors use and access our business partners’ websites and mobile properties and to develop reports on website usage on an aggregate basis.

You can find out more information about cookies at https://www.allaboutcookies.org/

In addition to cookies, we use local web storage on the browser that is used to access our publisher partners’ websites.  Local storage, like cookies, is contained on the browser you are using when you see a Kargo advertisement on our publisher partners’ websites. Like cookies, the browser or window type (e.g., private browsing) you utilize on your device may restrict the data that can be stored and the length of time it persists.

5. How We Use the Information We Collect

We may use the information we collect to:

• deliver or enable our advertising partners to deliver personalized messages that match your interests, including interest-based advertisements, or to predict the types of ads that visitors to certain websites may be likely to find of interest;

• understand the interests of our publisher partners’ users;

• customize user experiences when they use our advertising partners’ services;

• generate and analyze reports and statistics about the performance of advertising campaigns, and improve performance over time, for our business partners and for our own use, including through brand surveys;

• fulfill the purposes described to you at the point of collection or in accordance with your consent.

We may combine or aggregate any of the information we collect through our Services for any of these purposes.

6. Information of EU Area Users

If you are located in the European Union, European Economic Area, Switzerland or the UK (referred to in this policy as the “EU area”), and your information is subject to applicable EU area laws.  Kargo’s legal basis for processing your personal data depends upon the specific context in which we collect or use it. For EU area users, Kargo uses the IAB Europe Transparency and Consent Framework (TCF) as one mechanism for establishing our legal basis. The TCF is designed to allow a publisher to present information and choices to users about third-party vendors, like Kargo, that process data based on you accessing the publisher’s content. The TCF will display information about the purposes for which Kargo processes data and allow you to make choices with respect to those purposes. You can change your preferences at any time as set out in Section 8 below.

In addition, we may use information that we collect when we believe in good faith that disclosure is necessary (a) to protect our rights, the integrity of our Services, or your safety or the safety of others, or (b) to detect, prevent, or respond to fraud, intellectual property infringement, violations of Terms of Use related to the Service, or violations of law. For EU area users, our legal basis for use of information under these circumstances is the legitimate interest of Kargo or our business partners.   Such use is compatible with your legal rights, as no additional personal information is processed, and there is no effect on your web or app experience, or other intrusive processing.

Kargo may act as a “controller” as defined under applicable law when processing your personal data. We may also act as a “processor” as defined under applicable law to the extent that we receive your personal data from, or collect or process your personal data on behalf of and at the instruction of another party, for example a publisher or an advertiser.

7. How We Share the Information We Collect 

We may share information we collect in connection with the provision of our Services for purposes that include but are not limited to the following:

• with our advertising partners and technical service providers to enable our advertising partners to deliver personalized messages that match your interests, including interest-based advertisements. These include:

  • providers of IT-related services (e.g. data storage, hosting, management, or maintenance)

  • data analytics providers (e.g. measuring which advertisements receive the most views, clicks or sales, or categorizing data into interest groups)

  • advertising technology companies (e.g. data management platforms, demand side platforms, or ad-servers);

• with our affiliates, representatives and advisors around the world who are involved in the provision of the Services and performing and enforcing our contracts and terms of service;

• with our business partners, such as web publishers, advertisers or advertising agencies, for the purposes described in this Policy;

• as required by law, such as to comply with a subpoena or other legal, regulatory or law enforcement process, or to comply with government reporting obligations;

• when we believe in good faith that disclosure is necessary (a) to protect our rights, the integrity of our Services, or your safety or the safety of others, or (b) to detect, prevent, or respond to fraud, intellectual property infringement, violations of Terms of Use related to the Service, or violations of law;

• with affiliates, service providers, advisors, and other third parties to the extent reasonably necessary to proceed with the negotiation or completion of a merger, acquisition, or sale of all or a portion of our assets.

For users in the EU area and the UK, your information will be stored in the United States, and our affiliates and technical service providers outside the EU area and the UK may have access to information in order to assist us in providing our Services. In each case, we have in place safeguards that enable these transfers to happen in a way that ensures that the information is handled in accordance with our instructions and using similar standards to those applicable in the EU area and the UK. These safeguards may include standard contractual clauses for data exports as approved by the European Commission or other supervisory authorities. A copy of these documents may be made available if we receive a valid request.

Subsequent to the exit of the UK from the EU, we intend to continue to transfer personal data from the UK to the EU and the European Economic Area (“EEA”). When our Services involve transfers of personal data out of the EEA or the UK to a jurisdiction that is not the object of an EU or UK “adequacy” decision, then we will rely on the Standard Contractual Clauses issued by the European Commission or UK or other relevant authority.

In order to operate our business efficiently, we have to store and process transferred personal data in the United States, the UK, the EU and/or any other country where our partners, processors or subprocessors maintain facilities. We will only do so as long as those partners, processors and subprocessors transfer data via a valid legal mechanism such as the European Commission Standard Contractual Clauses which commit them to similar data protection standards as in the EU and the UK.

8. Your Choices About the Information We Collect

You are able to exercise control over the use of information collected by Kargo to serve you interest-based advertisements. These tools are browser-specific, so you should repeat this process for each browser that you use.

You may opt out of or withdraw your consent for our use of information collected for interest-based advertising purposes by using one of the “opt out” procedures described below:

Browser Opt-out: If you prefer not to see targeted ads via interest-based advertising from our platform on mobile websites, you may opt-out of or withdraw your consent for such interest-based advertising from Kargo by clicking “Click to Opt-Out” below to place an opt-out cookie on your device, if your device accepts such cookies. Kargo will set this opt-out cookie for a period of at least ten (10) years, unless you reset your device or clear your cache or cookies as set forth herein. This opt-out requires that you have cookies enabled and will need to be repeated if cookies are cleared on your browser (which can happen if you clear your browsing history or re-install your browser). This opt out cookie can also be impacted by browser technologies that impact the ability of javascript cookies to persist in your browser. In the event the browser resets your cookie, your cookie opt out might not persist for as long as our technologies attempt to place. But in this case, please note that your browser is attempting to utilize native privacy features.

Even if you opt out, you will still see advertising on the web pages you visit. However, such advertising may be less relevant to your interests.

You also may opt out of or withdraw your consent for our use of information collected for interest-based advertising purposes on mobile websites and have an opt-out cookie placed on your device if your device accepts such cookies by visiting either one of the following industry-developed sites and selecting Kargo:

• Digital Advertising Alliance Consumer Choice Page: www.aboutads.info/choices.

• Network Advertising Initiative Consumer Choice Page: www.networkadvertising.org/choices.

Please note that all of the options provided in this policy are browser-specific, so you should opt out on each device and browser for which you would like your preferences to apply. These tools also use cookies and cached files to record your preferences. If you delete your cookies or clear your browser cache, you may have deleted your opt-out status and may need to opt out again.

App Opt-Out: You may select a system level advertising preference feature on your device and Kargo will honor this preference to opt out your device from interest-based advertising in apps. On Apple iOS devices, this system level advertising preference may be accessed via Settings – Privacy – Advertising – Limit Ad Tracking. On Android devices, open the Google Settings app from your app drawer or from your operating system’s settings menu, tap Ads, and select “Opt-out of Interest-based ads.”

9. Other US State Laws

Consumers who are resident in US states such as California, Colorado, Virginia, Connecticut, or Utah may have additional rights under state privacy legislation which defines personal information more broadly, ensures greater transparency and accountability and provides consumers with extended rights as to the collection and use of their personal information.

Your rights under US State Privacy Laws:

If you are resident in one of the states where specific privacy legislation is in effect then, depending on the particular provisions of applicable local laws, you may have some or all of the following rights:

• Right to correction: Consumers have the right to request a business that possesses inaccurate personal information about the consumer to correct such inaccurate personal information, taking into the account the nature of the personal information and the purposes of the processing of the personal information.

• Right to notice: Businesses must inform consumers at or before the point of collection what categories of personal information will be collected and the purposes for which these categories will be used.

• Right to access: Consumers have the right to request that a business disclose the categories of personal information collected; the categories of sources from which personal information is collected; the business or commercial purpose; the categories of third parties with which the business shares personal information; and the specific pieces of personal information the business holds about a consumer. If a business sells personal information or discloses it for business purposes, consumers have the right to request the categories of information so sold or disclosed.

• Right to opt out: Consumers have the right—at any time—to direct businesses that sell or share personal information about the consumer to third parties to stop such sales or sharing, known as the right to opt out. If a consumer is a minor, this becomes a right to opt in to the sale or sharing of data (exercised by the minor if the consumer is between 13 and 16 years of age, or by the minor’s parent or guardian if the consumer is under 13 years old). Businesses must wait at least 12 months before asking consumers to opt back in.

• Right to request deletion: Consumers also have the right to request deletion of personal information, but only where that information was collected from the consumer. Like the right to erasure under the GDPR, this right is subject to exceptions. For instance, businesses need not delete personal information necessary for detecting security incidents, exercising free speech, protecting or defending against legal claims, or—in what is potentially a broad and likely contentious category—for internal uses reasonably aligned with the consumer’s expectations.

• Right to limit use of sensitive information; Consumers have the right to restrict a business’s use of sensitive personal information e.g. to use that is necessary to provide goods or services requested, to certain business purposes, or other legally permitted purposes.

• Right to equal services and prices: Businesses must not discriminate against consumers by denying goods or services, charging a different price or rate for goods or services, providing a different level or quality of goods or services, or suggesting that they will do any of these things based upon a consumer’s exercise of any of their legal rights relating to their personal information. Put differently, consumers have a right to equal services and prices.

Exercising your rights under US state laws:

If you want to make a request for exercise of any of the above rights, you (or your authorized agent) can write to privacyinfo [at] kargo.com and we will respond within 45 days as per the law.

If you make such a request, including through an authorized agent, we reserve the right to verify your identity and the agent’s authorization.

However, we may not be able to respond to your request if it is not permitted or foreseen under applicable law.

(Please note that we do transfer personal information collected through our network of partners to third parties and as such are considered as having disclosed or sold or shared data over the past twelve months. Please see Section 10 below for more information).  

10. Additional Information for California Consumers

10.1. Personal Information Collected in the past 12 months

10.2. Personal Information Sold or Shared in the past 12 months

We have sold and/or shared the following categories of Personal information in the past 12 months: (a) Identifiers; (b) Commercial information; (c) Internet or other electronic network activity information; (d) Geolocation Data; (e) Inferences; and (f) Sensitive Personal Data.

Such information is contained in audiences or profiles that we provide to our clients.

10.3. Personal Information disclosed for a business purpose in the past 12 months

We have disclosed the following categories of Personal Information for a business purpose in the past 12 months: (a) Identifiers; (b) Commercial information; (c) Internet or other electronic network activity information; (d) Geolocation Data; (e) Inferences; and (f) Sensitive Personal Data.

These business purposes comprise: 

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.

• Helping to ensure security and integrity.

• Debugging to identify and repair errors that impair existing intended functionality.

• Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf.

• Undertaking internal research for technological development and demonstration.

Undertaking activities to verify or maintain the quality or safety of our Services, and to improve, upgrade, or enhance our Services.

11. Your EU Area Rights

If you are an EU area user and your information is subject to applicable EU area laws, you have additional rights in relation to information that we process about you. These rights include:

• to ask for access to the data

• to ask for errors in the data to be corrected

• to ask for the data to be erased (the “right to be forgotten”)

• if not erased, then to ask us to restrict processing of the data

• to object to its processing for specific purposes

• to ask for a copy of the data to take to another service provider (“data portability”)

Where we process any information based on consent that you have previously given, you are permitted to withdraw your consent at any time (though the processing that took place before withdrawal will still be legal). You may withdraw consent by (1) managing online choices as set out above; or (2) visiting the websites where you have previously indicated your consent.

As indicated above, Kargo does not process contact or ID information such as names or emails. Therefore, unless you provide us with a relevant technical ID from your device, while we will always investigate any request thoroughly, it may be impossible for us to know whether or not we are processing any information relating to you. In these cases, we normally take the approach that it is more protective for you to use the systems referred to above that enable you to directly manage your online choices and cookie settings, and not to ask you for (and then to process) additional information about you in order to investigate such a request. 

We are always available through the contacts in Section 15 below to help resolve any issues or questions in relation to processing of your information. If you believe that your rights have not been respected then you are also entitled to make a complaint to the Supervisory Authority or Personal Data Protection Authority in your country to ask them for a resolution.

12. Users Under 16 Years Old 

Kargo does not knowingly collect personal information from users under 16 years old. If you become aware that Kargo may have collected information from a user under 16 through the Services, please contact us (see Section 15) and we will take steps to delete such information. 

13. Security

We strive to maintain reasonable administrative, technical, and physical safeguards designed to safeguard the information we collect from unauthorized access, corruption or loss. In general, information is kept in pseudonymous form (i.e. you cannot be personally identified from it without additional data) and we apply security measures such as password protection and Transport Layer Security technology (TLS). 

14. Information Retention

We retain information collected for interest-based advertising purposes for up to eighteen months from the date of its collection, unless you reset your device or clear your cache or cookies as referred to above. 

If we need to keep your information longer than eighteen months for reporting, accounting, regulatory or legal reasons, then we will retain it only for as long as necessary under the applicable laws, policies or agreement and will use the information only for the purpose for which it was retained.

We retain personal data of business contacts for 3 years from your latest purchase or contact with us. Personal data may be, wholly or in part, retained for a longer or shorter-term if required by applicable law or if there is another justified reason to retain or delete them (e.g. for recordkeeping purposes or in line with limitation periods for legal actions). In those cases, your personal data will be erased without delay after there is no longer any need for such retention.

15. Request for Information Disclosures

Reporting period Jan. 1 2020 - Dec. 31 2020

From Jan. 1 2020 - Dec. 31 2020, Kargo Global Inc. received a total of four (4) requests via the contact information listed in section 15. These requests can be categorized as deletion requests or information requests. Two (2) requests can be categorized as deletion. Two (2) requests can be categorized as information. While no specific requests were made to opt out via direct contact, Kargo provides an opt out link on this page and via the NAI as mentioned in section 1. In the cases of all requests in 2020, we issued a response to the data subject within an average of 6 days (median of 5 days). A member of the team responded to these requests either in the context of requesting more information to verify the identity of the data subject, or providing the data subject a link to an online portal where they could view additional information within their browsers which may be utilized by Kargo technologies. In all cases of the requests in 2020, Kargo did not receive a further reply after our initial response from the data subject.

16. Changes to This Policy

We may update this Policy from time to time to address changes in the Services, changes in the laws or regulations, or for other reasons. If we update this Policy, we will notify you by posting a new Policy on this page. If we make a change that materially affects the way in which we use or share the information previously collected from you through our Services, we will not apply that change to information collected prior to the date of the change.

17. Contact Us

If you have any questions about this Policy or our use of your information, please contact us by email at privacyinfo@kargo.com, or by mail at Kargo Global, Inc., 826 Broadway, 4th Floor, New York, NY 10003, Attn: Legal. We welcome your questions and feedback.

Our representative in the EEA is Kargo Media Ireland Limited, of ArcLabs Research and Innovation Centre, Carriganore, Co. Waterford, Ireland.

This Policy was last updated on November 28, 2023