We collect data from providers and from customers through secure transfer protocols.
The PADDLEWAVER Product provides software and data to companies and publishers (our “Customers”) and also receives data directly from Customers through secure server-to-server feeds. The Mobile Product includes data about mobile devices.
PADDLEWAVER follows the Network Advertising Initiative (NAI) Code of Conduct. To learn more about the NAI or how to opt out of receiving targeted advertising from third party services that belong to the NAI, please visit their website.
By actively opting-in to share data with us and the mobile apps in our network, you’re consenting that we can process your data to enable and improve our marketing and advertising services.
Our Customers integrate our Mobile Product into their mobile applications or send it to us directly via a secured server-to-service transfer. This enables us to receive the information described below, consistent with the authorizations you have provided, concerning the mobile device and/or the use of the mobile application.
Data We Collect
- Precise Location Data – By opting in to share your location data, the Mobile Product allows us to collect information regarding your location, or the location of your device, by using GPS coordinates provided by your mobile device. The GPS coordinates are collectively referred to herein as “Location Data.” Some of our Customers may also enable collection of background location data when the app is not in use, which enables us to also receive this Location Data. Most GPS-enabled mobile devices can identify a user’s location to within less than 50 feet. For some U.S. based devices that share location, we are able to infer a home or work location based upon frequent usage patterns. PADDLEWAVER stores Location Data, and Location Data is passed through to our Customers, service providers and partners, including ad networks, ad serving companies and third party information providers, as described below.
- Automatically Collected Information; Other Personally and Non-Personally Identifiable Information. When you opt-in to data sharing while using any of our Mobile Products by agreeing to share location with a Customer’s app, our web server automatically collects limited information about your device. PADDLEWAVER logs information including the mobile advertising ID (IDFA / AdID), IP address, SSID/BSSID, the type of mobile device you use, the IP address of your mobile device, and your mobile operating system. If you opt-out of location sharing, PADDLEWAVER does not receive any of your data.
- International Data Collection – PADDLEWAVER stores and processes information collected from our SDK and data feeds in the United States and the EU. For all data we collect, you have explicitly consented to its collection and transfer to PADDLEWAVER. If you would like to opt out of data collection, you may do so at any time pursuant to your rights in the US under CCPA and in the EU under GDPR.
- Browser-Level Information: When you browse our Website, our web server automatically collects limited information about your computer configuration or device or, such as the type of browser software you use and the operating system you’re running and your IP address.
- PADDLEWAVER logs Personally and Non-Personally Identifiable Information including IP address, profile information, browser type, browser language, referring / exit pages and URLs, platform type, number of clicks, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, from users and visitors to the Website and the type of mobile device you use, the IP address of your mobile device, your mobile operating system, and the type of mobile browsers you use. This data is used to manage our Website, including diagnosing problems with our Website, track usage and improve the Website. User IP addresses are recorded for security and monitoring purposes.
General Information About Cookies
A cookie is a text file containing an identification number which, when the website is used, is transmitted to the user’s computer together with the other data actually requested and stored there. The file is kept there for later access and serves to authenticate the user. Since cookies are only simple files and not executable programs, they do not pose any danger to the computer.
Cookies that are already active can be deleted at any time via the settings of your internet browser or other software programs. We may work together with advertising partners who help us to make our online offer more interesting for you. In this case, cookies from partner companies may also be stored on your hard drive when you visit our website (cookies from third parties).
Privacy of CHildren
Protecting the privacy of children is especially important. For that reason, PADDLEWAVER does not knowingly collect any Personal Information from anyone under the age of 16. In no other way do we knowingly collect or maintain personally identifiable information from persons under 16 years of age, and no part of our Mobile Product is directed to persons under 16. If PADDLEWAVER learns that Personal Information of persons under 16 years of age has been collected through its Website or a Mobile Product, then PADDLEWAVER will take the appropriate steps to delete this information and to flag the device to prevent any future data collection.
Disclosure and Sharing of Information and Data Retention
We store your data:
- if you have consented to the processing, at most until you revoke your consent;
- if we need the data for the execution of a contract, at most for as long as the contractual relationship with you exists;
- if we use the data on the basis of a legitimate interest, at most for as long as your interest in deletion or anonymization does not outweigh the data;
- insofar as statutory storage obligations exist, until the end of the storage periods.
We may disclose and/or sell your location data to third parties for the purposes of providing targeted advertisements and information our advertising partners believe may be of relevance and interest to you; these third parties include but are not limited to:
- Advertising/marketing companies;
- Advertising networks, exchanges, and related services;
- Automotive companies;
- Business services/agencies;
- Business-to-business companies;
- Consumer packaged goods companies;
- Marketing data companies;
- Data analytics providers;
- Consumer data aggregators;
- Educational institutions & companies;
- Financial services companies;
- Food & beverage companies;
- Gift product companies;
- Lifestyle & interest product companies;
- Not for profit organizations;
- Travel, leisure, & entertainment companies;
PADDLEWAVER shares data with third parties based upon use cases set forth by the Interactive Advertising Bureau’s Transparency and Consent framework. Those use cases include:
- Information storage and access
- Ad selection, delivery, reporting
- Content selection, delivery, reporting
- Matching Data to Offline Sources
- Linking Devices
- Precise Geographic Location Data
- We may disclose your Personal Information to our web analytics partners and data hosting providers who work on behalf of PADDLEWAVER, including to provide our Website with services or to fulfill user requests. However, these companies are not allowed to share this information or to use it for their own purposes.
- We may add additional data to the existing data collected about your device, such as appending US Census data to the device if you are located within the US.
- We may disclose personally identifiable information, including your IP address, and as part of an aggregate data set to third parties for the purposes of providing targeted advertisements and information our advertising partners believe may be of relevance and interest to you.
- We may disclose your data to comply with legal requirements or to respond to a subpoena, search warrant or other legal process or government request received by PADDLEWAVER, whether or not a response is required by applicable law.
- We may disclose your personal information to enforce our rights in our Mobile Products and/or Website or to protect the rights, property or safety of members of the PADDLEWAVER community, our Customers, other visitors to our Mobile Products or Website, the public, or PADDLEWAVER and its employees.
- We may collect data from mobile devices that share a household and that have actively opted in to data sharing.
- As our business grows, we may buy or sell various assets. In the event that PADDLEWAVER or some or all of our assets are acquired by another company, information about our users may be among the transferred assets.
- In the event that PADDLEWAVER goes through a bankruptcy, reorganization, receivership or similar event, you understand and agree that we may not be able to control how your Personal Information or Location Data collected by us is treated, transferred or used.
Unless we receive an opt-out request as discussed below, PADDLEWAVER stores the non-personally identifiable information about your device for up to two years.
If you provide Personal Information to us through our Website, such as signing-up for our newsletter, you may request that we delete such Personal Information from our system, by sending a request to firstname.lastname@example.org. We will promptly cease use of any such Personal Information and will remove such Personal Information from our servers in accordance with our standard practices, within at least four weeks. Certain non-personally identifiable information relating to your use of the Website may be retained for so long as it remains useful in connection with improving our Website and/or Mobile Product.
All data collected or received by PADDLEWAVER is securely stored and processed in the United States.
PADDLEWAVER has taken steps to protect the confidentiality of the data it collects from users of its Website and Mobile Products. Information we gather on PADDLEWAVER is stored within PADDLEWAVER controlled databases (or databases hosted on our behalf) on servers maintained in protected environments, and we limit access to such information to PADDLEWAVER employees who we believe need to see that information to provide you with services or otherwise do their jobs.
Opting Out of Data Collection and Access to Your Data
PADDLEWAVER and the Mobile Product is an opt-in service only. When you download a mobile application that uses the Mobile Product and choose to share your device’s location, you are opting in to this service. PADDLEWAVER works closely with our Customers to ensure they provide adequate notification and transparency to their end users about these practices and the appropriate privacy policies. It is the responsibility of our Customers to provide these notifications.
Mobile applications on Apple devices, like iPhones, and Android/Google devices, like Samsung Galaxy, ask for permission to collect data in different ways. Older Android phones running older Android operating systems require you to accept any permissions that the app asks for before you can install the app. Newer Android phones allow you to opt-in or out of location sharing after downloading the app.
Apple apps allow you to download the app, but then to opt in or out of sharing location, Bluetooth settings, and certain advertising settings on your device’s Settings General pages. If you opt-out of any of these after downloading an app using PADDLEWAVER, we honor these settings and don’t collect those data points. To learn more about how Apple manages location data, read Apple’s documentation.
Individual Rights on Data Collection for European Economic Area/European Union (EU)
If PADDLEWAVER receives data from within the EU, either from data suppliers or from our Customers, as verified by examining the lat/long coordinates received, PADDLEWAVER processes that data in compliance with GDPR regulations.
We may base the processing of your data on one or more of the following legal bases:
- Your consent, if you have given us such consent (Art. 6 para. 1 lit. a) GDPR)
- The initiation or execution of a contract with you (Art. 6 para. 1 lit. b) GDPR)
- The fulfillment of legal obligations (Art. 6 para. 1 lit. c) GDPR)
- The implementation of our legitimate interests (Art. 6 para. 1 lit. f) GDPR)
When processing your data, we pursue the following legitimate interests:
- The improvement of our offer
- Protection of our systems against misuse
- On the production of statistics
- For the storage of our correspondence with you
Transfer to Third Countries
Data PADDLEWAVER collects may be transferred to countries outside the European Economic Area. We only transfer personal data to third countries where the EU Commission has confirmed an adequate level of protection or where we can ensure the careful handling of personal data by means of contractual agreements or other suitable guarantees, such as certifications or proven compliance with international security standards.
- USA (Standard contractual clauses)
Rights as a Data Subject
Subject to applicable law, you may have additional rights regarding the processing of your data.
- The right to access your data, or to request copies of it, subject to verification
- The right to request corrections to your data
- The right to request deletion or restriction of your data
- The right to object to data collection
- The right to transfer your data to another data controller
- The right to file a complaint with the appropriate Data Protection Authority regarding the processing of your data
In compliance with Privacy Shield Principles, PADDLEWAVER:
- is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC)
- maintains the possibility, under certain conditions, for an individual to invoke binding arbitration
- may have liability in cases of onward data transfers to third parties
To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/
Opting Out of Data Collection and Access to Your Data under GDPR or CCPA
We provide multiple methods to opt-out of data collection. There are numerous ways to opt-out of sharing data with PADDLEWAVER.
If you disable ad tracking on your phone or tablet, we no longer collect or store any data about your device. Our product respects the advertising settings on your phone to limit ad tracking. This also opts your device out of all ad tracking across all of your apps.
You can disable location sharing with specific apps by reviewing the settings for each app, or by choosing to not share location when prompted after first downloading the app, or by uninstalling the app.
PADDLEWAVER complies with the General Data Protection Regulation (GDPR). We provide a form for all EU consumers to exercise the right to access their data, direct PADDLEWAVER to delete their data, and opt-out of the sale of their data.
PADDLEWAVER complies with the California Consumer Privacy Act (CCPA). We provide a form for all US consumers to exercise the right to access their data, direct PADDLEWAVER to delete their data, and opt-out of the sale of their data. You can also email email@example.com to determine if we have data on your device. If so, we’ll remove your device(s) from our database within 7 business days or less. You’ll need to provide us with the IDFA (iPhones) or Advertiser ID (Android phones) in order for us to remove your device. We don’t collect any email addresses, names, or phone numbers from mobile apps, so we need this identifier to find your device in our database. This blog post provides helpful tips on how to find your advertising identifier. To learn more about opt-out choices, we recommend reviewing the Network Advertising Initiative’s article on “Information on Opting-Out on Mobile Devices and Information on Opting Out on TV Streaming Devices.”
California’s “Shine the Light” law gives California customers the right to prevent disclosure of their personal information to third parties for those third parties’ direct marketing purposes, and requires certain businesses to respond to requests from California customers asking about the business’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. Alternatively, such businesses may have in place a policy not to disclose Personal Information of customers to third parties for the third parties’ direct marketing purposes if the customer has exercised an option to opt-out of such information-sharing.
CCPA Request Totals for
January 1, 2020 to December 31, 2020
The figures below represent our CCPA request metrics for calendar year 2020. The information provided reflects access, deletion and opt-out requests from both California and non-California consumers.
- The number of requests to know that the business received, complied with in whole or in part, and denied: 39
- The number of requests to delete that the business received, complied with in whole or in part, and denied: 25
- The number of requests to opt-out that the business received, complied with in whole or in part, and denied: 22
- The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out: 18
If you want to see the data we have stored for your device, email firstname.lastname@example.org along with your IDFA and/or AdID. We’ll then ask for verification of your identity, and then provide you the data, if any, we have stored about your device, and allow you to rectify any errors in any personal data as permitted by applicable law.