Quebec Privacy Statement

Last Updated and Effective: September 22, 2023

Our Commitment

StackAdapt Inc. ("StackAdapt", "us", "our", or "we") strongly believes that all information deserves protection. We've written this Quebec Privacy Statement ("Privacy Statement") to inform you of our privacy practices with respect to the personal information we process via our platform, which we will refer to as our "Platform". If you do not agree to the terms of this Privacy Statement, you may opt out of inclusion in our Platform. If you do not understand, or if you have questions about this Privacy Statement please contact us using one of the methods we've identified below.

We may update this Privacy Statement from time to time and will post the updates here. If we amend this Privacy Statement, we will revise the Last Updated date based on when we posted the updated version.

Types of Personal Information We Collect

Privacy laws in Quebec, Canada generally define personal information as any information that relates to a natural person, and allows that person to be identified directly or indirectly. Similarly, within this Privacy Statement we use the term "personal information" and "pseudonymous personal information" to represent various types of information we collect about you. This may include directly identifiable information, such as your name or email address, or indirectly identifiable information, such as cookie ID, IP address, and device ID.

Personal Information Collected. We collect the following pieces of personal information related to users, households, devices, and ads for use and processing within our Platform:

• Advertising identifiers (e.g., mobile advertising identifiers)
• Cookie identifiers
• Device identifiers
• IP addresses
• User agent
• Referral page URL and title
• Geolocation information (e.g., latitude/longitude at varying levels of specificity)
• Pseudonymous identifiers we receive or derive internally (e.g., RampID; household or consumer level identifiers)
• Email address
• Demographic data that may be associated with one of the above identifiers

Why We Collect Personal Information

StackAdapt is a programmatic advertising platform. We provide advertising services to our clients, who are typically advertisers or advertising agencies who use these services to buy, track, and manage their digital media to deliver advertisements, including, but not limited to, native, display, video, in-game, connected TV, audio, and digital out-of-home advertisements. Through our Platform we distribute and promote advertising content, also referred to as creative, using real-time, data-driven audience targeting on behalf of our clients.

As a programmatic platform, we also help our clients curate the audiences that are most likely to respond to an interest-based advertising campaign. When requested, we assist our clients in developing creative and when their campaign is ready to launch, we engage in real-time bidding on their behalf.

Real-time bidding is a process in which advertisers bid on ad placements across publisher websites in a real-time auction environment. When bids are won, we are able to place our clients' ads across a range of websites, thereby delivering ads that are relevant and timely to you. After you've seen the ad, we enable our clients to use certain information related to the delivery of the ad to measure its effectiveness, whether you clicked on the ad, purchased the product, or scrolled past. Ultimately, we and our clients collect and use information within the Platform to serve advertisements that we believe are relevant to your interests.

How We Collect Personal Information

We seek to minimise the amount of personal information we collect from you, and we do so only for the purposes described in this Privacy Statement. We collect personal information from the following sources:

Client-Owned Properties. We often use pixel tags and cookies to collect information about the ads you respond to or the purchases you make when you visit a website of one of our advertiser clients. We only use pixel tags and cookies at the direction of our clients and in each case, indirectly identifiable personal information is shared with us as further described below.

• A pixel is a tiny snippet of code that allows the owner of a website to gather information about visitors to their website. Clients who choose to implement one of our pixels will automatically collect and transfer indirectly identifiable personal information to our Platform that includes IP address, Cookie ID, and contents of cookie, user agent, and referral page URL.
• Our clients can customize their pixels to pass back additional indirectly identifiable personal data to our Platform. While clients can use this information to make informed and strategic advertising decisions, they are contractually obligated to comply with applicable data protection laws when customizing their pixels.
• Cookies are small text files that are stored on the browser of a computer that uniquely identify the browser and provide information to the cookie sender.

Our Platform. When we deliver advertisements through our Platform, we collect certain indirectly identifiable pieces of personal information related to the campaigns we serve on behalf of our advertiser clients. This is referred to as "impression data". Impression data includes, for example, advertising identifiers, identifiers tied to your device, your IP address, imprecise location (e.g., the postal/ZIP code you were located in when you saw the ad), user agent, as well as information related to the context of the web page you were viewing when you saw the ad.

We may use impression data to group and categorize consumers based on their interests or preferences. This helps us identify which products and services may be most appealing to consumers and subsequently, which advertisements are most likely to be relevant to a particular group of consumers. Impression data is collected in accordance with the data protection requirements of the jurisdiction in which the campaign was served, and privacy policies of the websites and advertising networks we work with.

Third Parties. We may collect personal data from third parties with whom you've shared your information, in accordance with their privacy policy. Third-party segments are combined pieces of data that are collected by external parties and acquired by StackAdapt for use in advertiser campaigns. Third-party segments do not contain directly identifiable personal data, rather third-party segments are resolved to pseudonymous identifiers that are used to track and manage digital media in an advertising campaign. Often, advertisers will request specific third-party segments, so that they can reach a desired audience more effectively. This ensures you receive advertisements that are more relevant to you and your interests.

How We Use Personal Information

We primarily process personal information in our Platform to assist our clients in reaching audiences that are most likely to respond to interest-based advertising campaigns. In that regard, we use personal information to do any, or all, of the following business or commercial purposes:

• Display advertisements that may be relevant to you;
• Place a bid for advertising space;
• Marketing automation and email activation;
• Track how many times an ad was shown and to whom (based on a pseudonymous identifier);
• Allow clients to measure the success of their advertising campaigns;
• Develop reports that provide measurement and attribution;
• Process pseudonymous information to prevent malicious ad traffic (i.e., fraud detection and prevention);
• To develop machine learning models and algorithms;
• Create and refine audience segments and profiles; and
• Develop and refine algorithms to understand better how users' interaction with a website might be of interest to advertisers.

Additionally, we may use personal information on our own behalf to do any, or all, of the following:

• Respond to your requests, communications, suggestions, comments, inquiries, and requests;
• Analyse the accuracy and effectiveness of the services we make available within our Platform;
• Develop new products, features, and services, including those that analyze and understand our customers and their needs;
• Respond to legally binding requests from law enforcement, supervisory or regulatory authorities, or other third parties;
• Defend, protect, or enforce our rights or applicable terms of service or to fulfil our legal or contractual obligations;
• Manage any dispute and accidents, and take legal or other professional advice;
• Comply with, or meet obligations as required by, applicable law (i.e. fraud detection or the recurrence of fraud);
• For internal or external audit purposes; or
• For any other purpose with your consent.

Profiling Technologies. Our Platform is used by client marketing teams to create digital advertising campaigns. To enable our clients to plan and effectuate campaigns that most likely are to be of interest to you, our Platform is underpinned by databases storing user-profile information, including cookie IDs, device IDs, IP addresses, email addresses, and universal IDs. We also source data from third-party vendors, including providers of data management platform services, to enrich our existing user-profile datasets.

StackAdapt clients can also track key performance indicators (KPIs) associated with campaigns through the inclusion of pixels within campaigns, which fire in order to track campaign outcomes (e.g. conversion, engagement, etc.), as well as user behaviour metrics, such as time on site. The StackAdapt pixel also transfers browser data to StackAdapt, including IP address, the user agent, when available, the contents of the cookie, and referral page URL.

Location Technologies. Within our Platform, clients can create location-based segments to select audiences for upcoming advertising campaigns. Clients are encouraged to use radiuses higher than 2.5km.

Identification Technologies. We maintain internal-identity graphs to stitch together universal identifiers that assist our clients in targeting and retargeting specific audiences with relevant advertising campaigns. Many of these universal identifiers are considered personal information under applicable data protection laws and include cookie identifiers, device identifiers, third-party identifiers, our own internal identifiers, and IP addresses. For more information regarding personal information and identification, please refer to Types of Personal Information We Collect.

Use of Artificial Intelligence (AI) in the Platform. We use AI technology to align ads with the content users are consuming. This means that, through algorithms, we can match relevant ads to your browsing. You can request to find out what personal information we may have used through our algorithms to send you ads based on your browsing. If you feel the information is inaccurate, you can request to have it corrected.

Privacy Impact Assessment. We complete Privacy Impact Assessments (PIA) in certain circumstances, such as when making material updates or changes to our Platform or Services or the manners in which we use personal information and before disclosing personal information outside of Québec. Each PIA considers the scope of the activity, the sensitivity of the information involved, the purposes for which the information is to be used, the protection measures, including contractual ones, that would apply, and the legal framework applicable in the jurisdictions where the information is shared.

How We Share Personal Information

We may share certain pieces of your personal information with our employees, subprocessors, partners, and clients to support our clients' advertising strategies. In each case; however, we only share your personal information for the limited circumstances we describe in this Privacy Statement and in accordance with applicable data protection law.

Internal Access to Personal Information. Access to your personal information is provided only to authorised employees who require it as part of their duties. StackAdapt employee access rights follow the principle of least privilege, whereby access is restricted to the minimum required to fulfil an employee's role. Employee access rights are formally reviewed by management at periodic intervals and only key managers may grant or change access. Generally speaking, engineers and analysts employed by StackAdapt have access to personal information within our Platform.

External Sharing of Personal Information. We share the categories of personal information listed in Types of Personal Information We Collect with the following categories of third parties for the specified advertising related purpose:

• Clients and their subprocessors (primarily advertising agencies): For the purpose of offering our programmatic advertising services.
• Onboarding and audience partners: For the purpose of identity resolution and audience creation.
• Publisher and supply-side partners: To technically enable the delivery of an advertisement and the measurement of its success.
• Accountants and auditors: In connection with our business operations.
• StackAdapt entities: For the purpose of offering our programmatic advertising services.
• StackAdapt subprocessors: For the purpose of offering our programmatic advertising services and in connection with our business operations.

We do not knowingly collect, process, or share personal information related to minors under 16 years of age.

In accordance with applicable law, we may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganisation, or liquidation. If we are involved in defending a legal claim, we may disclose personal information about you that is relevant to the claim to third parties as a result of, or in connection with, the associated legal proceedings.

Your Choices

Targeted Advertising. We enable our advertiser clients to engage in interest-based and targeted advertising via our Platform. You may opt out of targeted advertising powered by StackAdapt. If you choose to opt out of targeted advertising, it does not mean you will stop receiving advertisements or that you will receive fewer advertisements. When you choose to opt out of targeted advertising in our Platform, we will add a pseudonymous identifier that represents you to a suppression file that will prevent us from including you in future targeted advertising campaigns. After you opt out, you will still receive the same number of advertisements; they will just be less relevant to your interests.

Additionally, your opt out with us is only applicable to our Platform. We cannot control how third party websites or how the online services you visit will process your information or the opt outs you request from them.

We work with third parties who collect information through the use of cookies and similar methods in order to serve you with relevant advertisements or to determine whether you have seen advertisements. This method of advertising is sometimes called "Interest-Based Advertising." To learn more about Interest-Based Advertising, your choices with respect to it, and to opt out of advertising programs that track your activities across multiple websites to deliver personalised advertising content to you, please visit:

• For Canada: Digital Advertising Alliance of Canada Opt-Out Page (StackAdapt is a member of the Digital Advertising Alliance of Canada (DAAC) and we abide by their Self-Regulatory Principles for Online Behavioural Advertising.)
• For Canada and U.S.: NAI Opt-Out Page
• For Canada and U.S.: Ad Choices Opt-Out Page

StackAdapt participates in the IAB Canada Transparency & Consent Framework and complies with its Specifications and Policies. StackAdapt's identification number within the framework is 238.

Children's Privacy. Our Website and Platform are not for children or those under the age of 16. We do not knowingly collect personal information from children or other persons who are under 16 years of age. Individuals who are children or those under the age of 16 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 16, please contact us immediately.

Cross-Border Transfers of Personal Information

We may process, store, and transfer your personal information in and to another province or territory outside of Quebec or country outside of Canada, with privacy laws that may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a service provider, we will require that it is contractually obligated to keep personal information confidential and that it will use the information only for the purposes for which we disclose it to them.

Data Governance

Internal Data Classification. We have established formal data-handling guidelines that serve as our framework to govern the internal access, storage, and destruction of information across our organisation. Within this framework, we maintain a data classification standard, where information is classified according to sensitivity. Our data classification standards apply to all business units within StackAdapt, our employees, temporary employees, and subcontractors.

StackAdapt has established controls and mechanisms to protect data at each stage of the data lifecycle, from collection or creation, through to disposal. We have a formal Change Management Policy that governs the mechanisms for how IT changes are managed across each stage of the software development lifecycle, as well as Responsible, Accountable, Consulted, and Informed (RACI) matrices and procedure descriptions. Aligning our data classification standards with change management methods and techniques allows for efficient and prompt handling of all application changes, permitting us to meet agreed service levels with our clients, and lessens the occurrence of any change-related incidents.

Retention of Personal Information. Except as otherwise permitted or required by applicable law, we only retain your information for as long as necessary or relevant for the listed purposes in this Privacy Statement, including, for legal, regulatory, backup, archival, accounting, and/or audit purposes.

Storage of Personal Information. StackAdapt may process and store personal information anywhere our servers are located. StackAdapt leverages the ‘Amazon Web Services' (AWS) public, cloud-based platform to support the delivery of key services to its customers. Currently, we subscribe to the data centres located in the United States, Germany, and Singapore. For more information about our servers and storage of personal information, please contact us.

Complaints. To contact us regarding the protection of your personal information, please email us at privacy@stackadapt.com.

Data Subject Rights

If you have provided your information to us and would like to opt out of inclusion in our marketing or email campaigns, you can remove yourself by clicking "unsubscribe" at the bottom of an email we send you, or by contacting us using one of the methods listed below.

Access Request. You can request a copy of the personal information we may hold about you.

Rectification Request. You can request that we correct any incomplete or inaccurate personal information we hold about you. Because the data in our Platform is pseudonymous and not directly identifiable, we may not have the technical ability to correct your personal information. In that case, we will delete the incomplete or inaccurate personal information instead.

Correction Request. You can request that we correct any incomplete or inaccurate personal information we hold about you. Because the data in our Platform is pseudonymous and not directly identifiable, we may not have the technical ability to correct your personal information. In that case, we will delete the incomplete or inaccurate personal information instead.

De-indexation Right or Right to be Forgotten. You have the right to request that we delete the personal information that we collected from you and retained, subject to certain exceptions. For example, we may deny your deletion request if retaining your information is necessary for us to be able to recover payment, detect security incidents, or protect against illegal activity.

Right to Data Portability. You have the right to receive personal information that you have provided directly to us, for example, through opening an account, in a commonly-used and machine-readable format. You have this right so that you may transmit your information to another organization without hindrance.

Exercising Your Rights. To exercise these rights, please email us your request at privacy@stackadapt.com or fill out this web form.

Contact Us

If you have any questions about this Privacy Statement, our Data Protection Officer can be reached by:

Email:
privacy@stackadapt.com

Mail:
StackAdapt Inc.
6D - 7398 Yonge St, Unit # 2161
Thornhill, ON L4J 8J2, Canada

Or fill out our Consumer Rights Web Form.