Additional US State-Specific Privacy Disclosures
Last Updated: June 28, 2024
This additional state-specific privacy disclosure page (“Disclosure”) supplements the Amazon
Ad Server Privacy Policy and is effective as of June 28, 2024. The Amazon Ad Server Privacy
Policy describes the personal information that we collect, the sources from which we collect it,
the purposes for which we use it, the limited circumstances under which we share personal
information, and with whom we share it. These additional disclosures are required by certain
state privacy laws and provide a Notice at Collection under the California Privacy Rights Act:
1. Categories of personal information collected and disclosed for a business purpose.
The personal information that Amazon Ad Server, a service provider as defined byCalifornia Privacy Rights Act, collects, or has collected from consumers in the twelve
months prior to the effective date above, and may have disclosed to the recipients
identified in the Third-Party Disclosures section of the Amazon Ad Server Privacy Policy
for a business purpose, falls into the following categories established by the California
Privacy Rights Act and other state privacy laws, depending on which Amazon Ad Serverservice is used:oooidentifiers such as IP address or device IDs;
internet or other electronic network activity information, including advertising orcontent interaction information; andgeolocation data, such as the location of your device or computer.

2. Your Data Rights: You may delete or gain access in a portable format to personal
information collected by Amazon Ad Server by visiting here:
https://www.sizmek.com/rights- request/. Additionally, you may have the right to opt outof the processing of your personal data for cross-context behavioral advertising (alsoreferred to as targeted advertising under certain state privacy laws). To learn more, please
visit “Your Privacy Choices.” You may correct your personal information or appeal thedenial of any of these rights by contacting Amazon Ad Server Support by email atsupport@sizmek.com. An authorized agent under applicable laws may also contact us byemail at support@sizmek.com.
3. No sale or sharing of personal information. In the twelve months prior to the effective
date above, Amazon Ad Server has not sold or shared any personal information ofconsumers, as those terms are defined under the California Privacy Rights Act. Amazon
Ad Server’s advertiser, ad agency, and other customers do use the services provided byAmazon Ad Server in its role as a service provider to collect and use personal
information in connection with the creation and delivery of advertisements; however, if
you would like to opt out of your personal information being received by our customers
using our services, you may opt out at “Your Privacy Choices.”
4. De-Identified Data Disclosure. Amazon Ad Server may use de-identified data in someinstances. Amazon Ad Server either maintains such data without attempting to re-identify
it or treats such data as personal data subject to applicable law.

5. California Privacy Rights Act Sensitive Personal Information Disclosure. AmazonAd Server does not collect or disclose “sensitive personal information” as defined under
the California Privacy Rights Act.
6. California Privacy Rights Act Retention Disclosure. We keep your personal
information for as long as it is required in order to fulfill the relevant purposes describedin the Amazon Ad Server Privacy Policy, as permitted or required by law, or as otherwise
communicated to you.
7. California Privacy Rights Act Non-discrimination Disclosure. Amazon Ad Server will
not discriminate against any consumer for exercising their rights under the California
Privacy Rights Act.
8. Targeted Advertising Disclosure. Amazon Ad Server processes personal information
for the purposes of targeted advertising as that term is defined under certain state laws.
9. Colorado Privacy Act and Oregon Consumer Privacy Act Profiling Disclosure.
Amazon Ad Server does not engage in profiling of consumers in furtherance ofautomated decisions that produce legal or similarly significant effects, as those terms aredefined under the Colorado Privacy Act or the Oregon Consumer Privacy Act.
10. Oregon Consumer Privacy Act Controller Entity Disclosure. The controller entitythat is subject to the Amazon Ad Server Privacy Policy and this Disclosure isAmazon.com Services LLC.
11. Annual Reporting for 2023.
Access Requests. In 2023, Amazon Ad Server received 256 requests from customers toinitiate the data access process. All 256 requests were processed with a median return
time of less than 1 day.
Deletion Requests. In 2023, Amazon Ad Server received 12 requests from customers toinitiate the data deletion process. For 2 of these customers, their request was not fulfilled
because the customer did not complete the verification process or canceled the request.
The remaining 10 requests were processed with a median processing time of less than 1day.
Correction Requests. In 2023, Amazon Ad Server did not receive any requests fromcustomers to correct their data.