Company: CDLX
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001666071-25-000034
Chunk: 16

Company: Cardlytics, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1
Chunk 16
---
 more cash back on the things they care about most. At the same time, marketers gain more opportunities to get valuable content in front of the right audience.

Privacy and Security

Cardlytics Platform

We take privacy and security into account in the development and implementation of our systems and services. A critical part of our strategy involves a design focused on gathering data without collecting, maintaining or using sensitive personal data, such as social security numbers, credit card numbers, financial account information or medical records. Our platforms are designed so that we do not receive or have access to any personal data from our FI partners. We only target marketing against anonymized data or data that has undergone processing such that it is only linked to anonymized identifiers. Our privacy and security standards have also been designed to meet the requirements, and safeguard the reputations, of our partners and marketers, many of which are large, multinational corporations. These customers frequently audit our practices and engage in detailed assessments of our infrastructure.

5

Our Ad Server and Ads Manager form the core of the Cardlytics platform. The Ad Server is responsible for targeting and presenting offers, which are developed and designed within the Ads Manager. Each FI partner's Ad Server is either hosted at the FI partner's data center behind the FI partner's firewall or hosted by us on behalf of the FI partner. The Ad Server interfaces with our FI partners' systems to receive anonymized purchase data, assign a unique consumer ID to each FI partners' customer, and aggregate this purchase data. The unique consumer ID is then used to assign offers, measure redemptions, and in limited cases, validate certain online purchases. The Ad Server also receives engagement data, such as impressions and activations, related to each unique consumer ID.

Ads Manager is hosted in cloud data centers behind our firewall and is used to create, manage and publish marketing campaigns to each FI partner's Ad Server. Ads Manager also provides a majority of the functionality for managing configuration settings within each Ad Server and transferring data between Cardlytics and our FI partners.

We have implemented a number of security controls. Certain of our environments and systems have been certified as SOC 1 Type II or SOC 2 Type II compliant by third parties. Sensitive data is subject to encryption, anonymization, or de-identification depending on the use case and risk profile. We enhance our network security through measures such as network segmentation, firewalls and network and host-based intrusion detection at critical network aggregation and ingress/egress points.

Bridg Platform

The Bridg platform was designed to comply