PRODUCTS RESOURCES COMPANY CONTACT Privacy Policy FRANÇAIS ITALIANO ESPAÑOL PORTUGUÊS EFFECTIVE AS OF JULY 1ST 2020 S4M PRIVACY POLICY Summary: Introduction 1. Fusio Platform data processing 2. User rights 3. S4M Corporate Website and Social Networks: data processing 4. S4M Corporate Website Cookies Policy 5. General provision 6. Glossary INTRODUCTION The present Privacy Policy extends to the affiliates of SUCCESS4MOBILE SAS (herein “S4M”), which are Yanco by S4M, Fusio by S4M, Sam4Mobile Ltd (UK), Sam4Mobile Inc. (USA), Sam4mobile Brasil Solucoes da informaçao Ltda (Brésil), S4M PTE.LTD. (Singapour), S4M S.R.L (Italy), SUCCES POUR MOBILE CANADA Inc, S4M Benelux, as well as any company controlled by S4M that will be created. S4M is a global provider of mobile advertising media and data management technology. S4M’s proprietary technology (the “Platform” – marketed under the name “FUSIO”), provides tools and services that enable buying and bidding in real time and the delivery of advertising on ad networks, publisher mobile devices, websites and apps. Furthermore, the Platform allows advertisers and their media agencies to learn more about their advertisements through a set of analytic tools. We are looking at impressions (when the ad displays), click (when you click on the ad) and post-click traffic in aggregate (statistics report), trying to determine how the advertisements can be optimized, which are the most efficient publishers and ad formats. Purpose of the Privacy Policy This privacy policy (“Policy”) covers: The Platform owned by S4M (the “Company”, “we” or “us”); The following websites: s4m.io, www.yanco.io, www.fusio.io, www.success4mobile.com, and any subsidiary websites owned by S4M or its affiliates (“Website”); The following social networks: Facebook https://www.facebook.com/S4Mob; Twitter: https://twitter.com/S4Mobile; LinkedIn: https://www.linkedin.com/company/sam4mobile; Instagram: https://www.instagram.com/s4mobile/ Vimeo: https://vimeo.com/user45898886 and any subsidiary social networks owned by S4M and its affiliates (“Social Networks”). Herein named all together “S4M Tools”. S4M Tools use are primarily directed to digital professionals (BtoB). However, they are two categories of users of S4M Tools: Digital professional such as Media Agencies and Advertisers (“Customer(s)”), Ad networks and other partners (“Partner(s)”) End-users, who are visitors, prospects or users of our Website and/or Social Networks, individual users of mobile, tablet applications or individual visitors of a mobile website or app (herein “User(s)” or “You”) The purpose of this Policy is to set out: How S4M processes information collected via its Platform, Website and Social Networks, How S4M protects the collected information as well Inform You how S4M collects and processes information about You, and the way to exercise Your rights in respect with data protection By visiting or using S4M Tools, You are accepting the policies and practices described in this Privacy Policy. Territorial scope This Privacy Policy applies for all territories where S4M trades. However, the definition of personal data and applicable data protection regulation may be different depending on the country. S4M will ensure to comply with relevant regulations, especially undertakes to respect the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as “GDPR”. For more information, please contact us at privacy@s4m.io Advertising and Media industry standards S4M and its affiliates are member of the main industry’s associations. Hence, S4M and its affiliates comply with the applicable industry standards, guidelines and best practices. Moreover, S4M asks its Partners and sub-contractors to comply with those standards and our business ethical requirements. 1. FUSIO PLATFORM: DATA PROCESSING 1.1 Purpose of data processing The data is processed to allow our Customers to buy and release behavioral advertising and measure its performance through our Platform. Behavioral advertising means information collected across multiple web sites, in app, that you visit in order to predict your preferences and to show you ads that are most likely to be of interest to you On request of our Customers, S4M can also perform cross-device attribution. It is the measurement and reporting of conversions of ads as they take place after multiple engagements across different devices. For example, a User may click on an ad on one device, but will finish the desired action on another device. Processing data also allow us to improve the technical functionality of our Platform, as well as our products and services. 1.2 Type of data processed General. S4M only processes data that are relevant for the performance of its Platform’s services, whether by nature or volume. By delivering an ad to you via the Platform, S4M collects data about your mobile device (such as smartphone, tablet etc) using specific technology, as explained below. The Internet. S4M services are provided thanks to the Internet. Hence, the use of S4M services includes the processing of data found in every communication sent over the Internet, such as: browser type (e.g., Chrome or Internet Explorer); User-agent string (e.g operating system; operating system version); browser language (e.g., English or French); referrer addresses, Internet Protocol (IP) address. A browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. Platform customers’ data. When the Customer or Partner register to the Platform we ask for basic registration information, such as name, company, position, address, email address, phone, and other contact information. We may ask for voluntary personal information at other times, including but not limited to when Customer or Partner report a problem with the Platform. This type of information is deemed personal data and is used to contact Customer or Partner or determine its specific identity. When other information is linked to this information, it also becomes personal data. We may also automatically receive and record information in our server logs from Customer or Partner’s browser type (e.g., Chrome or Internet Explorer); User-agent string; browser language (e.g., English or French); device timestamp and time zone; Device screen size; Internet Protocol (IP) address, and other generally-accepted log information. We may also record page views (hit counts) and other general statistical and tracking information. Customer or Partner can access or correct certain personal information, such as applicable passwords, directly in the Account sections of the Platform. If Customer or Partner have provided personal data, such as his/her e-mail address when registering for our Platform, Customer or Partner may modify that information at any time by visiting your Account settings. Notably, since we may use its User name as the account identifier, Customer or Partner may not be able to change its User name. In addition, Customer or Partner can delete its account at any time. In a such case, S4M acts as Controller (having the meaning set forth under article 4 of GDPR) and its legal basis is the conclusion of the contract with its Customer and/or Partner Users data processed through the platform, including geolocation data. When an User views an ad on a site or app which uses our services, we collect information about the ad that he/she has viewed (e.g. advertiser’s name, type of advert, etc) and the web site or the app where the ad was delivered. This information does not enable us to work out any Users identity in real life but does enable us to recognize from which advertisements Users are coming from thanks to the following main data collected: device timestamp and time zone, device type, network provider, Mobile advertising ID, IP address, the geolocation of used device such as Lat/long, user-agent string, operating system, operating system version, and screen size. Depending on domestic regulation, these data may be considered as personal data, for example, like under the GDPR. We may specifically collect the information about the ad Users have viewed or clicked on. We collect some or all of the following information about the ad Users have viewed, clicked on: (i) the content type of the ad (what the ad is about, e.g. games, finance, entertainment, news); (ii) the ad type (e.g. whether the ad is a text, image, rich media or video based ad); (iii) where the ad is being served (e.g. the address of the website on which the ad appears); and (iv) certain information about post-click activity in relation to the ad (e.g. whether you proceed to fill-in form, purchase the product or service advertised). We may also collect information of the specific places (mostly area) that Users have visited during the period of the advertising campaign to measure the performance of the ads. In some cases, we can collect, on behalf of our Customers your name, email address and other direct personal data when you fill out a questionnaire with such information. IIn a such case, Customers, for whom the ad campaign is released by S4M, act as Controller and S4M acts as Processor (having the meaning set forth under article 4 of GDPR). Cross Device Tracking. To measure and report conversions of ads as they take place after multiple engagements across different devices, our third-party service providers, may set and/or access cookies or other data collection technology which collect information (not including your name, address, email address or telephone number) about your visits to this and other websites, mobile websites and/or mobile applications across your various devices, in order to provide content and advertisements about goods and services of interest to you across those various devices. Our Partners are using a probabilistic model by matching anonymous signals to try and identify a User. These signals include: Location (IP addresses) Date Conversion Type Device IDs Landing Page Interests and web history In a such case, Advertisers, for whom the ad campaign is released by S4M, act as Controller and S4M acts as Processor (having the meaning set forth under article 4 of GDPR). Cookies.We use a session first party cookie to track the User is coming to view a mobile website. The cookies contain a unique tracking ID per Ad placement and a session ID, and a User ID and will expire after 20 minutes. The User ID expires after 13 months. In certain instances, S4M may use HTML5 storage for enabling, tracking functionalities within an ad or for counting purposes. This can be removed by clearing your browser’s cache. Sensitive data. S4M do neither collect nor process any sensitive data such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, where the domestic regulation prohibits the processing of a such data, like under GDPR regulation. Children privacy. The Platform service is not directed to children (persons under the age of 13), and we do not knowingly collect, either online or offline, personal data from children. If we become aware that we have collected personal information about a child under the age of 13, that information will be immediately deleted from our database. 1.3 Role of S4M as a Controller or Processor If you are located in one of the countries of the European Economic Area, S4M may act a “controller” as defined under applicable law when processing your personal data. S4M may also act as a “processor” as defined under applicable law to the extent that it processes your personal data on behalf of and at the instruction of another party, for example one of our Customers. We are a data controller when we receive personal information: from our measurement pixels on an advertiser website. This is because we use this data for product improvement. In this instance, we are an independent data controller with the advertiser from the bid requests coming from a publisher website. This is because we use this data for fraud detection and product improvement. In this instance, we are an independent data controller with the publisher We are a data processor for any other processing activities as we will follow our Customers instructions. Please note that if you wish to exercise any of your rights with any of our Customers, you must make your request directly to those Customers, based on information and procedures that they supply. S4M Customers own the Platform data that they maintain in the Platform. S4M does not control how those Customers use Platform data. When acting as a data controller, S4M always relies on your consent to process personal information. We also rely on our legitimate interest when we process aggregated data to improve our products 1.4 How data is collected In order to serve our Customers, S4M collects data from the publishers through the RTB protocol (Bidstream) in order to display the ads. TheBidstream allows processing data that are directly related to the advertising campaign. For example, S4M does not collect geolocation data on a permanent basis. S4M processes data that are adequate, relevant and limited to what is necessary for the purposes of behavioural advertising which is why they are processed. S4M is not an audience provider, instead S4M relies on Bidstream information and, upon Customer’s request, external data provider who are either already working with our Customers or one of our qualified Vendors. Finally, for ads performance measurement and tracking, upon Customer’s request, S4M can use: its own Javascript library to collect in-ad activities and advertiser’s website conversions 3rd party data from our qualified Vendors In addition, for the post-click tracking (examples for landing or application installation), S4M requests to the Advertiser to implement the S4M Tracking Library only after the User consent obtention. 1.5 How data is shared and processed S4M is a member of IAB Consent and Transparency framework and bases the consent obtention and verification on the IAB consent signal provided via the Bidstream by publishers selling their inventory. This new organization allows us to check our Partners’ position and track the consent chain as well. Data is shared with and processed by authorized person such as: Platform Customers, who are Advertisers and their media agency, that use the platform to deliver advertisements for their own purpose (or on behalf of the advertiser); S4M qualified Partners, who are companies contributing to improve the service (e.g. audience measurement, viewability measurement, fraud detection); S4M authorized employees, who are the people who operate the Platform or process information disclosed from S4M Corporate Website and Social Network These authorized persons are bound to S4M by a contract where the respect of data protection and confidentiality is a key engagement. Our Partners are asked to provide detailed information on their Privacy and Security measures. The list of our partners can be found here. More generally, any of our subsidiaries, or other companies under common control are required to honor this Policy. Additionally, in the event we go through a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, we expect that any and all information that we have will be among the assets transferred. 1.6 Retention Data retention is decided by the Customer when it acts as Controller. S4M undertakes not to keep any said data beyond the agreed term. In the case where this information is not provided by the Controller, S4M deletes by default the data processed through the Platform within 13 months. 1.7 Data transfer S4M is an international group with its offices in Europe, United States and Asia. To this end, the Platform is supported by a technology that enables S4M to perform its services worldwide. Depending on the service used, the Platform is hosted in Ireland or in United States with relay servers in Singapore. Hence, the information that we collect from You and about You may be transferred to and stored in a country other than Your country of residence. However, S4M ensures to comply with relevant regulation and takes appropriate measures to keep your personal data protected. Especially, S4M ensures to comply with GDPR requirement regarding lawful transfer mechanism. The Platform is hosted by Amazon Web Services, that complies with the principles of the EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield. This framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States for commercial purposes. More information about EU-US Privacy Shield on the Official European Commission site. 1.8 Security S4M takes all reasonable measures to protect the security of Your personal data during transmission. We also take reasonable measures to safeguard personal data and to protect against unauthorized access, alteration, disclosure or destruction of such information through our data collection, storage and security practices. However, no transmission of data over the Internet is guaranteed to be completely secure. You should take further precautions to protect your personal data, such as safeguarding your User name and password or limiting the use of shared computers. 1.9 Limitation of liability S4M makes its best efforts to protect User privacy. However, S4M does not control the privacy practices of, and shall not be liable for the Ad Networks, Publishers, Advertisers and Social Networks. For details regarding their own privacy policies, we recommend visiting or contacting them directly. 2. USER RIGHTS 2.1 Your rights As per the applicable law, especially GDPR, you can exercise the following rights by contacting S4M Data Protection Officer at this email: privacy@s4m.io or as explained under section 5.3. The right to be informed The right of access The right to rectification The right to erasure The right to restrict processing The right to object Before treating the request S4M should ensure the identity of the person making the request to avoid sharing data to an unauthorised person. To deliver its services, S4M mainly uses the Mobile advertising ID to identify the User and the request can only be treated once this information is collected. We would ask you to share this information if not provided in your request. To learn more about behavioral advertising or to opt-out of some types of behavioral advertising for third-party ad networks, the User can visit the Digital Advertising Alliance: https://digitaladvertisingalliance.org/. Additionally, the mobile operating system of a User (e.g. iOS or Android) should also give the User the option to manage his or her advertising preferences (this may be found in the “Settings” function on the respective device): https://support.apple.com/en-us/HT202074 or https://support.google.com/ads/answer/2662856 2.2 How to reset Mobile Advertising ID Mobile advertising IDs are unique identifiers that are associated with individual mobile devices. They usually are user-resettable and are separate from hardware serial numbers. They are not permanently tied to a mobile device, as Users can reset their Mobile advertising ID at any time for added security or opt out of ad tracking. As a result, the Mobile advertising ID can no longer be easily linked to specific devices/users Types of mobile advertising IDs: Android ID is named GAID Apple ID is named IDFA or IFA is an Apple Device ID released with iOS 6 and is a cross application / publisher identifier. If you want to renew your profile used for behavioral advertising services, You can reset by yourself Your Mobile Advertising ID by following the processes described below: IOs: go to “Settings” then “Privacy”, then “Advertising” and then “Reset Advertising ID” (see demo on Apple Support) Android : go to “Settings” then “Google” then in “Ads” then “Reset Advertising ID” (see demo on Google Support) Be aware. Free media content is financed by advertising release. By resetting Your Mobile Advertising ID, You will still receive advertising on Your mobile phone, but this will not be behavioral advertising anymore and may not correspond to Your interests. 2.3 How to disable cookies The “Help” section of the browser indicates how to set and disable cookies. Your browser may be: Internet Explorer, Firefox, Safari or Chrome. 3. S4M CORPORATE WEBSITE, SOCIAL NETWORKS AND CORPORATE TOOLS - DATA PROCESSING 3.1 Purpose and Type of data processed General. We process the data you may provide us with through the S4M Corporate Website and/or Social Networks for internal use only, and for the sole purposes set out hereafter. Traffic. We process data to allow us to better understand our Corporate Website visitor’s expectations though statistical measures and analysis. To this end, we use cookies and other tracers to provide you with a better, personalized and secure browsing experience Social Networks Features. The Corporate Website includes the access to Social Networks features, used as communication tools by S4M. By using these features (e.g. click on Facebook like button) You accept the collecting of Your IP address, which page you are visiting on the Website, and may set a cookie to enable the Feature to function properly. Email contact.The Corporate Website includes the access to a generic email address contact@s4m.io This email address allows You to contact S4M communication services for general purpose. By sending an email through this email addresses, You accept that S4M communication services may forward Your queries and personal data provided such as: Your name, Your Surname and Your email address, to the relevant S4M employees that may contact you to answer your queries. We recommend to only send over relevant information needed to answer your queries. Press and Prospects Contact form. The Corporate Website includes the access to a press and prospects contact form, dedicated to potential clients and journalist and other Press and Public relation officer. By filling in this contact form, you accept to provide us with personal information such as: your name, company, position, address, email address, phone, and other contact information that are relevant for communication and marketing purposes. We recommend to only send over relevant information needed to answer your professional queries. Be aware. We draw Your attention to the fact that Social Network features are hosted by a third party. Your interactions with each of these Features is governed by the privacy policy of the company providing it. Furthermore, by using Social Networks features, you may voluntarily display information that is made public by You. If you have specific question about S4M, please use the dedicated and secured email address: privacy@s4m.io 3.2 Retention Personal data processed by S4M through contact email address or Press contact form are deleted from S4M database within 13 months after the end of the business relationship and/or the end of the service provided. 3.3 Cookies Please refer section 4 below. 3.4 Your rights S4M acts as Controller for personal data that are processed through the S4M Corporate Website. In respect with applicable law, especially GDPR, you can exercise the following rights with S4M, by contacting S4M Data Protection Officer as explained under section 5.3. The right to be informed The right of access The right to rectification The right to erasure The right to restrict processing The right to object Before treating the request S4M should ensure the identity of the person making the request to avoid sharing data to an unauthorised person. This will be done based on Your email address provided in Your request. 3.5 International Users The S4M Corporate Website is hosted in France. If you access the Website from the European Union, Asia, United States or any other region with laws or regulations governing personal data collection, use, and disclosure that differ from French laws, please be advised that through your continued use of the Website You are transferring your personal data to France and You are consenting to that transfer. 4. S4M CORPORATE WEBSITE COOKIE POLICY A cookie is a small piece of information (i.e., program code) that is stored on a browser for the purpose of identifying that browser during audience activity and between visits or sessions. Cookies are typically set to expire. Some cookies are intended to remain on the browser temporarily (for example, during a session) and some are persistent in that they are intended to be retained for longer periods. 4.1 Cookie banner. In respect with Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), except cookie that are deemed essential to the proper use of the service, S4M does not place any cookie, without your consent. To this end, when you first visit our Corporate Website, a banner informs You about the purpose of such cookie deposit and requests and collects your consent. 4.2 Cookie processing. A cookie is a small text file that a website saves on your computer or mobile device when You visit the S4M Corporate Website. Cookies that are installed by S4M are relating for two specific uses: Services cookies: required to ensure the proper functioning of the Website (essential). Functional cookies: used to determine Your usage and improve user experience (not essential). The cookie-related information is not used to identify you personally and the pattern data is fully under Your control. These cookies are not used for any purpose other than those described in this section. Service cookies. To make this site work properly, we install small data files called cookies on your device in order to provide the service. These cookies are strictly necessary for the website to work: to adapt the presentation of the Website to the display preferences of the terminal (display resolution, operating system used, etc.) during visits, according to the hardware and software of the terminal concerned; to memorize information related to the contact form filled in by the Website’s User; if necessary, to allow the Website’s User to access the reserved and personal areas without registering at each visit; to remember Your actions and preferences (such as login, language, font size and other display preferences) and if you have agreed (or not) to our use of cookies on this site Functional cookies. It enables S4M to improve the User experience, for example: to establish statistics and volumes of use and use of the various elements composing the Website, to better understand the behavior of S4M Website’s Users; Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can reject, delete or block these cookies, but if you do that some features of this site may not work as intended. If you want to block cookies, please refer to the following page: https://www.s4m.io/cookie-declaration/ 4.3 Retention To comply with applicable law, S4M deletes by default the Cookie processed through the Website within 13 months. At the end of this period, S4M shall ask again for your consent through the Cookie banner as explained above. 5. GENERAL PROVISION 5.1 CCPA CCPA rights. If you are a California consumer as defined by the CCPA, you may have the right to: (i) request access to your personal information and request additional details about our information practices, (ii) request deletion of your personal information, (iii) opt out of the “sale” of your personal information (as that term is defined by the CCPA), and (iv) to not be discriminated against for exercising any of your rights under the CCPA. Right to Know About Personal Information Collected and Disclosed. The CCPA requires us to disclose to California consumers the categories of personal information (as defined in the CCPA) we collect, our business and commercial purposes for collecting, using, or selling such personal information, the categories of sources from which we collect personal information, the categories of personal information we have disclosed or sold for a business or commercial purpose in the preceding 12 months, and the categories third parties with whom we share personal information. We have provided these disclosures above in this privacy policy. Right to Request Deletion of Personal Information. The CCPA requires us to allow California consumers to request the deletion of their personal information. Non-Discrimination for the Exercise of a Consumer’s Privacy Rights. At S4M, we ensure that any consumer (not just Californian consumers) does not receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA or any other local regulation. Right to Opt-Out of ‘Sales’ of Personal Information. S4M is a third-party business to which personal information is not sold and, more importantly, who does not sell your personal information. In certain circumstances, we will act as publishers’ service provider in handling data processed. In such a case, we will restrict the purposes for which personal information is being processed. It is publishers’ responsibility to let us know whether they consider us as their service provider. If you have any query regarding our privacy policy and practices or to exercise any of your rights, please contact us at privacy@s4m.io 5.2 Policy Updates S4M may revise this privacy policy from time to time. The date of the last update can be found at the top of this Policy. If we make any revisions that materially change or affect whether or how we collect or use personal data, a notice will be displayed at the top of this Policy. Therefore, you should review it periodically to be aware of our most up-to-date policies and practices. 5.3 Contact If you want to exercise your rights toward your personal data we might have collected, please contact our Data Protection Officer at privacy@s4m.io. If you have any questions about our privacy policy, please contact us at privacy@s4m.io You may also write to us at : SUCCESS 4 MOBILE SAS Attention to DPO 43 / 45 avenue de Clichy 75017 Paris 5.4 Governing law This Privacy Policy shall be governed by the laws of France without giving effect to applicable conflict of laws provisions. Each Party hereby agrees to the jurisdiction of the courts of Paris (France). PREVIOUS VERSIONS S4M-PRIVACY-POLICY-EFFECTIVE-AS-OF-MAY-9TH-2019 S4M PRIVACY POLICY – EFFECTIVE AS OF MARCH 4TH 2019 S4M PRIVACY POLICY – EFFECTIVE AS OF MAY 15TH 2018 PRIVACY POLICY LEGAL MENTION CODE OF CONDUCT TERMS AND CONDITIONS COPYRIGHT & TRADEMARK COOKIE DECLARATION © 2021 S4M. All rights reserved. PROUD MEMBERS OF FOLLOW US ON SOCIAL