Effective Date of Current Policy: December 23, 2019
Bounce Exchange is a member of the Internet Advertising Bureau and Network Advertising Initiative (“NAI”) and adheres to the 2018 NAI self-regulatory code, the Digital Advertising Alliance self-regulatory code and the IAB Europe OBA Framework.
The Types of Information that We Collect and How We Use it
The Websites and our general business operations
Our Websites are directed to our Clients, partners and vendors which are generally businesses. We collect two types of information from visitors to our Websites: personally identifiable information and pseudonymous information. Personally Identifiable Information (“PII”) is information that may be used to identify or locate an individual and includes email address, telephone number or postal address. We generally don’t collect PII via the Websites unless it is provided to us.
For example, if you purchase our products or Services we may request certain personally identifiable information from you on our order form. This includes contact information such as your name, email address, and address, as well as financial information such as a credit card number and its expiration date. We use this information for billing purposes and to fill orders. If we have trouble processing an order, we also will use this information to contact you. We do not sell this information and generally will only use it for the purpose it was provided.
In addition, if you contact us by email or otherwise provide your email address to us through our Websites, we may keep a record of your contact information and correspondence. We reserve the right to use your email address and any other PII that you provide to us to respond to your inquiries and to send you marketing materials for our own products and Services. We also reserve the right to share contact information you provide to us in connection with accessing certain content through our Websites (for example, webinars with industry partners) to our production partners or sponsors of such content. We will not otherwise share your contact information with outside parties for the purposes of marketing other products and Services to you without your consent.
We also collect pseudonymous information via the Websites such as the name of your internet service provider, the IP address of the computer or device you are using, the type of browser and operating system that you use, the date and time you access our Websites, the website referrer address and other log file information. Like most websites, our Websites use “pixel tags”, “web beacons”, “cookies” and/or similar tracking technologies that allow us to track the actions of visitors to our Websites as described here. We use this information to help us improve our Websites and the products, Services, applications, content and features that we provide. We also enable third parties to collect pseudonymous data via the Websites, and their use of that data may be considered a sale in California. We reserve the right to aggregate this information with similar data collected from other visitors to the Websites for any purpose, including publishing aggregate statistics about our Clients’ and/or Websites’ visitors.
The Ad Serving Platform
The Bounce Exchange ad serving Platform is designed to obtain pseudonymous information from websites, mobile applications and data partners and does not intentionally collect PII. The type of pseudonymous information collected via the ad serving Platform includes IP address, browser type, operating system, Internet Service Provider, referrer address, the time/date an ad is served and the site or mobile app that the ad is served in addition to other log file information. This information is used to offer products and Services designed to help our Clients better understand how their websites are being utilized, draw insights on how to better engage Users on their sites, to deliver more relevant advertising messages based upon the User visits to individual Client sites, and to provide Clients with ad delivery reports.
The Behavioral Automation Platform
Bounce Exchange collects email addresses and other PII such as telephone number via our behavioral automation Platform. We typically obtain this information from our Clients that collect it via online forms on Client websites. We process this data as a service provider and only use it as directed by our Clients. Our systems may access this information automatically as each data point is entered by a user into a particular web form in accordance with applicable law. We combine this PII with pseudonymous information also collected via Client websites such as a Client’s User ID, mobile o/s advertising ID, hashed user emails and/or other pseudonymous IDs to help our Clients with conversion tracking, site optimization and conversion. We may also collect an email address and a Client’s User ID when directed by a Client (e.g., when a user clicks on a link sent by one of our Clients via the Client’s email service provider.). Bounce Exchange and our Clients may also use this information to send customized and retargeted email, SMS and web push marketing messages to our Clients’ customers and prospective customers and we may use aggregate information to improve all of our Platforms, products or Services.
Web push notification messages are clickable rich content messages sent to your device via your browser. Web push notifications can be delivered to your device by an advertiser even when you are not on that advertiser’s web site and can only be sent to users who have opted-in to receive these notifications. To opt-out of web push notification messages, please check your browser settings. Most browsers allow you to control which websites are able to send you web push messages.
You can opt out of receiving any further marketing or promotional SMS messages from Bounce Exchange at any time by replying “STOP” to any SMS message you receive from Bounce Exchange. For help, reply “HELP” to any SMS message you receive from Bounce Exchange. In addition to any fee of which you are notified, your mobile provider’s standard message and data rates may apply to the SMS message correspondence with Bounce Exchange according to your individual rate plan provided by your wireless carrier. Please consult your mobile service carrier’s pricing plan to determine the charges for browsing data and sending and receiving SMS messages. Under no circumstances will Bounce Exchange or Bounce Exchange’s affiliates be responsible for any SMS messaging or wireless charges incurred by you or by a person that has access to your wireless device or telephone number. If your carrier does not permit SMS messages, you may not receive the SMS messages.
The Data Onboarding and Identity Platforms
The Data Onboarding Platform is designed to enable our Clients to activate their data in and across any marketing channel. As required by industry standards, we take steps to segregate any PII used for onboarding purposes from the pseudonymous information processed by our ad serving and interest based advertising platforms. As directed by our Clients, we process information such as hashed email addresses, cookie IDs, mobile advertising o/s IDs and other pseudonymous identifiers. We use this information to help us understand whether two devices are likely to be used by the same User or household. For example, where a User opens an email and we are able to place a cookie on that User’s browser, we may be to determine that this was the same User that had recently visited and logged into our Client’s website. Once we’ve established that linkage, we may use the information across Clients to enable Clients to onboard demographic data and other data onto profiles linked to those pseudonymous identifiers. This technology enables us to identify browsers and devices over time and across different websites via the Identify Platform. We also may enable Clients to leverage those pseudonymous identifiers to purchase advertising on digital media platforms. We are careful to segregate this data to ensure that neither Bounce Exchange nor our Clients are permitted to use information collected across non-affiliated Client sites and apps to personally identify and/or re-identify individual Users.
The Interest Based Ad Platform
Bounce Exchange also operates an Interest Based Advertising Ad Platform that enables our Clients to both create and utilize interest segments (e.g., frequent shopping, interest in fishing) from data collected across multiple non-affiliated websites or mobile apps. These segments are provided to us by Clients and third-party data partners and are attached to one or more pseudonymous identifiers described below for the purpose of delivering, customizing and reporting on advertising messages purchased via digital media platforms.
Our Services Dashboard
Employees of our Clients may provide contact information, such as their name and email addresses, in the Services Dashboard. We may use such contact information to message users of our Services to inform them about new releases, new functionality or services, training or other events being offered by Bounce Exchange that may be of interest to users of our Services, to provide important information about the Services (such as dates and times for scheduled maintenance), and for other purposes consistent with our ability to provide our Services and keep our Clients informed about our Services.
Additionally, when you access or use the Services Dashboard, we will track and collect usage data, such as the date and time you visited the Services Dashboard, what information and data have been accessed via the Services Dashboard and other interactions you have with the Services Dashboard. BounceX may use such data to determine the performance of the Services Dashboard, analyze how users of the Services Dashboard are utilizing our Services, identify potentially fraudulent or malicious activity, and for other purposes consistent with our ability to provide our Services and maintain or improve the Services Dashboard.
Profiles created by the BounceX Platforms
The BounceX platforms processes data to draw inferences about Users based upon website visits and mobile app usage. Some of our platforms also help our Clients collect email addresses. We use the collected information to create profiles the help us help our Clients engage their site visitors and bolster their advertising programs. Some examples of behaviors which generate profiles include: whether or not a visitor has visited a particular website, purchased something from that website, interacted with certain ads or other features placed on the website and/or submitted their email address to the website. We don’t create profiles which are considered sensitive or high risk under applicable law, and we don’t sell data via our platforms except as otherwise indicated. The profiles created by our platforms enable our Clients to offer a more engaging experience when you visit their websites.
The Tracking Technologies used by our Platforms and our Services
Our Platforms and our Services may utilize tracking technologies such as pixel tags, HTML5 cookies, HTTP cookies, web beacons, statistical identifiers, and mobile o/s advertising identifiers such as Apple’s IDFA, the Android Advertising ID and other pseudonymous information. For more information about cookies and web beacons, please visit allaboutcookies.org. Statistical identifiers are created when our systems read pseudonymous information about your computer or device, including the user agent, IP address, and the browser and operating system of your computer and device. Statistical identifiers enable our systems to determine within a reasonable level of certainty that they are encountering the same computer or device, including in environments where third-party cookies are not supported. If you want to see whether our Platforms are using a statistical identifier on the browser you are currently using, please visit http://optout.networkadvertising.org/#!/. If you would like to reset the value of this identifier, you may do so here. More information on this reset functionality under “choice mechanisms” below.
How We May Transfer the Information We Gather to Third Parties
Generally, we will not disclose the PII that we collect through your use of our Websites or the Services Dashboard to unaffiliated third parties without consent. We reserve the right, however, to provide such information to our affiliates, employees, contractors, agents, service providers and designees to the extent necessary to enable them to perform certain services for us, including order fulfillment and Websites-related services such as web hosting, to improve Websites-related services and features, to perform maintenance services, to distribute advertisements and other marketing materials on our behalf and to host our data. Other third-party service providers used by BounceX include: a) cloud computer, data storage and file storage providers, b) email marketing providers, c) website and b2b sales analytics providers, d) customer relationship management, contact database vendors, data hygiene vendors, survey vendors and project management software providers, e) customer billing systems partners, f) login authentication providers to ensure that the logins to our systems are working efficiently, g) social media platforms for advertising and marketing purposes, h) outsourced computer programmers helping ensure our systems are operating properly, i) auditing, debugging and security vendors. These agents work on our behalf and use data only as directed by us, provided that such third party agents provide at least the same level of privacy protection as we do.
BounceX may transfer data collected through BounceX’s website, marketing activities and the Services Dashboard, to entities such as: (i) website analytics vendors, who collect cookie and website engagement information to help understand website performance, (ii) advertising vendors, who collect cookie and website engagement information to target relevant advertising, and (iii) email marketing and lead database vendors, who collect email address and other personal information to improve email marketing efforts. Some of the transfers to these entities would constitute a sale of personal information.
Our platforms are designed to interact with a number of other affiliated technology platforms as described here. While we don’t operate a data marketplace, some of the transfers of data from the platforms may be considered a sale of personal information under California law. For example, where we use the Identity Platform to create pseudonymous IDs to identify browsers and devices over the past 12 months, we enable the use of those pseudonymous IDs across multiple Clients. Where we are acting as an agent (i.e., a service provider / data processor) for our Clients, we will transfer information as directed by such Clients. This collection and use is generally subject to our respective Clients’ privacy policies, not ours. We also reserve the right to disclose any personally identifiable information that we collect to any third party if we believe that we are required to do so for any or all of the following reasons: (i) to comply with the law; (ii) to comply with legal processes or governmental requests including sharing data of EU and Swiss individuals in response to lawful requests from public authorities to meet national security and law enforcement requirements; (iii) to prevent, investigate, detect, or prosecute criminal offenses or attacks on the technical integrity of our Websites or our network; and/or (iv) to protect the rights, property, safety and security of Bounce Exchange and its employees, our Websites’ visitors, and/or the public. Finally, we may transfer information, including any PII, to a successor entity in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change and will provide notice of such change on our Websites.
In the context of an onward transfer, Bounce Exchange is responsible for the processing of personal data it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Bounce Exchange shall remain liable under the Privacy Shield principles if its agent processes such personal data in a manner inconsistent with the principles, unless the organization proves that it is not responsible for the event giving rise to the damage.
Bounce Exchange supports high standards for digital privacy. We enable Users to opt-out from our Data Onboarding Platform and our Interest Based Ads Platform as described below.
Web based Opt-Out Choice Mechanisms. You can opt-out of our Data Onboarding Platform, and our Interest Based Ads Platform on your browser as follows:
When you opt out via the web based choice mechanisms described above, we will attempt to place an HTTP cookie that instructs us not to use information about your browser for IBA on our Data Onboarding Platform and our Interest Based Ads Platform.
If your browsers are configured to reject cookies when you visit our opt-out page, we cannot set our no-track cookie. Also, this choice mechanism is only applicable to the browser you are using, so if you subsequently erase your cookies, use a different computer or change web browsers, you will need to opt-out again.
Statistical device ID reset. BounceX also creates a non-cookie based statistical device-level pseudonymous identifier which is used in cookie-challenged environments. Information collected as outlined in “The Types of Information that We Collect” may be associated to this identifier over time. If you would like to reset the value of this identifier, you may do so here. This will effectively remove any associations between the identifier and any data that BounceX has collected. Note that any new data collected after resetting your identifier may resemble data previously collected if you engage in similar activities on websites.
Mobile App Opt-out Choice Mechanism. We honor the mobile device settings for Android and Apple iOS devices. To exercise this opt-out, please visit the privacy settings of your Android or iOS device and select “limit ad tracking” (Apple iOS) or “opt-out of interest based ads” (Android). For devices where we are able to see that such a selection has been made, we will not use information collected about your mobile app usage on our Data Onboarding Platform and our Interest Based Ads Platform. This choice mechanism is only applicable to the apps you are using on your current mobile device.
Precise Location Choices. If you’d like to adjust your choices regarding the use of precise location data by third parties such as Bounce Exchange, you may do so via your device settings. For your convenience, we provide links to instructions for both Apple iOS and Android devices. Also, most mobile applications that collect precise location information offer mechanisms to control the collection and use of precise location information. Please note that these choice mechanisms won’t impact previously collected precise location information.
Some of our Clients may utilize third-party advertisers on their websites. These third-party advertisers generally collect pseudonymous information across multiple non-affiliated websites and mobile apps to create interest segments for ad targeting and content customization purposes. This practice is sometimes referred to as interest based advertising (“IBA”) or online behavioral advertising (“OBA”) and is distinct from the Behavioral Automation Platform and Data Onboarding Platform offered by Bounce Exchange. To learn more about third-party advertising companies and your choices regarding how that information is used, please visit http://www.networkadvertising.org/managing/opt_out.asp, http://www.aboutads.info/choices/ or http://youronlinechoices.com/.
Where are systems are able to recognize a user initiated Do Not Track (DNT) setting in a browser, we treat that user as having opted-out from our sale of data under the CCPA.
Bounce Exchange ensures that SMS, email, web push and similar direct marketing messages sent using our behavioral automation Platform contain a choice mechanism as required by applicable law. To opt-out of web push notification messages, please check your browser settings. Most browsers allow you to control which websites are able to send you web push messages.
Bounce Exchange adheres to the Children’s Online Privacy Protection Act. Our Websites are not directed at children. If we are made aware that we have received personally identifiable information from someone under 18, we will use reasonable efforts to remove that information from our records.
We are Committed to Making Sure Your Information is Protected
Our physical, electronic, and procedural safeguards meet or exceed current industry standards regarding the protection of the information in our systems. We also require contractors and outside companies who work with us to adhere to strict privacy standards through their contracts with us. Unfortunately, no security system, or system of transmitting data over the Internet, can be guaranteed to be 100% secure. Consequently, while we use commercially reasonable efforts to protect information in our systems, we cannot guarantee the absolute security of our servers, the means by which information is transmitted between your computer and our servers, or any information provided to us or to any third party through or in connection with the Websites or Platform. Any information that you provide to us is done so entirely at your own risk.
Data Minimization and Retention
Bounce Exchange has internal procedures which are designed to ensure that we only process the minimum data required. We retain the IBA data that we collect for up to 13 months from the date of collection. Cookies used for IBA expire 13 months after they are last updated. EU data subjects may have additional rights or information as described below.
Data Subject Access Rights
Upon request, Bounce Exchange will provide you with information about whether we hold any of your PII. If you’d like to update, correct, delete, or deactivate any PII that you have provided to the company on this Website, please send your request to firstname.lastname@example.org, and we will process your request. We will respond to your request to access within a reasonable timeframe. EU and California data subjects may have additional access rights as described below.
In the Event We Engage in a Business Combination, We Reserve the Right to Transfer Any Information in Our Systems.
If we sell all or any part of our business or sell or transfer all or a material part of our assets or are otherwise involved in a merger or other transfer or disposition of any part our business, we reserve the right to access, transfer or disclose any and all information that we collect from our Websites’ visitors, or that we otherwise collect in connection with the Websites or Platform, to the party or parties involved in the transaction as part of that transaction.
CALIFORNIA DATA SUBJECTS
Effective January 1, 2020, the California Consumer Privacy Act (CCPA) provides additional privacy protections for California data subjects and users, including: a) the right to see what data we have about you, your computer or device (i.e., the right to know), b) the right to delete the data we have about you, your computer or device (i.e., the right to delete) and c) the right to opt-out of the sale of data about you, your computer or device to certain third parties (i.e., the right to opt-out from sales of your information). We do not discriminate against you if you exercise any of the above rights. Moreover, we may not be able to honor a right if doing so would violate applicable law.
Further details about exercising these rights can be found on our our data request page. You may access those rights with respect to Bounce Exchange by sending us an email to privacyrequests@bouncexcom.
Special Data Protections for EU Data Subjects.
As of May 25, 2018, the General Data Privacy Regulation (“GDPR”) affords additional rights to EU data subjects such as:
These rights can be exercised by visiting our data request page. Moreover, with respect to EU data subjects, PII (sometimes referred to as personal data) includes pseudonymous data such as an IP address, a mobile advertising ID or a cookie ID. Where BounceX is a processor of data (e.g., via the Behavioral Automation or Ad Serving Platforms), the legal basis for processing such data and the retention period is determined by our Clients. Where BounceX is a controller of data (e.g., via the Interest Based Advertising or Data Onboarding Platforms), the legal basis will be both legitimate interest (e.g., where we have evaluated that our interests are not overridden by Users’ fundamental rights) and consent depending on the type of information subject to processing and the information we receive from upstream partners. Where BounceX receives from an EU data subject a request to cease processing of data via one of the choice mechanisms listed above, BounceX will stop all data processing with respect to the opted out browser or device unless such processing is required by law and we use both HTTP and HTML5 opt-out cookies to record your objection in order to better protect it. BounceX’s Data Protection Officer is data protection officer and EU representative Dr. Christoph Bauer, CEO at ePrivacy GmbH and he may be contacted at email@example.com or by mailing to the address found below.
As a business subject to the investigatory and enforcement authority of the United States Federal Trade Commission, BounceX has certified that its U.S. operations adhere to the Privacy Shield with respect to the personal data that BounceX receives in reliance on the Privacy Shield.
Our Websites may Contain Links to Other Websites.
Contact Bounce Exchange Regarding Our Privacy Practices.
Ryan Urban, CEO
Bounce Exchange, Inc.
Attn: Privacy Officer
1 World Trade Center, FL 74
New York, NY 10007
Enforcement and Privacy Complaints by EU and Swiss Citizens
For human resources personal data that BounceX receives under the Privacy Shield (defined under Privacy Shield essentially as information about an employee collected in the context of the employment relationship): cooperation with the relevant data protection authority (which is usually the one where the employee works).
Please note that if your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel.