iq digital's privacy policy on the marketing of advertising space on third-party websites

1. Role of iq digital in the marketing of websites; responsibility for data protection; scope of this privacy policy

You have found the link to this privacy policy on a website whose advertising spaces are marketed by iq digital media markteting GmbH, Toulouser Allee 27, 40211 Düsseldorf ("iq digital").

The respective website operator is responsible for the personal data processed in this context. You can find the contact details of the website operator in the privacy policy and the legal notice of the respective website.

iq digital works together with other parties when processing the personal data concerning you. Sometimes iq digital acts on behalf of and under the instruction of third party website operators or service providers (in particular "vendors" within the meaning of section 2), so that iq digital acts as a processor and has concluded a contract with the respective website or service operators for the processing of personal data on behalf of Art. 28 GDPR. In some cases, iq digital also decides jointly with third-party website operators or service providers (in particular "vendors" within the meaning of Section 2) on the means and purposes of the data processing that takes place, so that iq digital is to be regarded as a joint controller with them in accordance with Art. 26 GDPR and has concluded a corresponding agreement.

In this data protection declaration, iq digital informs you on behalf of the respective website operator about the data processing procedures that take place as part of the marketing of the advertising spaces by iq digital.

For other data processing operations that take place on the website of customers (including any processing of personal data for advertising purposes by the customers themselves), reference is hereby made to the privacy policy of the respective customer.

2. General information on the involvement of partners ("vendors")

iq digital uses a large number of partners who provide various technologies and advertising networks to market the advertising spaces. These partners help to display advertising that is tailored to the interests of iq digital's customers and at the same time makes the most economic sense on their websites. These partners are also referred to below as vendors. All vendors are listed below, sorted according to their respective purpose and the purpose of data processing.

Some vendors who are directly involved in the selection of a suitable advertising medium are direct contractual partners of iq digital. Many other vendors only become active as part of a selected advertising medium and help to determine the success of the advertising (e.g. the length of time a banner was visible on a screen). Many of these vendors, which are used to measure success or reach, are not contractual partners of iq digital; their use is typically decided by the advertising companies. Nevertheless, all vendors that are active in connection with iq digital's activities are included in the list below.

The vendors do not receive any "real names" or other unique identifiers such as an address or date of birth. Instead, the vendors only receive pseudonymous information, such as a cookie ID or an IP address. Nevertheless, this data is also regularly personal data.

It is possible that the website operator whose advertising spaces are marketed by us has also implemented other vendors on its website. Consequently, you may not find all vendors that are active on the websites of iq digital's customers in the list below. For further information on vendors that are not integrated by iq digital but by iq digital's customers, please refer to our customers' privacy policies.

3. Your choice of vendors; revocation of the declaration of consent; opt-outIhre Auswahl der Vendoren; Widerruf der Einwilligungserklärung; Opt-Out

If you have given a comprehensive declaration of consent on our customers' website, all of the vendors listed below may be active on the corresponding website. Which vendor is involved in playing which advertising material in which individual case depends on many factors, e.g. which vendors have already stored detailed information about your interests in the cookies stored on your end device.

If, instead of your global consent, you have only permitted individual vendors to process your personal data, only these vendors will process your data on our behalf (for the sake of completeness, however, all of the vendors generally used by us are listed below).

You can revoke your declaration of consent at any time with effect for the future or give your opt-out to each individual vendor (or for all vendors). For this purpose, we refer you to the "Privacy Center", which is included in the privacy policy of our customers. There are also the following alternative ways to declare an opt-out:

Open the privacy policy of the respective vendor (you will find the link in the list of vendors below). An opt-out option is provided in the vendor's privacy policy.
Activate the "Do not track" function in your browser (Note: If you deactivate the setting of cookies in your browser, you will prevent the activity of many but not all vendors; this is because some vendors use similar technologies for identification in addition to cookies (see section 6 below).
Set your preferences on the "youronlinechoices" website. https://www.youronlinechoices.com/ch-de/praferenzmanagement

4. IAB TCF 2.2 („Transparancy and Consent Framework“)

iq digital only permits and integrates advertisements on its customers' websites that comply with the rules of the IAB TCF.

The Transparency and Consent Framework ("TCF") is a set of rules for online marketing issued by the Interactive Advertising Bureau Europe ("IAB Europe"), an industry association for online marketing. (see general information on IAB Europe here: https://iabeurope.eu/about-us/ ). Version 2.2 of the IAB TCF is currently used (see general information on the IAB TCF 2.2 here: https://stg-iabeurope-iabeuropeold.kinsta.cloud/iab-europe-transparency-consent-framework-policies/). All references to the IAB TCF in the following refer to its current version 2.2.

The IAB TCF defines strict rules which, according to the IAB Eurpoe, ensure GDPR compliance and the fulfilment of all other European data protection requirements through standardization. iq digital therefore only works with vendors who have subjected themselves to compliance with the rules of the IAB TCF and who have been included in the so-called "Global Vendor List" after an audit (see https://iabeurope.eu/vendor-list/).

5. Declaration of consent as a basis for permission for advertising purposes and the creation of profiles

The processing of personal data for advertising purposes is based on your declaration of consent, which you gave when you accessed our customers' website (if you have not given your declaration of consent or have only given it for certain vendors, the corresponding data processing will not take place; the same applies if you have revoked your declaration of consent. To revoke your declaration of consent, please refer to the "Privacy Center", which is included in our customers' privacy policy (see explanation under 3.).

According to the IAB TCF, your consent relates to the following data processing purposes (so-called "purposes", see also the table of data processing purposes at https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/):

For all processing purposes, the storage and/or retrieval of information from a user's terminal device is necessary (Purpose 1 according to IAB TCF). For this purpose, vendors can:
- Store and retrieve information such as cookies and device identifiers and similar online identifiers on the device for the processing purposes indicated to the user.
Selection of simple ads (Purpose 2 nach IAB TCF)
- For the selection of simple ads, vendors can:
  - use real-time information about the context in which the ad is displayed, including information about the content environment and the device used for an interaction, e.g. device type and functions, browser ID, URL, app, IP address;
  - use the approximate location data of a user;
  - control the frequency of ad impressions;
  - control the order in which ads are displayed;
  - prevent an ad from being displayed in an inappropriate editorial environment (brand-unsafe).

Create a personalized ad profile (Purpose 3 according to IAB TCF)
- To create a personalized ad profile, Vendors:
  - collect information about a user, including their activities, interests, visits to websites or use of applications, demographic information or location, in order to create or edit a user profile for the personalization of content and advertisements by combining it with previously stored information.
Select personalized ads (Purpose 4 according to IAB TCF)
- For the selection of personalized ads, vendors can:
- Select personalized ads based on a user profile or other historical usage data, including past activity, interests, visits to other websites or app usage, location or demographic information.

Create a personalized content profile (Purpose 5 nach IAB TCF)
- To create a personalized content profile, Vendors:
  - collect information about a user, including their activities, interests, visits to websites or use of applications, demographic information or location, in order to create or edit a user profile for the personalization of content. The user profile may also be used to present content that appears more relevant based on possible user interests, for example by adjusting the order in which content is displayed so that users can more easily find content that matches their interests.

Select personalized content (Purpose 6 nach IAB TCF)
- To select personalized content, Vendors:
  - Select personalized content based on a user profile or other historical usage data, including previous activities, potential interests, visits to websites or use of applications, location or demographic information and other personal aspects. Personalization of content may also include adjusting the order in which content is displayed to make it easier for users to find content that matches their interests.

These categories of data processing purposes are specified in the formulation given here by the IAB TCF rules. The vendors approved by iq digital undertake to use precisely these categories of data processing purposes (see https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/). Not every vendor pursues every stated purpose. Under 8. you can find out which vendors pursue which purposes. The data processing activities and data processing purposes are explained in more detail in the privacy policies of the individual vendors linked below.

6. Declaration of consent and legitimate interest as justification for permission for analysis purposes, reach measurement and product improvement

In addition to the purposes listed under 5, individual providers process personal data for the following additional purposes. The providers base this partly on your declaration of consent and partly on a legitimate interest. You can find out which legal basis is used by which provider in the detailed information under 8.

Measure content performance (Purpose 8 nach IAB TCF)
- To measure the performance of content, vendors can:
  - measure and report on how content was delivered to users and how they interacted with it;
  - measure and report on whether content reached its target audience and matched their interests, e.g. whether an article was read, a video watched, a podcast listened to or a product description viewed;
  - provide reports on directly measurable or already known information from users who have interacted with the content.
Use market research to gain insights into target groups (Purpose 9 nach IAB TCF)

o In order to measure target groups for advertising campaigns or content, Vendors:

- create reports based on data sets (such as user profiles, statistics, market research and analytics data) about user interactions.
Develop and improve products and services (Purpose 10 nach IAB TCF)
- In order to develop and improve products and services, vendors can:
  - use information to improve their existing products and services with new functions and to develop new products and services, whereby explicitly no development or improvement of user profiles or user identification is undertaken;
  - create new computational models and algorithms using machine learning.
Use of limited data for content selection (Purpose 11 nach IAB TCF)
- To improve the presentation of content, Vendors:
- Access limited information, such as the website visited, the app used, the device type, the approximate location or the content interacted with. This can be used, for example, to limit the frequency with which a video or article is displayed.

Some vendors base this data processing for the above-mentioned purposes on the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The vendors' interest is to measure the performance of ads and content and to improve and further develop their products. You can see from the list below which vendors are relying on this. For all purposes mentioned in this section, no user profiles are used and the information about specific interests of users is not used.

7. Standardized functions for data processing according to the IAB TCF

According to the IAB TCF, the functions (so-called features) that can be used by vendors to process personal data concerning you for the purposes mentioned under 5. and 6. are also standardized. This serves both to comply with your data protection preferences and to exchange the information required for data processing.

There are a total of three features that vendors can use to process data concerning you for all of the aforementioned purposes:

Comparison and combination of data from other sources (Feature 1 nach IAB TCF)

o Information about your activity on a website can be compared and combined by Vendors with other personal data relating to you from various sources (e.g. other websites, survey participation, etc.).

Linking different devices (Feature 2 nach IAB TCF)

o To support data processing, vendors may consider your device to be likely connected to another device in your household (e.g. because both devices use the same internet connection).

Identification of devices based on automatically transmitted information (Feature 3 nach IAB TCF)

o Your device can be distinguished from other devices by vendors on the basis of the information it automatically sends when accessing the Internet (e.g. IP address or browser data).

There are also two special features that may only be used with your consent:
Use of precise location data (Special Feature 1 nach IAB TCF)

o Your location can be localized by vendors within a radius of less than 500 m.

Active scanning of device properties for identification (Special Feature 2 nach IAB TCF)

o To distinguish your device from other devices, vendors can query and use certain features of your device (e.g. fonts, plugins or screen resolution).

8. Overview of the partners/vendors and the purposes for which they process personal data in accordance with IAB TCF

See the overview

9. Advertising material in newsletters

We take over the display of advertising material in newsletters for our partners. For this purpose, a connection to the ad server of Passendo ApS, Tagensvej 85F, 2200 København, Denmark ("Passendo") is established when the newsletter is called up and the respective advertising material is retrieved from this ad server. Your IP address is necessarily transmitted in the process. Passendo is a service provider of ours that processes the data exclusively on behalf of and under the instruction of us or the provider of the newsletter. The data is processed exclusively within the EU.

In order to determine the success of the advertising material (e.g. to determine how often a newsletter was opened and an advertising material was clicked on), parts of the data provided to register for the newsletter are converted into a hash value and transmitted to Passendo. It is not possible to draw any conclusions about the data originally provided from this hash value.

The IP address and the hash value are not used in this context to create an advertising profile. The advertising playout shown here only concerns non-personalized advertising and only the statistical analysis of the success of the advertising media.

The respective provider of the newsletter is responsible for the personal data processed in this context. You can find their contact details in the respective newsletter.

10. general information on cookies and similar technologies

Cookies are small text files that are stored on your end device by the browser you use when you visit our customers' websites. Individual services of a website and in particular the vendors used by iq digital can "recognize" you in this way and "remember" which settings you have made. This is used, among other things, to carry out personalized online advertising.

Some cookies are automatically deleted from your end device as soon as you leave the website (so-called session cookies). Other cookies are stored for a specific period of time, which generally does not exceed two years (persistent cookies). You can find out which cookies are used by which vendor and how long they are stored for in the vendors' privacy policies linked below.

However, the "recognition" of a specific end device is not only carried out via cookies, but also via other similar technologies and in particular data that is read from your end device (e.g. the device ID of your end device, the MAC address of your end device, information about the settings of a browser (so-called browser fingerprint) or the system settings). You can find out which technology is used for user recognition by which vendor in the vendors' privacy policies linked below.

11. storage period

iq digital itself does not store any user profiles in the long term (short-term storage for the purpose of displaying advertising and measuring reach is not excluded).

The vendors store the pseudonymous user profile for a longer period of time, although the individual information about users is usually only stored for a few weeks. Other personal data (e.g. the customer's IP address, which is collected for technical reasons) is only stored for a short period of time. You can find more detailed information on this in the vendors' privacy policies linked in section 8.

Privacy Policy

We, iq digital media marketing gmbh, appreciate your visit to our website https://www.iqdigital.de/ and your interest in our company and our services. The protection of your personal data is important to us. We want you to feel safe and comfortable when you visit our website. In this privacy policy, we inform you about which of your personal data we process when you visit our website and what rights you have in relation to your data.

Data controller
The controller for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is
iq digital media marketing gmbh
Toulouser Allee 27
40211 Düsseldorf
Phone: +49 211 887-0
E-mail: info@iqdigital.de

Data protection officer
You can contact our data protection officer at any time with questions or concerns about data protection:
DEGECO Deutsche Gesellschaft für Compliance mbH
Domberger Str. 27
33615 Bielefeld
E-mail: datenschutz@iqdigital.de

Personal data
According to Art. 4 No. 1 GDPR, personal data is information that can be used to identify or determine a person, i.e. information that can be traced back to a person. This typically includes the name, email address or telephone number. However, purely technical data that can be assigned to a person is also considered personal data.

Purposes, legal bases and storage duration of data processing
We process your personal data for various purposes and on the basis of various legal grounds.

Server log files
If you visit our website purely for information purposes, i.e. without transmitting any other information to us, we only collect the personal data that your browser transmits to our server (so-called server log files). These are
o IP address
o Date and time of the request
o Time zone difference to Greenwich Mean Time (GMT)
o Content of the request (specific page)
o Access status/HTTP status code
o amount of data transferred in each case
o Browser, its language setting and version
o operating system

The processing of this data is technically necessary in order to display our website to you and to ensure its stability and security. The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR, whereby our legitimate interest lies in the provision and optimization of our website and its protection against unauthorized access. You can object to this data processing at any time in accordance with Art. 21 GDPR if there are reasons arising from your particular situation that speak against data processing. All you need to do is send an email to: datenschutz@iqdigital.de.
Server log files are stored for a maximum of 30 days.

What is an IP address?
Every device (e.g. smartphone, tablet, PC) that is connected to the internet is assigned an IP address. Which IP address this is depends on the Internet access via which your device is currently connected to the Internet. It may be the IP address assigned to you by your Internet provider, for example if you are connected to the Internet at home via your Wi-Fi. However, it can also be an IP address assigned to you by your mobile phone provider or the IP address of a provider of a public or private Wi-Fi or other Internet access. In its most common form at present, the IP address consists of blocks of numbers. As a private user, you will not usually use a constant IP address, as this will only be assigned to you temporarily by your provider ("dynamic IP address"). With a permanently assigned IP address ("static IP address"), it is in principle easier to clearly assign the user data. Except for the purpose of tracking unauthorized access to our website, we do not use this data for personal purposes, but only evaluate on an anonymous basis which of our websites are favored, how many accesses are made daily and the like.

Contacting us via the website
If you contact us, e.g. via our contact form, our e-mail address or our telephone number, we process your data in order to answer your inquiry and, if necessary, to take further steps. The legal basis for this data processing is Art. 6 para. 1 lit. b GDPR, insofar as your request is aimed at the conclusion or execution of a contract with us, or Art. 6 para. 1 lit. f GDPR, whereby our legitimate interest lies in the satisfactory processing and answering of your request.

Cookies
We use cookies on our website to provide you with a comfortable and functional use of our website, to save your preferences, to measure the reach and user behavior on our website. Cookies are small text files that are stored on your end device and contain certain information about your surfing behavior and interests. You can change your cookie settings at any time via the corresponding link on our website or revoke your consent. You can also generally prevent or restrict the storage of cookies in your browser by making the appropriate settings in your browser. Please note, however, that this may impair the functionality and convenience of our website. You can also arrange for cookies that are already stored on your end device to be deleted in your browser or activate automatic deletion when you close your browser.

Necessary cookies (sourcepoint and own cookie): Necessary cookies are essential for the operation and security of our website and enable you, for example, to navigate our website or use certain functions. We use two types of necessary cookies, namely a cookie provided by us to store the selected language preference for the texts on our website, as well as cookies from Sourcepoint Technologies Inc. These cookies are stored for a maximum of one year. You can view more detailed information on the storage duration of individual cookies in the data protection settings. The legal basis for data processing using these cookies is Art. 6 para. 1 lit. f GDPR, whereby our legitimate interest lies in the provision and optimization of our website. Consent for the general use of necessary cookies is not required in accordance with Section 25 (2) No. 2 of the TDDDG.

Adobe Analytics
We use Adobe Analytics on our website, a web analytics service provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland ("Adobe"). Adobe Analytics uses cookies and similar technologies to analyze and improve our website based on your user behavior. This includes, for example, information about whether you have read a particular article, watched a particular video, listened to a particular podcast or viewed a particular product description, how much time you have spent on this service and the websites you have visited, etc. This information helps to determine the relevance of content that is displayed to you.
The legal basis for the use of Adobe Analytics is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you give when you first visit our website and which you can revoke at any time with effect for the future, e.g. via the cookie settings on our website.

We have concluded an order processing contract with Adobe in accordance with Art. 28 GDPR and fully implement the strict requirements of the German data protection authorities when using Adobe Analytics. Adobe Inc. is certified under the EU-U.S. Data Privacy Framework and thus guarantees an adequate level of data protection when processing your data in the USA if your data is transferred there. You can find more information about Adobe Analytics and data protection at Adobe at https://www.adobe.com/de/privacy.html. We ourselves do not intend to transfer your data to third countries. The Adobe Analytics technology has a storage period of one browser session.

YouTube
We use the provider YouTube for the integration of videos. YouTube is operated by YouTube, LLC, headquartered at 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube is represented by Google LLC, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

If websites on which YouTube content is integrated are accessed, a connection to the YouTube servers is established to display the video. This tells the YouTube server which website you have visited. If you are logged in to YouTube during this time, YouTube assigns this information to your personal user account. If you interact with the content, e.g. by clicking on the start button of a video, this information is also assigned to your user account. You can prevent this assignment by logging out of your YouTube user account and other user accounts of YouTube LLC and Google LLC before using our website and deleting the corresponding cookies of the companies.

The legal basis for the use of YouTube is your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you give on your first visit to our website and can revoke at any time with effect for the future, e.g. via the cookie settings on our website.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: www.google.de/intl/de/policies/privacy. Google may also process your personal data in the USA. Google is also certified under the EU-U.S. Data Privacy Framework and thus guarantees an adequate level of data protection when processing your data in the USA, if your data is transferred there.

The storage period for YouTube cookies is 6 months.

Your rights
In accordance with Art. 15 GDPR, you have the right to receive information about the personal data we store about you free of charge upon request. In addition, you have the right to rectification of inaccurate data (Art. 16 GDPR) and the right to erasure (Art. 17 GDPR) of your personal data, provided that this does not conflict with a statutory retention obligation or a permission that allows us to process the data. In accordance with Art. 20 GDPR, you also have the right to request that we return the data that you have provided to us (right to data portability).
In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with a data protection supervisory authority at any time. The supervisory authority responsible for us is
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
P.O. Box 20 04 44
40102 Düsseldorf
Telephone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de.
You can also contact the supervisory authority of your place of residence or work or any other data protection supervisory authority in Europe.

If you have given us your consent to process your data, you can withdraw this consent at any time with effect for the future without affecting the lawfulness of processing based on consent before its withdrawal. You can declare your revocation, for example, by sending an e-mail to datenschutz@iqdigital.de.
You also have the right to object, on grounds relating to your particular situation, at any time to processing of your data which is based on point (f) of Art. 6(1) GDPR (legitimate interests), e.g. by sending an email to datenschutz@iqdigital.de. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. If we process your data for direct marketing purposes, you have the right to object at any time without giving reasons. In this case, we will no longer process your data for these purposes.

Changes to this privacy policy
We reserve the right to amend this privacy policy at any time in order to adapt it to changed legal, technical or business requirements. The current version of this privacy policy can be found on our website. Please check regularly to see if there have been any updates or changes to our privacy policy. If you have any questions or comments about this privacy policy, you can contact our data protection officer at any time.