Privacy Policy

Last Updated: March 15, 2018

Index Exchange, Inc. (“Index Exchange”) believes in all Internet users’ rights to privacy. This Policy explains the information collection, use, and disclosure practices of Index Exchange. It applies to all information received by Index Exchange whether in electronic, paper or verbal format.

The Index Exchange Business

The Index Exchange Online Advertising Exchange (“Index Platform”) prides itself on providing an atmosphere that is non-disruptive to Internet users. Our proprietary targeting methodologies enable advertisers to effectively target their campaigns to the audience(s) they are looking to reach without engaging in profiling practices. Services offered by Index Exchange include a Web-based advertising exchange marketplace that enables publishers, advertisers, and ad networks to efficiently market, buy and sell digital and mobile advertising and ad inventory.

Through its ad server, Index Exchange also acts as a service provider to enable its publishers, advertisers, ad networks and other clients to collect and use data for advertising purposes on their digital and mobile platforms across the Internet.  Publishers may use our services to process consumer data, which they collect or source. Their data collection, use, and sharing practices may be governed by their own privacy policies and differ from those found in Index Exchange’s Privacy Policy. We encourage you to refer to the privacy policies of any websites you visit and apps you use, to learn about their privacy practices before disclosing any personal information to them.

Industry Self-Regulation

Index Exchange prides itself on conducting business in a transparent and open manner. In line with those values, we support efforts for self-regulation in the internet-based advertising industry.

NAI

Index Exchange is a member in good standing of the Network Advertising Initiative (NAI), a cooperative of online marketing and analytics companies committed to responsible data collection for digital advertising, building consumer awareness, and establishing responsible business and data management practices and standards. Index Exchange adheres to the NAI Code of Conduct in all its operations.

DAAC

Index Exchange adheres to the standards and practices outlined by The Digital Advertising Alliance of Canada, a consortium of the leading national advertising and marketing trade associations, promoting a self-regulatory program for online interest-based advertising. More information on the program can be found here. 

Information Collection, Use, and Sharing

In general, like most standard website servers, Index Exchange uses log files to track transactions. These log files include internet protocol (IP) addresses, browser types used, the internet service provider (ISP) utilised, referring/exit pages, platform type, date/time stamps, and number of clicks. This information is then used to analyze trends, administer the site, aggregately track user movement, and target advertisements to users accordingly. Index Exchange does not collect a website user’s Personally Identifiable Information (PII) as defined under United States federal law. However, in the course of and for purposes of conducting its business, Index Exchange may collect and process the following consumer information that is considered Personal Information (PI)  under the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) or Personal Data under the European Union’s General Data Protection Regulation (GDPR):

(1) browser and device information received from publishers is shared with advertisers and agencies for responding to requests for advertisements, forecast advertising inventory and troubleshooting any operation issues related to the Index Platform;

(2) IP addresses, including both IPv4 and IPv6 are used to bid on advertising inventory;

(3) geo-location data is used to bid on advertising inventory;

(4) Precise Location Data (data obtained from a device about the physical location of the device) is used to bid on advertising inventory;

(5) GPS coordinates, where available;

(6) unique Index Exchange UserIDs, stored in browser cookies, are used for profiles on the ad server;

(7) mobile device identifiers are used to track mobile traffic and are shared with advertisers and agencies to tailor the advertising experience;

(8) Pixel Data (data obtained through or in connection with the placement of any pixel mechanism) is used as part of the user matching process;

(9) people identifiers provided by Index Exchange’s partners are associated to audience segments, and shared with advertisers and agencies;

(10)   data on whether a user viewed or clicked on an Ad is shared with advertisers and agencies.

 

Index Exchange’s internal processes treat personal data in accordance with regulatory requirements and applicable privacy laws to ensure that information is stored securely and used only for allowed and intended purposes.

Index Exchange may combine information that does not directly identify an individual with data collected from other sources to provide publishers, advertisers and ad networks with information to improve the relevance of advertising presented to users and determine whether to bid on ad inventory. Any information shared with advertisers and publishers within the Index Exchange Online Advertising Exchange is done so in an aggregate fashion. This means that clients only receive information about users targeted by advertisements in a format with broad percentages.

In addition, although Index Exchange does not directly engage in Cross-App Advertising, our technology may collect and/or pass through Mobile Device IDs (the unique identifier assigned to a device by the manufacturer) or Advertising IDs (for iOS 6 and later), instead of cookies, to recognize you.

Do Not Track Signal

Index Exchange does not honor the ‘DNT’ browser signal. Instead, we utilize the cookie based opt-out mechanisms to allow users to opt-out of all advertising. For more information, please see the “Your Choices” section below.

Cross-Device Linking

Cross-Device Linking is the process of making assumptions that certain devices are related to each other, i.e. they belong to the same user/household. Index Exchange may engage in Cross Device Linking for personalized advertising, ad delivery, and reporting. If you would like to opt-out of having Cross-Device Linking used by Index Exchange on your devices, please see the “Your Choices” section below.

Cookies

A cookie is a small amount of data, which often includes a unique identifier that is sent to your browser from a website’s computer and stored on your computer’s hard drive. Index Exchange uses both session and persistent cookies on our website. These are needed for site navigation and to perform aggregate analysis of what is viewed on our site. Cookies are considered Personal Data under the General Data Protection Regulation.

The Index Platform uses cookies for tracking when an Internet user has seen an advertisement. These cookies serve two purposes:

  1. To inform the Index Platform if an advertisement has been served to the same computer before, and if so, when the advertisement was served. These cookies are not used by Index Exchange to build a profile of a user’s behavior nor are they used by Index Exchange for the purposes of behavioral tracking or behavioral targeting.
  2. To facilitate retargeting at a campaign level. Retargeting is the process of serving an ad from a particular advertiser to a user, based on the fact that the user has previously visited the advertiser’s website. Retargeting occurs within the confines of a user-to-advertiser relationship, and is not available for general targeting on Index Exchange. Retargeting is not available for Sensitive Data as defined by the General Data Protection Regulation. 

Personally Identifiable Information and Personal Data of Index Exchange Members

Registering to become a member of the Index Platform, either as an advertiser or a publisher, requires the submission of PI, PII or Personal Data to Index Exchange. This can include the full name, mailing and/or billing address, email address, company name, and website URL. Index Exchange uses this information to service its accounts and respond to inbound inquiries related to sales or technical support requests. Communications to business users are related to the Advertising Exchange. All such information submitted is held by Index Exchange in strict confidence and as prescribed by corresponding regulatory authorities.

Index Exchange does not engage in any form of distribution or sale of PII, PI or Personal Data to third parties for their own promotional use. Index Exchange does not sell, supply, or otherwise make user PII, PI or Personal Data available to any third party under any circumstances, unless ordered to do so by a court of competent jurisdiction.

Information Obtained from Third Parties

Index Exchange may obtain data from third party companies for the purpose of informing ad selection. This data is supplied in aggregate form and may include Personal Data as defined under the GDPR. Advertisers who are clients of Index Exchange may collect PII and Personal Data on their own websites. These details are provided directly by the individual Internet user through online order forms, contests, etc. PII or Personal Data provided through an advertiser’s website is not visible to Index Exchange while being entered, nor provided to Index Exchange at any time in the future. This personal data collected by the advertiser is subject to the privacy policy of the individual advertiser involved.

Your Choices

 Web Browser Option to Opt-Out

Some of the ads you see on the internet or in applications on your mobile device are tailored to your interests and based on your activity online or in the applications on your mobile device. This type of ad tailoring — sometimes called “interest-based” or “online behavioral” advertising — is enabled through various technologies, including browser cookies, mobile advertising identifiers as well as other non-cookie technologies. Tailored digital ads help support the free products, services and content you enjoy online. To help protect your privacy, Index Exchange (along with other NAI members) has voluntarily agreed to abide by high NAI standards including offering an opt-out mechanism.

Opting out of interest-based advertising means that you will no longer be shown ads that have been tailored to your interests. It does not mean you will no longer see advertising online. When you opt-out, an opt-out cookie will be stored in your web browser signaling your opt-out preference to NAI members including Index Exchange.

Please note that if your browser is configured to block third-party cookies, then the opt out cookie may not work. If you delete your browser cookies, you will need to opt out again. The opt-out will not apply to the specific browser in which you set it. The opt-out process must be repeated for each different browser.

CLICK HERE TO OPT-OUT

Access to information

Applicable privacy laws may allow you the right to access and/or request the correction of errors or omissions in your personal data. You may also have the right to have personal data deleted. To make a request, or if you need assistance with this process, please contact us.  If you have a complaint regarding a response to your request to access information, please contact our Data Protection Officer:

Lucid Privacy Group

Address:

Attn: Index Exchange Data Protection Officer

Lucid Privacy Group

1556 Shrader Street

San Francisco, CA 94117

USA

Email: dpo@lucidprivacy.io

Data Retention

Index Exchange may retain data for as long as needed to provide services. We may retain data even after an account has been closed or is no longer engaged in business with Index Exchange if retention is reasonably necessary to comply with our legal obligations or meet regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our Privacy Policy or our contractual obligations. We also retain personal data for as long as is necessary to provide support-related reporting and trend analysis which is thirteen (13) months. After 13 months, we de-personalize data by creating aggregate data sets that cannot be traced back to individuals. Personal data will be destroyed according to our data destruction process.

Security

Index Exchange follows strict Information Security policies to protect personal data submitted to us, both during transmission and once we receive it. Although we take steps to secure your information, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

In the unlikely event of a confirmed security breach, Index Exchange will investigate and contact impacted persons within 72 hours of the breach.

We reserve the right to disclose your personal data as required by law, in response to a subpoena or similar investigative demand, a court order, or a request for cooperation from a law enforcement or other government agency; when we believe that disclosure is necessary to protect or exercise our legal rights; or to defend against legal claims.

 

Changes to this Privacy Policy

Index Exchange may find it necessary to update this Privacy Policy from time to time. Any changes will be posted at this site. Except as otherwise required by law, any modifications made to this Privacy Policy will not materially affect the privacy of data collected by Index Exchange prior to the effective date of the policy change.

 

Contact Us

To inquire about privacy concerns, please contact Index Exchange by mail, as detailed below, or using our online form.

Index Exchange

74 Wingold Avenue

Toronto, Ontario M6B1P5 Canada

Designated Privacy Officer

Drew Bradstock

Index Exchange processes PI, PII and Personal Data in accordance with this Privacy Policy. In addition to Index Exchange being a controller, other controllers may exist depending on the use of your Personal Data. If you have questions regarding the collection and use of Personal Data, please contact our Designated Privacy Officer who will direct any inquiries to the proper controller as applicable.

Any user who has consented to the use of their Personal Data by Index Exchange in accordance with the uses disclosed in this Privacy Policy, has the right to withdraw their consent to such use. In order to withdraw your consent, please contact our Designated Privacy Officer.