Privacy Policy
This policy explains what we collect, why we collect it, the legal basis we rely on, and the control you have over it. It covers our website, the publisher dashboard and the ad technology we run on our publishers' sites.
What this policy covers
This Privacy Policy explains the difference between personal and non-personal information, how your information is collected, the choices you have over the personal information you give us, how Regulad uses the information it collects, and how you can opt out of our mailings.
It applies to regulad.com, to the Regulad publisher dashboard, and to the advertising technology we operate on our publishers’ websites.
What information is collected
We collect two broad categories of information.
Information you give us
- Account details: name, email address, company, website, payment details and tax information.
- Contact form submissions: anything you choose to write to us, including domain and traffic figures.
- Support correspondence: emails, chat messages and call notes relating to your account.
Information collected automatically
- Ad serving data: IP address (truncated where required), user agent, device type, operating system, browser, coarse geographic location and the page on which an ad was requested.
- Auction data: bid requests, bid responses, timeouts, win prices and rendered impressions.
- Site analytics: pages viewed on regulad.com, referring URL and session duration.
How we use your information
- To operate the advertising auction and deliver ads to the correct placement.
- To measure ad performance so publishers can be paid and buyers can be billed accurately.
- To detect and prevent invalid traffic, fraud and malvertising.
- To provide support, respond to enquiries and administer your account.
- To send service messages and, where you have opted in, our monthly newsletter.
Legal bases under GDPR
If you are in the European Economic Area, Regulad’s legal basis for collecting and using personal information depends on the context in which we collect it. Regulad may process your personal data because:
- We need to perform a contract with you.
- You have given us permission to do so.
- The processing is in our legitimate interests and is not overridden by your rights.
- We are required to do so by law.
IAB TCF 2.3 compliance
In accordance with TCF 2.3, we process personal data only when a valid Transparency and Consent (TC) string is present. We adhere to the following principles:
- Disclosed vendor requirement: we process data only where Regulad is a disclosed vendor in the publisher’s consent management platform.
- Consent-based processing: purposes requiring consent are processed only when consent is signalled in the TC string.
- Purpose limitation: data is used strictly for the purposes signalled, and for no other purpose.
- Framework version: TCF 2.3. Our Global Vendor List entry carries our current purposes and retention periods.
Processing under legitimate interest
As an SSP and aggregator, Regulad processes certain personal data on the basis of legitimate interest. The specific purposes, the justification and the retention period for each are set out below.
| Purpose | SSP / aggregator justification | Retention |
|---|---|---|
| Select basic ads | Using real-time context (page content, device type, general location) to serve ads without creating a persistent user profile. | 13 months |
| Measure ad performance | Counting impressions and clicks to enable accurate billing for publishers and performance reporting for buyers. | 13 months |
| Create audience insights | Generating aggregated, non-identifiable statistics about ad reach and audience composition for our partners. | 24 months (aggregated) |
| Develop and improve services | Analysing system logs to optimise bidding latency, improve fraud detection and fix technical faults. | 6 months |
Special purposes (essential operations)
- Special Purpose 1: ensuring security, preventing fraud and debugging — detecting invalid traffic and malicious activity.
- Special Purpose 2: technically delivering ads — routing the correct creative to the correct device.
The balancing test
We keep the impact of this processing on your privacy minimal by applying data minimisation (we collect only what the auction requires), by truncating IP addresses where they are not needed in full, by never combining ad-serving data with information from other sources to identify you, and by keeping strict retention schedules.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to object to processing based on legitimate interest at any time.
- Right to object: exercise it through your publisher’s consent management platform, or by writing to us directly.
- Direct request: email privacy@regulad.com with enough detail for us to identify the data in question.
- Mailings: if you no longer wish to receive mailings from us, use the unsubscribe link in any message or email privacy@regulad.com.
We respond to verified requests within 30 days. You also have the right to complain to your local data protection authority.
Data retention and security
We maintain strict retention schedules to minimise storage. Specific retention periods for each processing purpose are disclosed in our Global Vendor List entry and are accessible through the consent management platforms of our publishing partners.
Data is encrypted in transit and at rest, access is restricted on a least-privilege basis, and we review our security posture annually.
Contacting us
If you have any questions or comments about this Privacy Policy, write to privacy@regulad.com or to Regulad Media Ltd., 1 Finsbury Avenue, 3rd Floor, London EC2M 2PF, United Kingdom.