Full Privacy Notice
How and why we collect data and covering your choices.
(last update, May 25, 2018)
Catalyst Privacy Notice
This Privacy Notice describes the information Catalyst collects from web sites, applications, and other digital properties, we refer to all of these as “Sites”. We explain how we use this information in our “Platform” and to provide “Services” to our clients. We also explain how you can manage your privacy choices and exercise your rights in relation to certain data about you collected and used by Catalyst.
Who are we?
Catalyst is part of [m]PLATFORM, which is a business that operates globally as part of the GroupM group of companies. In the European Economic Area (EEA) and Switzerland the [m]PLATFORM legal entity responsible for the data that [m]PLATFORM collects is [m]PLATFORM Ltd. Outside of the EEA and Switzerland the responsible legal entity is mPlatform, LLC.
[m]PLATFORM is GroupM’s audience intelligence and activation solution that builds personalized consumer relationships at scale. In addition to the technology suite, it is a worldwide service organization comprised of analysts, data strategists, search and social specialists, and product and media experts focused on ensuring consistent delivery in all markets where our clients do business.
If you have any questions or comments regarding this Privacy Notice, please see the “Contact us” section at the bottom of this Privacy Notice. Please note that this Privacy Notice has been translated from English into multiple different languages. If there are any conflicts or inconsistencies between the different language versions of this Privacy Notice, the English version will prevail.
What are our Services?
[m]PLATFORM owns and operates a technology platform (the “Platform”) that provides various advertising-related services (collectively, “Services”) for its clients, which consist of other GroupM agencies and businesses as well as other companies within the WPP plc group of companies. [m]PLATFORM does not provide services directly to consumers, our clients are corporate businesses who work with GroupM agencies to plan and buy media campaigns (advertising).
GroupM agencies use our Platform and Services, for their own clients, to help them to understand the advertising that the clients deliver online (e.g. what sites it was delivered on, who saw it and whether or not anyone interacted with it) and to improve the effectiveness of that advertising and we also help them to try deliver advertising to consumers who are more likely to be interested in their products and services.
When we help clients to select audiences to deliver their advertising to, we use certain demographic information (such as age, gender, education, income and household status (e.g., number of children)), geography, interests, activities, and similar information (“User Information”). We explain below where this information comes from. We call this type of advertising “Interest-Based Advertising”.
What information is collected and utilized by [m]PLATFORM?
The Platform is designed to collect and/or use information about the type of web pages that individuals visit and about interactions that they have with Sites and with our clients’ advertisements. We also collect information that identifies the browsers and devices of the individuals who have viewed our clients’ advertising. This information includes the following categories of data:
These can be used to identify an individual’s browser, mobile advertising environment, and/or device, and typically include:
- Cookie IDs
- Mobile advertising IDs (e.g., IDFAs and Google Advertising IDs)
- [m]PLATFORM’s “[mP]ID” proxy identifier for the above IDs
Additional Technical Information
- Internet protocol address (“IP address”) and data derived from an IP address, such as non-precise geolocation data that indicates the country, region, city, and/or postal code of a device
- Type of Internet browser, browser language, and operating system
- Connection type (wired or Wi-Fi), network to which the device is connected, and mobile carrier (if available)
- Latitude/longitude of a (mobile) device. For purposes of this Privacy Notice, “mobile device” includes smartphones and tablet computers.
Online Activity Information
[m]PLATFORM collects the information explained below about your online browsing activity to determine what types of activities, services and products you and other users may be interested in and how you and other users interact with certain advertisements. This information includes:
- Records of the type of Sites and pages viewed (i.e., in order to ascertain interests)
- Site/page you came from before, and visited after, viewing an advertisement
- Date and time of online activity
- Frequency of visits to a Site
- Search terms used on a Site
- Interaction with an advertisement (e.g., whether a user clicks on an advertisement)
User Information received from Third Parties
We also receive both online and offline User Information collected by third parties, including demographic and interest information for use in our Services. The third parties include our clients and carefully selected service providers. When we receive offline User Information, this information is provided to us via a service provider in conjunction with a cookie ID, advertising ID, or similar user ID that identifies a customer or consumer to us, the client or service provider, but we do not receive any names, mailing addresses, phone numbers, email addresses or similar data that would enable identification of a particular individual connected with these IDs.
How do we collect information?
Cookie – is a small alphanumeric text file that is stored in a browser by a web site or by a third-party ad server or other third party which allows that web site or third party to recognize that browser and remember User Information and other information. Our targeting cookies, which are named “Mookie” and operate on the mookie1.com domain, are persistent cookies that contain unique randomly-generated values that enable our Services to distinguish browsers and devices and are associated with User Information and other information. Mookie cookies, together with this associated information, are used in the performance of our Services, and in particular Interest-Based Advertising activities. More information about our Mookie cookies is set forth in the table immediately below this explanation of terms.
Advertising ID – is an alphanumeric identifier made available by a platform or operating system (such as Apple iOS or Google Android) that allows application developers and third parties to recognize a particular device in an application environment. It is associated with User Information and other information and, together with this associated information, is used in the performance of our Services, and in particular Interest-Based Advertising activities.
Pixel – is a line of code that is used by a Site or third party to assign online activities to a device or browser, or more specifically to the applicable cookie or advertising ID. The use of a pixel allows us to record, for example, that a device or browser has visited a particular Site or page.
The following chart provides information about our Mookie cookies, all of which are “persistent” cookies (meaning they are stored until they expire or are deleted/removed by a user) mapped to the mookie1.com domain:
[m]PLATFORM processes the information it collects and receives for the purposes of providing the Services to clients which we have explained above, as well as for administrative, security and compliance purposes. Specifically, we carry out the following activities:
How do we use this information?
Ad Selection, Delivery, Reporting
We analyze the information collected when client advertising is delivered through [m]PLATFORM and information received from our partners. We organize this information into collections of IDs (which we call segments), based on various components of the User Information we explained above. For example, we may have segments of IDs that visit sport websites. GroupM agencies then use these segments within our platform to deliver Interest-Based Advertising for their clients, using our partners and service providers. This advertising may be delivered across computers, phones, and other mobile devices.
We may also integrate (and use for the same purposes) User Information obtained from other carefully selected companies (including Site owners, data providers and data aggregators).
We also maintain our own internal identifier, which we call “[mP]ID”. We use the [mP]ID to associate information relating to browsers, environments, and/or devices that we reasonably believe belong to the same user. This helps us to provide more useful and relevant advertising to a specific user, regardless of the browser, device, or environment.
In order to provide our client-specific personalization Services, we:
- collect information on each client’s Sites (this includes websites, apps, and other digital properties) – as described above in “How we collect information”;
- access or store this information on devices (via cookie IDs and advertising IDs, as applicable); and
- analyze the information collected, sometimes with other information received from the client and organize it into segments of IDs, based on the various User Information we have
Our clients can then use these segments to deliver, on their own behalf or on behalf of their clients, Interest-Based Advertising to users on their computers, phones, and other mobile devices (this is through a variety of means).
Where we are providing this client-specific personalization, the segments that we build for one client are logically segregated from the segments and data of other clients. Data collected in this way, and the segments produced, can only be used on behalf of that specific client.
We process User Information to deliver advertisements and measure the delivery of these advertisements, to learn about what factors make advertising successful or unsuccessful for advertisers and generate reports to understand and improve Service usage and advertising effectiveness.
Storage and Access of Information
In order to provide our Services, we store our Mookie cookies on the browser(s) of individuals to whom we have delivered advertising and then recognize the Mookie cookies, when your browser is used to access websites of our clients and publishers we work with. Sites on which we are dropping and/or reading, or seek to drop and/or read, Mookie cookies should tell you about the use of third-party cookies, and in particular Mookie cookies where required by law, on those Sites. In the data feed we receive from our partners in connection with the delivery of digital advertising in mobile application environments we also receive Advertising IDs associated with users’ mobile device platforms/operating systems and recognize these Advertising IDs.
We use the information collected and received for Interest-Based Advertising, such as:
- Matching Data to Offline Sources – as indicated above under “User Information received from third parties”:
- We receive offline User Information, including demographic and interest information, from other companies, including our clients, partners and service providers, that is collected outside the Platform and is provided to us for use in our Services. It is the responsibility of those companies collecting that data to do so in an appropriate and legal way, and to permit sharing that information with us for our purposes.
- When we receive offline User Information, this information is provided to us via a service provider in conjunction with a cookie ID, advertising ID, or similar user ID that identifies a customer or consumer to the client or service provider.
- We do not receive any names, mailing addresses, phone numbers, email addresses or similar data that would enable identification of a particular individual connected with the IDs we receive.
- Linking Devices – we make use of our own [mP]ID identifier to associate information relating to browsers, environments, and/or devices that we reasonably believe belong to the same user, in order to help provide more useful and relevant advertising regardless of browser, environment, or device.
- Precise Geographic Location Data – when we have the necessary rights to do so we may receive and/or use a user’s precise geographic location data in connection with our Services. Where we collect this type of data it is provided in the data feed we receive from our partners in connection with the delivery of digital advertising.
Whom do we share data with?
[m]PLATFORM shares data with GroupM agencies and their clients for purposes of delivering Interest-Based Advertising, analytics, and the other Services described above. We also share data with third-party service providers that perform services and functions on our behalf and/or on behalf of our clients, in the provision of the Services such as companies that are responsible for the actual delivery of Interest-Based Advertising – including demand-side platforms, advertising networks, advertising exchanges, and ad servers.
If we reasonably believe we are obliged by law or legal process to disclose information to a third party (including law enforcement), then we will do so. In addition, we may disclose information to a third party (including an auditor or other service provider) in order to investigate, prevent, or take action regarding suspected or actual prohibited activities and/or in order to review, evaluate, or address the integrity or security of our Platform and Services.
We are a member of the Digital Advertising Alliance (DAA), the European Interactive Digital Advertising Alliance (EDAA), and the Digital Advertising Alliance of Canada (DAAC). In connection with these memberships, we adhere to the DAA’s self-regulatory framework, the IAB Europe EU Framework for Online Behavioural Advertising, and the DAAC’s Canadian Self-Regulatory Principles for Online Behavioural Advertising, respectively, in those markets where the applicable self-regulatory framework applies, and we support deployment of the Advertising Option icons (AdChoices and, where available, AppChoices). Advertisements that are provided by organizations that participate in these frameworks display the icon shown below when technologically feasible. Clicking on the icon provides you with information about Interest-Based Advertising.
When the IAB Europe’s Transparency & Consent Framework is finalized, we plan to participate in the framework as a “global vendor”.
Opt-out/Right to withdraw consent
You may opt out of [m]PLATFORM Interest-Based Advertising through several mechanisms.
You may choose not to receive customized third-party advertisements via [m]PLATFORM targeting cookies on the browser you are using by clicking below. If you do this the [m]PLATFORM targeting cookies will be replaced with an “opt-out” cookie. Any Interest-Based Advertising data linked to the replaced [m]PLATFORM targeting cookies will not be used for Interest-Based Advertising on any device or browser that we have reasonably linked to the browser where the information was collected. In addition, if we have actual knowledge that another device or browser is linked to your opted-out browser, that other device or browser will also be opted out from receiving Interest-Based Advertising via [m]PLATFORM.
To opt out of data collection via cookies from [m]PLATFORM please click here
Our opt-out cookies are programmed to expire ten years after they are initially issued. If you buy a new device, upgrade or change web browsers or delete this opt-out cookie, you will need to perform the opt-out process again. In order for the opt-out process to work, your browser must be set to accept third-party cookies.
In browser environments, you may also refuse or remove cookies from both [m]PLATFORM and other service providers, via the following methods:
- Adjusting your browser settings to refuse or remove cookies, which would result in the cessation of Interest-Based Advertising via cookies from [m]PLATFORM and from other providers. However, by doing so, you may not be able to use certain features on certain web sites or take full advantage of all web site offerings and Interest-Based Advertising. You may refuse or remove cookies by following the directions provided in your browser settings. Further information about cookies is available at www.aboutcookies.org, www.youronlinechoices.com, and www.aboutads.info/consumers#cookies.
- Adjusting the cookie settings at the level of the web site owner where you granted us consent to our cookie usage; cookie settings options may vary by web site owner.
- Opting out of Interest-Based Advertising via our targeting cookies, as well as the targeting cookies of other service providers, at the following web sites:
- www.youronlinechoices.com (by clicking the “Your ad choices” link after selecting the appropriate country)
In mobile app environments, you may opt out of Interest-Based Advertising from just [m]PLATFORM or from both [m]PLATFORM and other service providers, via the following methods:
- Going to the privacy setting on your device and selecting “Limit Ad Tracking” via your device settings, which will result in the elimination of Interest-Based Advertising via the applicable advertising ID from [m]PLATFORM and from other providers.
- Opting out of Interest-Based Advertising via the applicable advertising ID from [m]PLATFORM and/or other providers via the AppChoices app. Please note that, in order for the AppChoices app to function properly, the “Limit Ad Tracking” device setting must not be selected. Interest-Based Advertising data previously collected or received in association with the replaced advertising ID will not be used via [m]PLATFORM for Interest-Based Advertising on any other device or browser that we have reasonably linked to the mobile app environment where the information was collected. In addition, if we have actual knowledge that another device or browser is linked to the opted-out mobile app environment, that other device or browser will also be opted out from receiving Interest-Based Advertising via [m]PLATFORM. Additional information regarding the AppChoices app is available at http://www.aboutads.info/consumers and http://www.youradchoices.ca/choices/.
[m]PLATFORM’s Services are not directed at children (as defined by applicable law) or at Sites primarily directed to children. [m]PLATFORM does not knowingly collect information from children (determined in accordance with the age requirement for the applicable country). If you believe a child has provided us with personal data and would like to have the information removed, please contact us.
Transfer of data in the event of acquisition
In the event that another company acquires all or substantially all of our assets, or all or substantially all of the assets of our Platform business, through a consolidation, merger, asset purchase, corporate reorganization, or other transaction, we reserve the right to transfer all information or all Platform information, as applicable, that is in our possession or under our control to the acquiring party.
Information security and global data transfers
We follow generally accepted online advertising industry standards to protect against unauthorized access to, unlawful processing of, unauthorized retention of, and unauthorized disclosure of data. These standards include undertaking necessary physical, electronic, and management activities required to protect data integrity, access, and use. Please keep in mind, however, that despite these efforts to protect data on our servers, no method of transmission over the Internet is guaranteed to be secure.
[m]PLATFORM Services and the Platform are used globally and therefore we may transfer data to countries around the world, including countries outside your country. We will, where necessary, put in place appropriate safeguards to ensure such data is protected. When we transfer personal data from the EEA or Switzerland to an affiliate outside the EEA or Switzerland, we enter into standard (“model”) contractual clauses with the recipient in order to ensure an appropriate level of data protection. When we transfer personal data from the EEA or Switzerland to an unaffiliated entity (such as a service provider performing services on our behalf) outside the EEA or Switzerland, we either enter into standard (“model”) contractual clauses, or substantially equivalent terms and conditions, or ensure that the transfer is pursuant to another valid mechanism, such as the service provider being certified under the EU-U.S.Privacy Shield Framework.
We maintain the information we collect through our Services in non-aggregated form for a period of not more than 13 months. This data includes Sites visited, content viewed, ad interactions, IP addresses, browser type and language settings. We maintain this information for the 13-month period to enable our clients to perform year-over-year analyses. For example, a retailer may wish to compare the effectiveness of its online advertising activities at Christmas for the current year vs. the effectiveness in the prior year. A 13-month retention period enables that client to perform such comparison.
We maintain information we collect through our Services in an aggregated form for a period longer than 13 months.
Pursuant to Section 1798.83 of the California Civil Code, residents of California can obtain certain information about the types of personal information that companies with whom they have an established business relationship have shared with third parties for direct marketing purposes during the preceding calendar year. To request a list of companies, if any, to which [m]PLATFORM has provided personal information for its own marketing purposes, please email us at email@example.com or write to us at [m]PLATFORM, c/o GroupM, 498 7th Avenue, New York, NY 10018, USA, Attn: Privacy. Please allow 30 days for a response.
California law requires us to disclose how we respond to browser “Do Not Track” signals or other choice mechanisms relating to Interest-Based Advertising. We have not yet developed a response to browser “Do Not Track” signals, and do not change any of our data collection practices when we receive such signals. We will continue to evaluate potential responses to “Do Not Track” signals in light of industry developments or legal changes.
We are committed to honoring privacy choices. For more information on opting-out of Interest-Based Advertising, please see the “Opt-Out/Right to Withdraw Consent” subsection above.
Changes to this Privacy Notice
Please note that because of the changing nature of privacy laws and regulations, digital technologies, and our business, we may modify this Privacy Notice from time to time. Please review this Privacy Notice periodically to become aware of any changes that may have occurred (we will update the effective date at the top of the page to help you know when changes have been made).
Other than when acting at the direction of a client or other third party, [m]PLATFORM is a data controller responsible for your personal data (as this term or similar term is defined by applicable law) when you interact with our Services.
Europe ([m]PLATFORM Ltd.)
[m]PLATFORM, c/o GroupM, 26 Red Lion Square, London, WC1R 4HQ, UK
Worldwide (mPlatform, LLC)
[m]PLATFORM, c/o GroupM, 498 7th Avenue, New York, NY 10018, USA, Attn: Privacy
If you have questions or concerns regarding this Privacy Notice, you should contact us through email addressing general questions and comments to firstname.lastname@example.org, or by post: Catalyst, 501 Boylston Street, Boston, MA 10018.