Privacy Policy

Scope of this Privacy Notice

This Notice applies to Personal Data processed by Huella in connection with:

• Huella websites and online properties;
• digital and Connected TV advertising campaigns;
• advertising delivered through publisher websites, applications, OTT services, CTV environments, television operating systems and other digital properties;
• audience targeting and activation;
• interactive advertising and creative experiences;
• programmatic advertising;
• campaign optimisation, frequency management and sequencing;
• measurement, attribution, verification, analytics and reporting;
• advertiser or agency first-party data activation where specifically agreed;
• Huella products and platforms, including NEXad/ImpacTV, AIgnite, NewsroomAI and HuellaNXT; and
• our interactions with advertisers, agencies, publishers, technology partners, vendors and other business contacts.

This Notice does not mean that Huella receives all categories of data described below in every campaign. The information processed depends upon the product, advertising environment, client instructions, technology integration and applicable privacy requirements.

Where Huella processes Personal Data solely on behalf of a client, advertiser, agency or other organisation acting as the relevant Controller or Data Fiduciary, that organisation's privacy notice and Huella's contractual arrangements with it may also apply.

What we mean by Personal Data and Advertising Data

For purposes of this Notice, "Personal Data" means information relating to an identified or identifiable individual, or equivalent terminology under applicable privacy legislation.

In digital advertising, Personal Data does not need to contain a person's name. Depending on applicable law and context, an IP address, cookie identifier, mobile advertising identifier, device identifier or other online identifier may constitute Personal Data even where Huella does not know the person's real-world identity.

Much of the data Huella processes for advertising is therefore pseudonymous advertising data: data associated with a browser, device, advertising identifier, advertising request or audience segment rather than directly with a person's name.

Where information has been effectively anonymised so that an individual is no longer identifiable in accordance with applicable law, it is not treated as Personal Data.

Personal Data and advertising information we may process

A. Device and online identifiers

• IP address;
• cookie identifiers;
• mobile advertising identifiers, including IDFA or Android advertising identifiers where made available;
• device or platform advertising identifiers;
• CTV or connected-device identifiers made available by the relevant platform;
• browser or device identifiers;
• operating system information;
• browser type;
• device type;
• user-agent information; and
• other pseudonymous online identifiers.

B. Advertising request and delivery information

• date and time of an advertising request;
• campaign, advertiser and creative identifiers;
• publisher, application, channel or placement information;
• ad impressions;
• clicks;
• video starts and completions;
• interactions with interactive advertising;
• exposure information;
• frequency information;
• creative engagement;
• technical delivery information; and
• campaign performance signals.

C. Audience and targeting information

• audience-segment membership;
• inferred interest or intent categories;
• contextual signals;
• device characteristics;
• broad geographic or regional information;
• campaign exposure history;
• publisher or platform audience classifications; and
• advertiser first-party audience segments where contractually agreed.

Such information is generally provided or used in pseudonymous form. Where an advertiser activates its own first-party audiences through Huella, the data may include hashed or otherwise pseudonymised identifiers or audience-segment membership. Huella does not ordinarily require clear-text consumer contact information for routine advertising delivery.

D. Approximate location information

Huella may process approximate location information, for example country, region or city-level information inferred from an IP address or supplied by a platform. Huella does not ordinarily require precise GPS-level location information for its advertising services.

E. Consent and privacy signals

• consent-management signals;
• advertising permission signals;
• opt-out or restriction signals;
• platform privacy settings; and
• similar signals transmitted by publishers, platforms or consent-management technologies.

F. Website and business-contact information

• name;
• business email address;
• business telephone number;
• organisation;
• job title;
• correspondence; and
• information voluntarily provided to Huella.

This business-contact information is distinct from the pseudonymous information generally used for advertising delivery.

Information we do not ordinarily collect for advertising delivery

Huella's advertising technology is not generally designed to require the identity of an individual. For routine advertising delivery and audience targeting, we do not ordinarily require:

• a person's name;
• personal email address;
• personal telephone number;
• residential address;
• government identification numbers;
• passwords or authentication credentials;
• consumer banking or payment-card information;
• health or medical information;
• biometric or genetic information;
• information concerning sexual orientation or sexual life;
• religious or philosophical beliefs;
• political opinions;
• precise GPS-level location; or
• other sensitive or special-category Personal Data as defined by applicable law.

Huella also does not ordinarily intend to process children's Personal Data for targeted advertising.

If a particular client engagement requires processing outside these ordinary practices, it should be subject to separate privacy, contractual and legal review before such processing begins.

How we obtain information

Publisher and media environments

Information may be generated when advertising is requested or delivered through publisher websites, mobile applications, OTT services, CTV services, smart-TV environments, television operating systems or other digital media properties.

Advertisers and advertising agencies

Advertisers and agencies may provide campaign information, targeting requirements, audience segments or first-party audience data where such activation has been specifically agreed.

Technology and advertising partners

Information may be received from or exchanged with technology providers involved in advertising delivery, including advertising platforms, demand-side platforms, supply-side platforms, ad servers, publishers, identity or audience providers, measurement providers and other campaign-technology partners.

Consent-management systems

Publishers, platforms and other partners may transmit consent, permission or privacy-preference signals associated with an advertising request.

Huella technologies

Our systems may automatically generate campaign-delivery, interaction, performance and operational data when an advertisement or advertising experience is served.

Directly from you

We may collect business-contact information when you contact Huella, communicate with our employees, submit an enquiry or otherwise interact directly with us.

Why we process information

Advertising delivery

To select, deliver and render digital advertisements and advertising experiences across websites, applications, CTV, OTT and other digital environments.

Audience targeting and activation

To make advertising more relevant by applying audience, contextual, geographic, device, campaign or other permitted targeting criteria.

Frequency management

To help control how frequently a device, browser or other permitted advertising identifier is exposed to a particular advertisement or campaign.

Campaign sequencing

To manage the order or progression in which campaign messages or creatives are presented.

Creative experiences and interaction

To deliver interactive, dynamic or customised advertising experiences and measure interaction with those experiences.

Campaign optimisation

To analyse campaign performance and adjust media delivery, audience allocation, creative selection or other campaign parameters.

Measurement and reporting

To measure impressions, reach, frequency, video completion, engagement and other campaign-performance indicators and provide reporting to advertisers and agencies.

Attribution and effectiveness

Where applicable and legally permitted, to understand whether advertising exposure was associated with subsequent campaign outcomes.

Fraud prevention, quality and security

To identify invalid traffic, suspicious activity, technical errors, abuse or potential security issues and maintain the integrity of Huella's services.

Service administration

To operate Huella's platforms, manage campaigns, troubleshoot integrations, reconcile campaign delivery and administer our relationships with clients and partners.

Product and service improvement

To understand how our technologies and advertising products perform and improve their functionality, reliability and effectiveness, where permitted by applicable law.

Legal and regulatory compliance

To comply with applicable law, respond to lawful requests and establish, exercise or defend legal rights.

Audience targeting and personalised advertising

Audience targeting is part of Huella's advertising services. Depending on the campaign, targeting may use combinations of:

• contextual information;
• pseudonymous audience segments;
• inferred interests or intent;
• device or platform characteristics;
• broad geographic information;
• advertising exposure or frequency information;
• publisher or platform audience classifications; and
• advertiser first-party audience segments.

Audience segments may be supplied by advertisers, publishers, platforms or authorised data and technology partners. Huella generally does not need to know the name or direct identity of an individual in order to perform this targeting.

Huella does not ordinarily use sensitive or special-category Personal Data, precise geolocation or children's Personal Data for targeted advertising.

Advertisers, publishers and platforms that determine which audiences they wish to activate may have their own independent privacy responsibilities in relation to the collection and use of those audiences.

Cookies, device identifiers and similar technologies

Huella and the publishers, platforms and technology providers involved in delivering advertising may use cookies and similar technologies to recognise a browser or device and support advertising functions.

Depending on the environment, these technologies may include cookies, local or browser storage, mobile advertising identifiers, CTV or connected-device identifiers, platform-generated advertising identifiers, pseudonymous server-side identifiers and advertising-event information.

These technologies may support purposes such as delivering advertising, remembering advertising preferences, measuring campaign exposure, frequency management, audience activation, campaign measurement, attribution, fraud detection and performance reporting.

Where applicable law requires consent or another permission before a technology may be stored on or accessed from a user's device, Huella relies upon the relevant permission or consent mechanisms implemented by Huella or by the publisher, platform, advertiser or technology partner responsible for obtaining that choice.

Huella is designed to receive and honour applicable privacy, consent or permission signals that are transmitted through supported campaign and technology integrations.

Users may also be able to control certain advertising identifiers through browser, device, application, television operating-system or platform privacy settings. Additional information is provided in Huella's Cookie & Similar Technologies Policy.

Legal basis for processing

India

Huella designs its data-processing practices with reference to the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules and requirements as their relevant provisions become applicable.

Where Huella acts as a Data Fiduciary, Personal Data will be processed on a lawful basis available under applicable Indian law, including consent or an applicable legitimate use where permitted.

Where consent is the applicable basis, that consent may, depending on the advertising environment, be obtained directly or through an advertiser, publisher, platform, consent-management mechanism or other party responsible for the relevant user interaction.

Where Huella acts solely as a Data Processor for another Data Fiduciary, Huella processes Personal Data on that Data Fiduciary's instructions and subject to applicable contractual and legal requirements.

European Economic Area and United Kingdom

Where the GDPR, UK GDPR or related European privacy requirements apply, processing may rely on one or more lawful bases depending upon the activity.

• Consent — particularly where consent is required for cookies, device access, targeted or personalised advertising or similar technologies.
• Legitimate interests — where permitted for distinct activities such as maintaining service security, preventing fraud, performing certain operational activities, improving services or conducting business-to-business activities, provided those interests are not overridden by applicable rights and freedoms.
• Performance of a contract — where processing is necessary to provide a service directly requested by an individual or administer an applicable contractual relationship.
• Compliance with legal obligations — where processing is necessary to comply with applicable law.

Huella does not currently rely on legitimate interests as the primary legal basis for the targeted-advertising processing covered by Huella's relevant advertising privacy practices and WPP assessment.

Where Huella acts as a Processor, the relevant Controller is responsible for identifying the applicable lawful basis for the processing it instructs Huella to perform.

Nothing in this Notice should be interpreted as relying on legitimate interests where applicable electronic-communications, cookie or privacy law requires prior consent.

When Huella is a Controller, Data Fiduciary or Processor

Huella acting as Processor / Data Processor

In many advertising engagements, an advertiser, advertising agency, publisher, platform or other client determines the purpose of a campaign and instructs Huella regarding the processing necessary to execute it.

In these circumstances, Huella may act as a Processor under GDPR terminology or Data Processor under the DPDP framework and process Personal Data on behalf of the relevant Controller or Data Fiduciary.

Huella's processing in such circumstances is governed by applicable contractual instructions, data-processing terms and privacy law.

Huella acting as Controller / Data Fiduciary

Huella may act as an independent Controller or Data Fiduciary for processing activities where Huella independently determines the purposes and means of processing.

Examples may include certain activities relating to operation and security of Huella's own systems, Huella's corporate website, business-contact information, service administration, fraud or abuse prevention, regulatory compliance, or product analytics and improvement where Huella determines the relevant purposes and means.

The role applicable to a particular client campaign may also be defined in the relevant agreement or data-processing terms.

Advertisers, agencies, publishers, OEMs, CTV platforms and technology partners

Digital advertising generally requires several organisations to work together. Depending on the service, Huella may interact with:

• advertisers and brands;
• advertising and media agencies;
• publishers and broadcasters;
• OTT services and applications;
• CTV publishers;
• smart-TV manufacturers and OEM partners;
• television operating-system providers;
• ad exchanges;
• demand-side platforms;
• supply-side platforms;
• ad servers;
• data and audience partners;
• consent-management technologies;
• identity or activation partners;
• measurement and verification providers;
• attribution providers;
• analytics providers; and
• cloud, hosting and infrastructure providers.

These organisations may act as Huella's processors, Huella's clients, independent Controllers/Data Fiduciaries or other participants in the advertising ecosystem depending upon the circumstances.

Where another organisation independently determines how it processes Personal Data, its own privacy notice will apply to that processing.

Sharing of Personal Data and use of processors

Huella may disclose Personal Data where reasonably necessary to provide its services, including to:

• clients and advertising agencies receiving campaign reporting;
• publishers and platforms involved in delivering advertising;
• technology providers necessary for programmatic advertising and campaign execution;
• measurement, analytics and verification partners;
• audience, identity or activation partners where relevant to an agreed campaign;
• hosting, cloud, infrastructure and security providers;
• professional advisers such as auditors, lawyers and accountants where necessary; and
• governmental, regulatory or law-enforcement authorities where disclosure is required or permitted by law.

Huella does not disclose Personal Data merely because it is commercially available to do so. Disclosures must relate to a legitimate business, service, contractual or legal purpose.

Where Huella appoints a processor or sub-processor to process Personal Data on its behalf, Huella applies contractual data-protection requirements as required by applicable law and relevant client agreements.

Where required by applicable client agreements, Huella may provide information regarding relevant sub-processors through the agreed contractual or vendor-management process.

International transfers

Huella is based in India and works with advertisers, agencies, publishers and technology partners that may operate internationally. Accordingly, Personal Data may in certain circumstances be processed or accessed in countries other than the country in which it was originally collected.

Huella manages such transfers in accordance with applicable data-protection law.

Where GDPR or UK GDPR applies, a transfer of Personal Data to a country without an applicable adequacy determination will be carried out using an appropriate legally permitted transfer mechanism where required.

Transfers of Personal Data subject to India's DPDP framework will be handled subject to applicable requirements and any transfer restrictions notified by the Government of India.

The specific transfer mechanism applicable to client-controlled Personal Data may also be addressed in Huella's contractual data-processing terms.

Data retention

Huella does not intend to retain Personal Data indefinitely.

We retain Personal Data for only as long as reasonably necessary for the purpose for which it was processed, taking into account:

• the duration of the relevant advertising campaign;
• measurement and attribution requirements;
• reporting and reconciliation requirements;
• the nature of the data;
• applicable client contracts;
• legal or regulatory requirements;
• dispute-resolution requirements;
• fraud-prevention and security requirements; and
• whether the information can be aggregated, anonymised or deleted.

Where Huella processes Personal Data solely as a Processor or Data Processor, retention may be determined by the relevant client's instructions and contract.

Huella may retain aggregated or anonymised campaign information after the underlying Personal Data is deleted where the information can no longer reasonably identify an individual.

Data security

Huella maintains technical and organisational measures designed to protect Personal Data against unauthorised access, misuse, alteration, disclosure, loss or destruction, taking into account the nature of the information, the processing involved and the relevant risks.

Huella maintains an ISO 9001-certified Quality Management System. ISO 9001 is a quality-management certification and is not presented as an information-security certification.

Access to Personal Data is limited to authorised personnel and service providers that require such access for legitimate business purposes and is subject to appropriate access controls and confidentiality obligations.

Huella reviews its privacy and security arrangements in light of applicable legal requirements, contractual commitments, business needs and the nature of the processing performed.

Where Huella processes Personal Data on behalf of an enterprise client, additional security obligations may be established through the applicable client agreement, data-processing agreement, information-security schedule or vendor-security requirements.

No technical environment can be guaranteed to be completely secure.

Data Subject Rights and Privacy Requests

Depending on the jurisdiction and applicable data-protection law, individuals may have rights in relation to Personal Data processed about them.

These rights may include, where applicable:

• the right to request information about or access to Personal Data;
• the right to request correction, completion or updating of inaccurate or incomplete Personal Data;
• the right to request deletion or erasure of Personal Data;
• the right to withdraw consent where processing is based on consent;
• the right to object to or request restriction of processing, where such rights apply;
• the right to request data portability, where applicable;
• the right to raise a privacy grievance or complaint;
• the right to contact an applicable data-protection or supervisory authority where provided by law; and
• any other rights available under applicable data-protection legislation.

Privacy rights are not absolute. Whether a particular request can be fulfilled will depend upon the law applicable to the processing, Huella's role, the nature of the Personal Data, appropriate identity or request verification, technical feasibility and any lawful exemptions or retention requirements.

For example, Huella may need to retain particular information where required by law, where necessary to establish, exercise or defend legal claims, or where another lawful exception applies.

How to submit a privacy request

Individuals may submit a privacy-rights request to Huella at legal@huellaservices.com.

Please include sufficient information to allow Huella to understand the request and, where reasonably possible, identify the relevant processing.

Huella will review and respond to valid requests in accordance with applicable data-protection requirements.

Huella may request information reasonably necessary to verify the identity or authority of the person making the request and to protect Personal Data against unauthorised disclosure.

Huella will not request additional identifying information merely because an individual wishes to exercise a privacy right where such information is unnecessary for verification or locating the relevant Personal Data.

Requests involving pseudonymous advertising identifiers

Much of Huella's advertising activity involves pseudonymous identifiers rather than directly identifying consumer information.

As a result, Huella may hold information relating to a cookie ID, mobile advertising identifier, device identifier, CTV identifier or other online identifier without possessing the individual's name, personal email address or telephone number.

A person's name or email address alone may therefore not allow Huella to locate data associated with a particular advertising identifier.

Where a privacy request concerns advertising activity, Huella may ask the requester to provide information reasonably necessary to locate the relevant records. Depending on the environment, this might include:

• a cookie identifier;
• device or advertising identifier;
• relevant website or application;
• CTV/platform environment;
• campaign information, if known;
• approximate date of interaction; or
• other appropriate technical information.

Any such information will be requested only where reasonably necessary to investigate and respond to the request.

Huella will not claim that it can identify or retrieve pseudonymous advertising information where the technical relationship between the requester and the relevant identifier cannot reasonably be established.

Requests where Huella acts as Processor / Data Processor

Huella may process Personal Data on behalf of advertisers, agencies, publishers, platforms or other clients.

Where Huella acts solely as a Processor or Data Processor, the relevant client may be the Controller or Data Fiduciary responsible for responding to the individual's request.

In such circumstances, Huella may refer the requester to the relevant Controller or Data Fiduciary, forward or communicate the request to the relevant client where appropriate, coordinate with the relevant client, or assist the client in responding, in accordance with applicable law and Huella's contractual obligations.

The fact that Huella acts as a Processor for a particular activity does not prevent an individual from contacting Huella at legal@huellaservices.com. Huella will review the request and determine the appropriate handling based on Huella's role in the relevant processing.

Where Huella acts as an independent Controller or Data Fiduciary, Huella will assess and respond to applicable requests relating to that processing directly.

Withdrawal of consent and advertising choices

Where Huella's processing relies upon consent, individuals may have the right to withdraw that consent. Withdrawal of consent does not affect the lawfulness of processing undertaken before consent was withdrawn.

In advertising environments, consent or advertising choices may sometimes be managed through:

• a publisher's consent-management platform;
• a website cookie-preference interface;
• an application;
• a mobile operating system;
• a CTV or television platform;
• an OEM privacy interface;
• browser settings; or
• another technology partner responsible for collecting or communicating the applicable permission.

Where such a mechanism controls the relevant consent signal, an individual may need to update the choice through that mechanism.

Huella is responsible for respecting applicable consent or permission signals that are made available to Huella through supported technology integrations.

Individuals may also contact legal@huellaservices.com with questions regarding consent or Huella's processing.

Grievance and Privacy Contact

Huella has designated the following channel for privacy enquiries, privacy-rights requests and grievances relating to Personal Data:

Huella Services Private Limited Legal & Privacy Team Ground Floor, Huella Services Plot No. 312, Phase II, Udyog Vihar Sector 20, Gurugram, Haryana – 122016, India Email: legal@huellaservices.com

This is Huella's designated contact channel for privacy enquiries, Data Subject/Data Principal requests and privacy grievances.

Individuals may use this contact to exercise applicable privacy rights, ask questions about Huella's processing of Personal Data, raise concerns regarding privacy practices, request clarification regarding Huella's advertising privacy practices, or submit a privacy grievance or complaint.

Huella will review and respond to valid privacy requests and grievances in accordance with applicable data-protection requirements, subject to applicable law, appropriate verification, technical feasibility and lawful exemptions.

Where applicable Indian data-protection law provides a grievance-redressal process, Huella will handle grievances through its designated privacy channel in accordance with the requirements applicable to Huella as a Data Fiduciary.

Where GDPR or another applicable law provides a right to lodge a complaint with a competent supervisory authority, exercising Huella's internal privacy process does not remove any right an individual may have to approach the relevant authority, subject to applicable law.

Where a grievance relates primarily to processing controlled by an advertiser, agency, publisher, platform or other client for whom Huella acts only as a Processor/Data Processor, Huella may coordinate the matter with or refer it to that Controller/Data Fiduciary.

Children

Huella's advertising services are not designed to knowingly use children's Personal Data for behavioural or personalised advertising.

Huella does not ordinarily seek to collect children's Personal Data or create audience segments based on children's Personal Data.

Publishers, platforms and advertisers using Huella's technology are responsible for appropriately identifying services directed to children and complying with applicable requirements concerning children's data.

If Huella becomes aware that children's Personal Data has been processed in a manner inconsistent with applicable law or Huella's contractual requirements, Huella will take appropriate steps in accordance with its legal and contractual obligations.

For purposes of this section, a "child" means a person treated as a child under the privacy law applicable to the relevant processing activity.

Automated processing and artificial intelligence

Huella's advertising technologies may use automated systems, optimisation algorithms, machine-learning techniques or AI-assisted tools in connection with activities such as:

• campaign optimisation;
• audience and placement recommendations;
• creative analysis or generation;
• selection or adaptation of advertising creatives;
• campaign-performance analysis;
• anomaly or fraud detection;
• media recommendations; and
• reporting and campaign insights.

Where such systems process Personal Data, that processing remains subject to this Notice and applicable privacy requirements.

Huella's advertising automation is generally intended to improve advertising delivery and marketing effectiveness. It is not intended to make decisions about individuals that produce legal effects or similarly significant effects upon them.

Where applicable law provides specific rights relating to solely automated decision-making, Huella will address those requirements where relevant to the processing concerned.

Business communications and Huella's website

Huella also processes Personal Data in the ordinary operation of its business.

For example, when representatives of advertisers, agencies, publishers, partners or prospective customers contact us, we may process their professional contact details to:

• respond to enquiries;
• conduct business discussions;
• provide information about Huella's products;
• manage commercial relationships;
• administer agreements;
• organise meetings;
• provide support; and
• maintain appropriate business records.

This information is not ordinarily combined with pseudonymous advertising identifiers for consumer audience targeting.

Changes to this Privacy Notice

Huella may update this Privacy Notice from time to time to reflect changes to our products or technology, new advertising practices, changes in applicable law, regulatory guidance, changes in our partners or service providers, or improvements to our privacy practices.

When we make material changes, we will update the "Last Updated" date at the beginning of this Notice and take any additional steps required by applicable law.

We encourage users, clients and partners to review this Notice periodically.