Product and Service Privacy Policy | LiveRamp (original) (raw)

Overview of LiveRamp

LiveRamp is a data connectivity platform leveraged by companies, such as brands and their partners, to deliver relevant advertising and marketing. Our business provides the technology to move data safely and securely between the advertisers, platforms, and other parties that select and host ads.

LiveRamp allows companies to enhance and activate their data across online and offline channels, primarily for marketing purposes. For instance, a sports clothing store might receive email addresses from its shoppers. This enables the store to send emails to its shoppers regarding offers or updates, but doesn’t enable it to communicate tailored offerings to its shoppers through different channels, or enable the store to understand the effectiveness of its online marketing.

LiveRamp enables the sports clothing store to transform the information provided directly by its customers into other identifiers, such as the advertising IDs at platforms that engage in online advertising. This enables the store to use (and sometimes to share) its data much more flexibly, such as serving digital advertisements on their customers’ devices, understanding how those digital advertising campaigns impact in-store sales, or discovering additional customer traits (for instance “interest in outdoors”) by appending 2nd- and 3rd-party data sets to its customer list.

Scope of this Notice

Though the information in this notice is accurate regardless of where you reside, more specific information and access to some data rights described in geographically-defined regulations, such as state-specific privacy rights or the European Union’s General Data Protection Regulation (GDPR), may be available depending on your jurisdiction.

This privacy notice applies to the products and services that we offer and databases we manage when we operate as a “business” or “controller.”

If you have questions about our practices on the liveramp.com website or if you have questions on how we manage personal information that we collect from you at corporate activities and events, please consult our Web and Business Representative Privacy Notice.

For the purposes of this notice, “personal information” is broadly defined as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or device. This includes, without limitation, offline identifiers such as a name, postal address, phone numbers, and social security number, information traditionally considered personally identifiable (PII), and online identifiers associated with devices (i.e., browser cookie or mobile advertising ID).

General Privacy Information

An Overview of How We Process Personal Information

LiveRamp processes personal information in two main ways:

First, we collect and maintain personal information to enable the data connectivity that we provide to our customers. We collect personal information for this purpose from several different types of sources, and we use it to generate and translate the identifiers that our customers – such as the sports clothing store described above – use for their own marketing campaigns and related purposes. The personal information that enables this connectivity forms LiveRamp’s core data assets.

Second, LiveRamp provides its customers with online identifiers and helps customers map identifiers to one another for their own purposes. In many cases, customers use identifiers for digital advertising campaigns. Although LiveRamp limits the types of personal information that its customers can associate with our identifiers as well as the purposes for which customers can use them, our customers – not LiveRamp – determine how they will use and disclose their data.

Here’s an example to help make LiveRamp’s role in online data connectivity clearer. Cookies – small text files stored in your browser – very often store identifiers. Cookie identifiers can be used for site functionality and security as well as advertising, analytics, and other commercial purposes which span multiple sites. 1st-party cookies are cookies set by the website owner; 3rd-party cookies are cookies set by parties other than the website owner. In its products, LiveRamp both places 3rd-party cookies and leverages its partners’ 1st-party cookies.

On web browsers, LiveRamp may collect and store one or more identifiers and data using 3rd-party cookies that it places.

When you are logged in to one of our partner websites (or sometimes, if you open emails from them), that partner may set 1st-party cookies and disclose personal information collected from you, such as your email, cookies set on your browser, IP address, or information about your browser or operating system, to LiveRamp. LiveRamp uses this personal information to create an online identifier associated with you or your device. Our partner may then store this online identifier in its 1st-party cookie and use it in targeted advertising campaigns, to connect demographic or interest-based data about you, or to connect data about your browsing on unrelated sites.

The critical point is that LiveRamp’s partner makes its own decision about how to use online identifiers and any data linked to them – including for targeted advertising. LiveRamp itself does not provide the service of targeted advertising or cross-context behavioral advertising. Instead, LiveRamp processes and transfers data to an advertiser’s advertising platform so that platform can provide targeted advertising services.

LiveRamp gives you choices about whether we use your personal information for the purposes described in this Notice.:

Our Collection of Personal Information

We collect the categories of personal information identified in the chart below from the categories of data sources identified in the chart below when we operate as a “business” or “controller.” We collect each category of personal information for data marketing, online targeting and measurement, and operating our products and services, as further described in this privacy notice.

Sensitive Personal Information We Collect

As detailed in the chart above, LiveRamp collects social security numbers and driver’s license numbers, which constitute “sensitive personal information” under certain state privacy laws. LiveRamp uses this sensitive personal information strictly for identity resolution and does not infer characteristics about consumers based on such sensitive personal information.

Our Purposes for Processing Personal Information

‍Generally speaking, we collect, use, disclose, and may sell personal information for the purposes of building products and providing services for advertisers (and ad and data platforms that service advertisers) related to facilitating marketing, advertising, analytics, attribution, fraud detection, and reporting. This includes:

Our Disclosure and Sale of Personal Information

We may “sell” your personal information as defined in applicable privacy laws. A “sale” includes making available personal information to a third party in exchange for “valuable consideration,” which is not limited to “monetary consideration.”

We engage in sales when we disclose identifiers (i.e., unique personal identifiers, online identifiers such as cookies, mobile IDs, other online advertising identifiers, IP addresses, email addresses, name, postal address, phone number or other similar identifiers) and internet or electronic network activity information (i.e., information regarding a consumer’s interaction with a website or application) to our customers and partners, including advertising networks, data analytics providers, media platforms, advertisers of consumer goods and services, brands, social networks, consumer data resellers, distribution partners, third party marketers and marketing partners, digital advertisers operating in ad tech sector. For information about how to opt out of sales, please find the section titled “Consumer Privacy Rights and Disclosures” in this privacy notice. To go directly to instructions for exercising rights offered by certain states, please visit Your Privacy Choices

We may also disclose each category of personal information that we collect to our service providers who process it on our behalf and in accordance with our instructions. This may include, for instance, providers involved in tech or customer support, operations, web or data hosting, billing, accounting, security, marketing, data management, validation, enhancement or hygiene, or otherwise assisting us to provide, develop, maintain and improve our services.

In addition, we may disclose each category of personal information that we collect as follows:

How We Handle Children’s Privacy

As a data controller, we do not directly and knowingly collect personal information about children or minors under the age of 18. In addition, our websites and systems are not designed for use by individuals under the age of 18. If we learn we have collected or obtained personal information of someone under 18 as a data controller, we will delete that information from our database. If you believe that this has occurred, please contact the U.S. Data Ethics Team.

When We Act as a Service Provider/Processor

We may receive, handle and process personal information on behalf of our clients, in order to provide services to those clients. This may include, for instance, information about our clients’ customers or prospective customers, or about other consumers our clients have interacted with. This is information we access as a “processor” or “service provider”. This information is not owned by LiveRamp, and thus is not subject to this privacy notice. For additional information or to exercise your rights, please contact whichever company or organization is the “controller” or “business” that is responsible for collection, use, or disclosure of your personal information.

How We Secure Personal Information

LiveRamp has implemented security measures, including physical, technical and operational safeguards, designed to prevent the unauthorized access to or acquisition of personal information in our possession. However, no security measures are 100 percent effective. Thus (like other platforms and websites) we cannot guarantee such safeguards in securing all information from any such event or preventing harm that might arise.

How Long We Retain Personal Information

LiveRamp will retain your personal information for as long as reasonably necessary to provide the products and services described in this privacy notice or otherwise where permitted or required in accordance with applicable law. We will retain and use your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will vary between different types of information, and when we consider our approach we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

Consumer Privacy Rights and Disclosures

U.S. State Specific Privacy Rights and Disclosures

California

California law provides California residents with specific rights regarding their personal information. To review information specific to California residents, please review our standalone California privacy notice, accessible here. To get directly to information about exercising rights afforded by California law, including how to exercise your right to access, correct, opt out, and delete personal information, please visit Your Privacy Choices

Nevada

Nevada residents have the right to opt out of the sale of their personal information from LiveRamp to third parties. To exercise this right, please visit Your Privacy Choices

Other U.S. States with Privacy Laws

Various state privacy laws confer privacy rights to consumers across the United States and impose corresponding obligations on businesses. Where LiveRamp is acting as a service provider/data processor, we are processing data on behalf of other businesses that will provide you with applicable privacy rights.

The following is intended to explain consumers’ rights and the obligations LiveRamp has under the following state privacy laws: Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. To review information specific to California residents, please review our standalone California privacy notice, accessible here.

Right to Access Personal Information and List of Third Parties

You have the right to request access to the personal information that we have collected about you, including the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or selling personal information, the categories of third parties to whom we disclose personal information, the categories of personal information we disclose or sell to third parties (collectively, “categories”), and the specific pieces of personal information that we have collected about you (the “specific pieces”).

You also have a right to request a list of specific third parties, other than natural persons, to whom we have disclosed your personal information or any consumer’s personal information. LiveRamp provides a list of third parties to which it has disclosed any consumer’s personal information as part of our response to your access request.

If we are able to verify your identity and provide back personal information as requested, we may withhold some personal information where the risk to you or our business is too great to disclose the information. If we are unable to verify your identity, we will inform you that we cannot verify your identity and we will not disclose any specific pieces of personal information to you. To make an access request, please visit Your Privacy Choices

Right to Correct

You have the right to request corrections to inaccuracies in your personal information.

For this type of request, we encourage you to first submit an access request. If you identify anything in the response to the access request that is inaccurate, you have the right to request that LiveRamp correct the inaccuracies. Upon receipt of a valid correction request, LiveRamp will remove the information identified as inaccurate from our systems and add you to an opt out process to prevent LiveRamp from collecting or using inaccurate information about you going forward. We will respond to your correction request within 45 days of receipt, and may contact you if we need more time to process your request. To make a correction request, please visit Your Privacy Choices

Right to Opt Out of Sales; Right to Limit the Use and Disclosure of Sensitive Personal Information

All consumers, regardless of state of residence, may opt out of sales of their personal information and limit the use and disclosure of sensitive personal information.

If you would like to opt out of sale of your personal information and limit the use and disclosure of sensitive personal information, you may do so as outlined on the following page: Your Privacy Choices. When you submit a request to opt out, we ask that you provide your first and last name, state of residency, and email address in order to comprehensively apply your opt-out request. If you do not feel comfortable sharing this information with us, we also offer the opportunity to opt out using a Mobile Identifier or Third Party cookie only. Note that cookie opt outs will only apply to your web browser, while the Mobile Identifier opt out will only apply to your device. If you use different browsers or devices, you may need to enable the opt out on each browser and device.

You can use certain preference signals to exercise your sale opt-out right automatically with all businesses that you interact with online, including LiveRamp. If you enable a browser-based opt-out preference signal, such as Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sale of personal information linked to your browser. Please note that if you use different browsers, you may need to enable the signal on each browser.

Right to Deletion

You have the right to request LiveRamp delete personal information we have about you. Please note that this is different from your right to “opt out” of us selling your personal information, which is described above.

Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers and third parties to delete) your personal information from our records, unless an exception applies. We may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as debugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, (f) for our own internal purposes reasonably related to your relationship with us, or (g) to comply with legal obligations. To make a deletion request, please visit Your Privacy Choices

Right to Appeal

You have the right to submit an appeal to LiveRamp’s refusal to take action on a request for access, lists of third parties, correction, deletion, or opt out rights afforded by state privacy laws. You will need to provide the following information as part of an appeal request:

We will review your request and will likely reach out to you via email to request additional information about your submission. Within 45 days of receipt of the appeal, LiveRamp will inform you in writing of any final action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

To make an appeal request, please visit Your Privacy Choices. You may also file a complaint with the appropriate state attorney general or privacy agency.

Right to Non-Discrimination for Exercise of Your Consumer Rights

You have the right not to receive discriminatory treatment by LiveRamp for the exercise of your privacy rights under state privacy laws. Employees, applicants, and independent contractors will not be retaliated against for the exercise of privacy rights.

If you have other questions about LiveRamp’s privacy information practices or products, or your rights under applicable U.S. state privacy laws, you may submit your questions via our Other Inquiries form found on Your Privacy Choices

Right to Use Authorized Agents to Exercise Rights

Consumers covered by state privacy laws may use authorized agents to submit requests to LiveRamp on their behalf. In addition to standard identity verification of the consumer for access, deletion, and correction requests, LiveRamp may require, upon request, that the authorized agent provide either (a) a written authorization from the consumer to act on the consumer’s behalf or (b) a valid power of attorney to act on the consumer’s behalf. In the case of an authorized agent’s request for access to personal information, the resulting report will be delivered to the consumer directly. To make a request as an Authorized Agent, please visit Your Privacy Choices

Exercising Your Rights

You may exercise these privacy rights by:

For security purposes, since we do not have direct relationships with consumers, we use third-party providers to verify the identity of consumers for specific rights requests. Depending on the type of request, we may verify your identity by requesting certain information from you.

This information will only be used for verification purposes. This information is deleted as soon as practical after processing your request, except as required to comply with law.

We may need to contact you in order to clarify your request, confirm your identity, or collect more information in order to verify and respond to your request.

If we are unable to complete your requests fully for any of the reasons above, we will provide you with additional information about the reasons that we could not comply with your request.

Opt Out of Interest Based Advertising

LiveRamp is a member of the Digital Advertising Alliance (DAA) and Digital Advertising Alliance Canada (DAAC) and adheres to the DAA Principles for Online Behavioral Advertising and Multi-Site Data, as well as related guidance. LiveRamp subscribes to the DAA’s industry-wide cookie opt out mechanism that can be found here and its mobile device ID opt out available through its AppChoices app.

Keep in mind that opting out of LiveRamp through the DAA does not disable advertisements altogether. Instead, opting out means that LiveRamp services will no longer be used to facilitate targeted advertising to your browser, device, or email address. In other words, you will still see advertisements and receive email marketing, but they may be less relevant to you.

If you create a new email address, reset the mobile advertising ID on your device, or use a new browser, you will need to apply the appropriate opt out to that new email address, new device ID, and/or new browser as opt outs are not necessarily transferred between email addresses, browsers, or devices.

Texas Data Broker Disclosure

The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website.

To exercise your privacy rights, please see “U.S. State Specific Privacy Rights and Disclosures” above.

Policies and Rights Specific to Other Countries

For information specific to non-U.S. countries, please review our Privacy Portal. We offer specific opt out choices depending on your location (i.e., Australia, EU).

European Data Protection Regulation

LiveRamp European entities are subject to privacy and security frameworks called the General Data Protection Regulation and the U.K. Data Protection Act (together, the “European Data Protection Regulation”). It imposes a number of obligations on data controllers and data processors and affords data subjects a number of important rights. This document is intended to provide transparency regarding LiveRamp operations in the United States (“LiveRamp”) as required by the European Data Protection Regulation.

LiveRamp acts as both a “Data Controller” and a “Data Processor” under the European Data Protection Regulation. LiveRamp acts as a data controller with respect to personal data about its employees in the E.U. and the U.K. (i.e., human resource data), personal data it collects from its clients and prospective clients (i.e., customer relationship management data).

For some transfers, LiveRamp relies on: (i) Standard Contractual Clauses from the European Commission to cover international data transfers between the European Union, and the U.S.; and (ii) the IDTA (the International Data Transfer Agreement) issued by the ICO to cover international data transfers between the U.K. and the U.S., in order to ensure data security and integrity.

For other transfers, LiveRamp complies with the EU-U.S. Data Privacy Framework Principles, the U.K. Extension to the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework of notice, choice, onward transfer, security, data integrity, access, and enforcement. To learn more about how we collect, use, and retain your personal information when you use our services in the European Union or member countries, please Data Privacy Framework notice.

If you have queries and/or wish to exercise any of your rights in regards of the European Data Protection Regulation, please click on the following links:

Canada Privacy Rights and Choices

For information about exercising privacy rights and choices in Canada, please review our Canadian consumer rights portal here.

Mexico Privacy Rights and Choices

For information about exercising privacy rights and choices in Mexico, please review our Mexico privacy notice here.

Derechos y opciones de privacidad de México

Para obtener información sobre cómo ejercer los derechos y opciones de privacidad en México, consulte nuestro aviso de privacidad de México aquí.

How we update this Privacy Notice

This privacy notice is subject to change at any time. If we make any changes to this privacy notice, we will post the revised privacy notice on this page and update the date at the top of the notice. If we change this privacy notice in a material way, we will provide appropriate notice to you and seek your consent where required by applicable law. Notice may be provided, for example, via a banner on our website.

How you can contact us

If you have any questions or comments about LiveRamp’s privacy practices or your choices and rights regarding such use, please do not hesitate to contact us through the following methods:

Argentina

Asia Pacific

Brazil

Canada

Europe

We recommend reviewing the E.U. country specific privacy notices accessible here.

Mexico

U.S. and Other Non-Specified Countries

Online: U.S. Data Ethics Inquiries

Postal Address:
LiveRamp, Attn: Data Ethics Administrator
225 Bush Street, 17th Floor
San Francisco, CA 94104.