Adswag B.V. — Advertising Privacy Statement
1. Who we are
Adswag B.V. ("Adswag", "we") operates an advertising buying platform that delivers and measures advertising on websites, apps, audio services and connected-TV services of the publishers we work with, in the Netherlands and the wider EU.
Registered office: Molenpad 5, 1016 GL Amsterdam, The Netherlands. Chamber of
Commerce (KvK): 77810708.
Privacy contact: privacy@adswag.nl.
For the advertising delivery and measurement data described in this statement, Adswag acts as a controller in its own right, under the purposes and legal bases it declares as TCF vendor 1417. Consent is asked and collected on the publisher's website or app through the publisher's consent management platform (CMP); Adswag appears there as a vendor you can accept or refuse.
2. Where this statement applies
This statement covers the processing Adswag performs when an ad opportunity on a publisher property is offered to us, when we deliver an ad, and when we measure that delivery. It does not replace the privacy policy of the publisher whose site or app you are using, nor the privacy policy of the advertiser whose ad you see.
3. What data we process
Identifiers. We only read or write an identifier when the consent signal on the request permits it for vendor 1417. The complete set of identifiers we use:
| Identifier | What it is | Scope |
|---|---|---|
| Publisher first-party identifiers | Identifiers the publisher passes to us (for example from a publisher login) | Per publisher |
adswag_uuid | A random identifier our Prebid.js adapter stores in your browser (localStorage, or a first-party cookie), only with Purpose 1 consent | Per publisher website |
aswg_uid | A random identifier in a cookie on our own domain (ev.adswag.ai), set on our measurement endpoints, only with Purpose 1 consent | Across publishers, only where your browser allows third-party cookies |
| Device advertising identifiers | The advertising identifier of a connected-TV, audio or mobile device (respecting the device's "limit ad tracking" setting) | Per device |
All of these are random, opaque values. We hold no name, e-mail address or account of you, and we do not buy, sell or exchange identifiers with data brokers or identity providers.
Request and device information. Publisher and placement references, the channel and ad format, page or app context signals, device information (such as the user-agent), timestamps and auction transaction identifiers.
IP address. Your IP address is used at the edge of our platform to derive approximate geography and is then discarded: the full IP address is not stored, is not written to our event data, and is not sent to any third party. Where fraud filtering requires it, a truncated network prefix is carried instead.
Geography. We derive at most country, region, city and four-digit postal area (PC4). We never process GPS-grade location: latitude and longitude are discarded before they can reach any of our systems, and we declare no use of TCF Special Feature 1 (precise geolocation).
Consent data. The consent signal is interpreted once, at the edge of our platform. We keep a record of the consent state under which an identifier was processed (see section 8) — this record contains a non-reversible digest, not the identifier itself.
Frequency and delivery state. How often an identifier has seen a campaign (frequency capping), recency, and audience-segment memberships, held with automatic time-to-live expiry.
Measurement events. Ad impressions, completion quartiles for audio and video, clicks, viewability/audibility beacons and error events, each carried on signed, tamper-evident tracking URLs.
4. Purposes and legal bases (TCF vendor 1417)
We process personal data for the following TCF purposes. Where the table says "consent", we do not process for that purpose without your consent for vendor 1417. Where it says "legitimate interest", you can object at any time (section 5 and section 10).
| TCF purpose | Legal basis | Maximum retention |
|---|---|---|
| 1 — Store and/or access information on a device | Consent | See device storage table (section 7) |
| 2 — Use limited data to select advertising | Consent or legitimate interest (default: legitimate interest) | 90 days |
| 3 — Create profiles for personalised advertising | Consent | 365 days |
| 4 — Use profiles to select personalised advertising | Consent | 90 days |
| 5 — Create profiles to personalise content | Consent | 365 days |
| 6 — Use profiles to select personalised content | Consent | 365 days |
| 7 — Measure advertising performance | Consent or legitimate interest (default: legitimate interest) | 90 days |
| 8 — Measure content performance | Consent or legitimate interest (default: legitimate interest) | 90 days |
| 9 — Understand audiences through statistics | Consent | 90 days |
| 10 — Develop and improve services | Consent or legitimate interest (default: legitimate interest) | 365 days |
| 11 — Use limited data to select content | Consent or legitimate interest (default: legitimate interest) | 90 days |
Purposes 8 and 11 (measuring content performance and selecting content) are exercised by our content-distribution product Headline, not by the advertising buying platform — see section 11.
| TCF special purpose | Legal basis | Maximum retention |
|---|---|---|
| SP1 — Ensure security, prevent and detect fraud, and fix errors | Legitimate interest | 90 days |
| SP2 — Deliver and present advertising and content | Legitimate interest | 90 days |
| SP3 — Save and communicate privacy choices | Legitimate interest | 400 days |
Without a consent signal, or where consent is insufficient, we serve advertising contextually only (TCF Purpose 2, on the basis of legitimate interest): no identifier is read and none is written.
5. Our legitimate interests
Where we rely on legitimate interest (Purposes 2, 7, 8, 10 and 11 by default, and Special Purposes 1–3), the interests are: delivering and billing contextual advertising that funds the publishers you visit; measuring that delivery so buyers pay only for real, delivered advertising; selecting and measuring distributed content on a contextual basis (our Headline product, section 11); protecting our systems, publishers and buyers against fraud and invalid traffic; and honouring and evidencing your privacy choices.
The balancing rests on the limited nature of the data involved: under legitimate interest we select and measure advertising using contextual and technical request data; we do not read or write identifiers, build profiles or use precise location on that basis. We have conducted and documented a legitimate interest assessment for each of these purposes. You can obtain a summary of these assessments, and object to any legitimate-interest processing, via privacy@adswag.nl or via the publisher's consent tool.
6. What we never do
- No fingerprinting and no probabilistic identification: we never derive an identifier from your device's characteristics. (TCF Special Feature 2 is declared in our vendor registration to be transparent about the framework option, but it is not implemented, and our platform architecture forbids implementing it without explicit opt-in consent handling.)
- No precise location: latitude/longitude never enter our systems (section 3).
- No sale or exchange of identifiers or profiles to data brokers; no cookie syncing with third parties — the identifiers in section 3 are used inside our platform only.
- No processing of a user identifier without a consent decision attached to the operation.
- All processing takes place in the European Union (Google Cloud region europe-west4, the Netherlands).
7. Storage on your device
We store the following on your device, only with Purpose 1 consent for vendor 1417. The machine-readable version of this table (per the IAB TCF device storage disclosure specification) is published at content.adswag.ai/iab/vendorjson.json.
| Name | Type | Where | Maximum lifetime | Refreshed? |
|---|---|---|---|---|
adswag_uuid | localStorage | The publisher website you are visiting | Until you clear site data | — |
adswag_uuid | Cookie (fallback when localStorage is unavailable) | The publisher website you are visiting | 365 days | No |
aswg_uid | Cookie | ev.adswag.ai (our domain) | 365 days | Yes, on each consented measurement event |
8. How long we keep data
- Serving and measurement data that carries an identifier: at most 90 days, enforced by automatic deletion of the underlying storage partitions.
- Profile and service-improvement data: at most 365 days.
- Consent records — the proof of the consent state under which an identifier was processed: 400 days. These records contain a non-reversible digest rather than the identifier, and they are retained (not deleted on request) because they are our evidence of lawful processing.
- Aggregated, identifier-free reporting and financial records: kept per our commercial and statutory obligations; they contain no user identifiers.
9. Recipients and processors
We use Google Cloud (region europe-west4, the Netherlands) as our infrastructure processor. Creative assets (the ad files themselves — public content, no personal data) are delivered through a content delivery network. We do not transfer the personal data described in this statement outside the European Economic Area.
10. Your rights
You have the right of access, rectification, erasure, restriction, objection and data
portability under the GDPR. Because we only hold random identifiers, we will ask you for
the identifier value (for example the adswag_uuid or aswg_uid
value from your browser) so we can locate data that relates to you; we cannot identify
you by name.
You can withdraw or change your consent at any time through the consent tool on the publisher's website or app. To exercise any right directly with us, contact privacy@adswag.nl. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
11. Our Headline product
Adswag B.V. also operates Headline, a content-distribution product that places customers' content on the websites of publishers in its network and measures whether that content was actually read and engaged with (customers pay for engaged visits, not for placements). Headline is the Adswag B.V. processing behind TCF Purpose 8 (measure content performance) and TCF Purpose 11 (use limited data to select content) in our vendor registration; the advertising buying platform described in the rest of this statement performs neither.
Headline operates under the same rules as the rest of this statement:
- Content selection (Purpose 11) is contextual on the legitimate-interest basis: which content is shown is decided from the page or app context and technical request data — no identifier is read or written, and no profile is built or used on that basis.
- Content measurement (Purpose 8) covers engagement signals about the content unit — such as time on page, scroll depth and engaged-visit counts — and is identifier-free on the legitimate-interest basis.
- Identifiers follow the same posture as section 3: no identifier is read or written without your consent for vendor 1417, and any device storage Headline uses is limited to the items disclosed in section 7.
- Retention follows section 8: at most 90 days for measurement data carrying an identifier, at most 365 days for profile and service-improvement data.
- Hosting is in the European Union.
- Objection works the same way: Headline reads the TCF consent signal and honours the legitimate-interest objection you register in the publisher's consent tool, and you can always contact privacy@adswag.nl (section 10).
12. Changes to this statement
We will publish any change to this statement at this address and update the version and date above. Material changes to purposes or legal bases are additionally reflected in our IAB TCF vendor registration (vendor 1417), which the consent tools on publisher properties read.