Privacy Notice – Ad Measurement Services 

1. Who are we and what is this notice for?

We are Brand Metrics ("Brand Metrics"). We provide ad measurement technology that our customers (advertisers, agencies and publishers) use to measure and analyse the impact of digital advertising campaigns on their own websites and apps (the "Measurement Services"). This notice is for people who visit a website or app on which our Measurement Services are deployed by one of our customers – for example because you were exposed to an advertisement that is being measured, or because you were asked to answer a short survey ("Respondents"). It explains what Personal Data Brand Metrics processes about you in that context, and how.

This notice does not apply to our own website, our customer portal, or our general business relationships – for that, please see our general Privacy Notice 

2. What is Brand Metrics’ role, and who is responsible for your data?

When we provide our Measurement Services, we process Personal Data solely on behalf of, and under the instructions of, the customer that has deployed our Measurement Services on their website or app (the "Customer"). Under the GDPR, that Customer is the Controller of your Personal Data in this context, and Brand Metrics acts as their Processor. We enter into a data processing agreement with each Customer, setting out the purposes and safeguards that apply to this processing.

Because the Customer is the Controller for the Measurement Services, they are primarily responsible for informing you about our processing, and are the appropriate point of contact for exercising your rights in that context – please also check the Customer’s own privacy notice. This notice explains our processing from Brand Metrics’ side, and how you can reach us directly if needed.

3. What Personal Data do we process, and why?

Depending on how a Customer has configured our Measurement Services, we may process the following categories of Personal Data about you as a Respondent:

• Cookie and local-storage identifiers placed on your device (e.g. to recognize your browser during a measurement, or to remember that you opted out) – see our Cookie Statement for the full list of cookies, what they store, and how long we keep them.
• Information about your exposure to an advertisement, such as the number of exposures, exposed time, device type, and – only if a Customer has enabled this – an approximate region derived from your IP address.
• Your answers to survey questions, if you are shown and choose to answer a survey.
• Where a Customer has enabled our identity-resolution features: a customer-provided user or device identifier, or a hashed combination of your IP address and browser User-Agent, in accordance with the Customer’s configurations and documented instructions. These identifiers are used only to perform the measurement as defined by the Customer – primarily, to link an exposure to a later survey response across sessions or devices, and to avoid showing you the same survey too often.

We process this data because it is necessary to perform the Measurement Services the Customer has engaged us for. The legal basis relied on for showing you an ad, setting a cookie on your device, or asking for a survey response – typically your consent, obtained via the Customer’s own consent management platform, often through the IAB Transparency & Consent Framework – is the Customer’s responsibility. Brand Metrics is a registered vendor within that framework and will not process cookie-based data without valid consent, or where we can determine that consent has not been given.

4. Cookies and similar technologies

We use cookies and local storage to run our Measurement Services; see our Cookie Statement for the full list of cookies we use, what they store, and how long we keep them. Where a Customer has enabled our identity-resolution features (see the previous section), we may additionally use a hashed combination of your IP address and browser User-Agent as an identifier strictly for the measurement purposes defined by that Customer. This is not stored in a cookie – it is processed and stored server-side.

5. How long do we keep this data?

• Cookie and local-storage data: see the retention periods in our Cookie Statement.
• Exposure and survey data collected during a measurement: kept for the period specified by the Customer in its documented instructions or in the data processing agreement with that Customer.
• Aggregated results (KPIs) we report to the Customer: survey responses are anonymized – the identifier linking them to your browser or device is removed – before being stored in our reporting database.
• Identity-resolution data (see ‘What Personal Data do we process’ above): kept only for as long as necessary to support the measurement it relates to, in accordance with the Customer’s instructions and/or the data processing agreement.

After these periods, we may retain data to comply with a legal obligation, to investigate fraud or misuse, or to substantiate a legal claim. In such cases we retain the data separately and use it only for that purpose and you will be informed separately of this processing, when this is required.

6. Do we share this data with others?

We work with sub-processors who support our infrastructure, for example cloud hosting and content-delivery providers. We have data processing agreements with all of them, and they may only process data on our instructions. We share the results of a measurement – such as aggregated KPIs and anonymized survey responses – with the Customer that commissioned it. We do not sell Respondent data, and we do not use it for our own independent purposes.

7. Export of Personal Data outside the European Union

We may transmit Personal Data to parties outside the European Union or European Economic Area if one of our sub-processors is established there. We only do so where an adequate level of protection applies, or where we have appropriate contractual safeguards in place, such as the European Commission’s Standard Contractual Clauses. You may contact us if you wish to receive more information or a copy of these safeguards.

8. Your rights

Because the Customer is the Controller of your Personal Data in this context, requests to exercise your data subject rights – such as access, rectification, erasure, restriction, objection, or data portability – should generally be directed to that Customer. If you contact Brand Metrics directly, we will support the Customer in responding, including via the self-service tools described below.

• You can see what cookie and local-storage data we hold about your browser, and delete non-anonymized information directly, at collector.brandmetrics.com/cookies and collector.brandmetrics.com/cookies2.
• You can opt out of Brand Metrics measurements entirely, or on a specific site, via the cookie settings on the relevant website, or using the opt-out mechanisms described in our Cookie Statement.
• Most browsers let you send a Do Not Track (DNT) signal; we look for this signal before setting any cookies.
• Customers can request, on your behalf, that all data associated with a given identifier be exported or deleted; this is also available to them via an API.

You are always entitled to file a complaint with a data protection supervisory authority if you believe your Personal Data is not being processed in accordance with the GDPR – either the supervisory authority of the relevant Customer, or your own local EU/EEA supervisory authority.

9. Security

We take appropriate technical and organizational measures to protect Personal Data against loss or unauthorized processing, and require the same of our sub-processors.

10. Changes to this notice

This notice may be changed from time to time. Please check it regularly. A new version is effective immediately upon posting. If we make a significant change, we will state so together with the revised notice.

11. Contact and our supervisory authority

If you have questions about this notice or about Brand Metrics’ processing of your Personal Data, you can contact us at [email protected].

As Brand Metrics Sweden AB is established in Sweden, our lead supervisory authority is Integritetsskyddsmyndigheten (IMY) – the Swedish Authority for Privacy Protection, website: https://www.imy.se. If you live or work in a different EU/EEA member state, or believe the alleged infringement took place there, you may also lodge a complaint with the supervisory authority of that member state.

Brand Metrics Sweden AB

Kyrkogatan 15, 411 15 Göteborg, Sweden

E: [email protected]

W: https://www.brandmetrics.com/

Chamber of Commerce: 559139-4332