FACTUAL SERVICES PRIVACY POLICY

Last Updated: December 27th, 2019

This Services Privacy Policy outlines Factual’s collection, use and sharing of consumer data for Factual services and describes consumer data protection rights, including a right to object to some of our processing.

For information on data collected from business users of Factual websites and apps or that Factual otherwise obtains in connection with managing our business, please see the Factual Site Privacy Policy.

Sections:
  1. Who are we?
  2. What information does Factual hold?
  3. How does Factual get this information?
  4. How does Factual use this data in its services?
  5. Does Factual share Observation Data
  6. How long does Factual retain Observation Data?
  7. U.S. Consumer opt-out
  8. Particular U.S. segment disclosures
  9. More information for individuals in the EEA
    1. When Factual is a data controller, what is our legal basis for processing?
    2. How long does Factual, as a data controller, retain data that is subject to GDPR?
    3. E.U.-U.S. Privacy Shield and Swiss-U.S. Privacy Shield
    4. Consumer rights for individuals in the EEA
  10. Children’s privacy
  11. More information for California residents
  12. Data security
  13. Changes to this Services Privacy Policy
  14. Factual contact information

1. Who are we?

Factual helps companies and other organizations better understand and engage with consumers and markets by using location data. Factual’s services draw observations about individuals from location data collected from the individual’s device such as their tablet or smartphone. We refer to these individuals as “Consumers“.

Factual’s customers (“Customers“), such as brands, advertising agencies, and online ad platforms, may use this information for the purpose we describe below. For example, if location data suggests that a Consumer regularly visits golf courses, a Customer may decide to show golf-related advertisements to that Consumer

2. What information does Factual hold?

Factual’s data falls into two broad categories: Point of Interest Data (or POI Data) and Observation Data. Factual combines POI Data and Observation Data to provide its services. Factual holds detailed information related to businesses and other points of interest for example on restaurants, stores, hotels, doctors’ offices, airports, and monuments and includes location coordinates (e.g., the latitude-longitude coordinates of a local grocery store). We refer to this information as “Point of Interest Data.”

Factual also processes information about Consumers, which is described in the table below. We refer to this information and the inferences that Factual draws from this information as “Observation Data.

Demographic information Information that includes data about a Consumer such as age range, gender, and/or birth year.
Device information Information about a device and apps which generally includes mobile advertising identifier, device type (e.g., tablet, smartphone, television), operating system (e.g., iOS, Android), app names and/or identifiers, IP address, network provider, mobile carrier, mobile browser type (e.g., Firefox, Chrome), timestamp, time zone, information about the speed, bearing, orientation, and altitude of a device, or other information about the device.
Geolocation data Precise geolocation data from or about a device (e.g., latitude-longitude coordinates).
Exposure data Information about the advertising and content that has been displayed on a particular device.
Cross-device data Information about the possible relationships among different devices such as browsers, mobile devices, and televisions (outside the EEA*).
Other data Information such as consumer products information, inferences drawn from other data described above, or information about events that were held at specific locations, that Factual has associated with a particular device (e.g., a device attended a Wimbledon match).

*In this privacy policy, we will use “EEA” to refer to the European Economic Area, the UK and Switzerland.

Observation Data does not include information that has been aggregated or deidentified (so that it does not identify a specific device).

3. How does Factual get this information?

Factual creates its POI Data using information from third party data contributors, Customers, and the open web.

Factual receives Observation Data from suppliers and sometimes from Customers.

Factual’s suppliers are third parties (e.g., third-party app publishers, data aggregators, ad tech platforms, etc.) who provide Observation Data to Factual for general use in our Services. Some suppliers use a Factual software development kit (SDK) to provide us with Observation Data.

In addition, some Customers provide Observation Data for Factual to use in providing Services solely to those Customers and their clients (e.g., an ad agency and its advertiser client), and not for use in Factual’s generally available services. For example, Customers may use a Factual pixel to provide Factual with exposure data.

4. How does Factual use this data in its services?

Factual uses POI Data and Observation Data to create and improve our services.

Category Such data is used to:
POI Data
  • Give Customers a reliable set of business and other locations to use in their own services. E.g., a Customer may use POI Data to show points of interest on a map.
  • Enable Factual to determine the businesses and other locations that a device has visited.
Observation Data
  • Enable Customers to target advertising and personalize content and services based on inferred traits or preferences such as ‘luxury good shopper’. E.g., a jewelry store could use Factual’s services to send exclusive offers to luxury goods shoppers.
  • Help Customers evaluate customer preferences and behaviors.
  • Allow Customers to evaluate the effectiveness of advertising campaigns. E.g., a car dealership could use our services to determine if its ad campaign persuaded Consumers to visit the dealership.
  • Provide Customers with insights and analysis of markets, Consumer behavior and business opportunities, and enable Customer to draw their own insights and analysis.
  • Give Customers a resource to design and improve other products and services.
  • Enrich Customer data assets.

5. Does Factual share Observation Data

Observation Data will be disclosed in the limited circumstances described below:

Categories of recipients Purpose of sharing.
Customers Factual will disclose Observation Data in order to provide its services to Customers.  
Government, law enforcement, or regulatory bodies. Factual will disclose Observation Data if it believes that such action is necessary to comply or assist with applicable laws or regulatory investigations, or to respond to a court order, judicial or other government subpoena, warrant, or law enforcement request.
Factual’s service providers. Factual shares Observation Data with service providers that help it provide or improve the services, such as Amazon Web Services. These service providers are authorized to use Observation Data only for the purpose of providing services to Factual.
Factual’s affiliates and joint venture partners. Factual will share Observation Data with its affiliates, strategic business partners and joint venture partners as necessary to operate or enhance Factual’s business.
Acquirer or merger entity In the event that Factual is acquired by or merged with a third-party entity or is potentially going to be acquired by or merged with a third-party entity, in any partial or total sale of assets including in the event of bankruptcy, or in any other corporate change, Factual may transfer or assign Observation Data as part of that actual or potential merger corporate change.
Other

Factual will disclose Observation Data if it believes it will help protect Factual, its Customers, or any other person or third party, or to enforce any legal rights.

6. How long does Factual retain Observation Data?

Factual may retain Observation Data not subject to GDPR: (a) as needed to provide its services for up to 24 months from the date of last observation; and, (b) for other business purposes (including technical developments, legal, accounting, auditing, or bug-detection and prevention) for such period as Factual considers reasonably necessary to protect its legal or business interests.

Factual may retain data beyond the foregoing time periods if required by law.

For data subject to GDPR, please see More information for individuals in the EEA.

7. U.S. Consumer opt-out

In the United States, the Network Advertising Initiative (“NAI”) and the Digital Advertising Alliance (“DAA”) have established rules about interest-based advertising including cross-device linking for such advertising. Interest-based advertising is digital advertising that is tailored to Consumers’ inferred interests, preferences, and locations. Cross-device linking is the practice of associating different browsers and/or devices (such as mobile devices and televisions) based on information about the likely relationships among them.

Factual may use or transfer Observation Data for interest-based advertising including cross-device linking. Factual is a member of the NAI and adheres to the NAI Code of Conduct as described on the NAI website. Factual also adheres to the Digital Advertising Alliance (DAA) Self-Regulatory Principles as described on the DAA website.

Opting out of advertising services by Factual

Factual provides Consumers the ability to opt-out of the collection and use of mobile app data by Factual across apps over time on a device for interest-based advertising purposes (including cross-device linking for such purposes), and for ad delivery and reporting purposes, through the DAA’s AppChoices tool.

To exercise this opt-out, a Consumer can download the AppChoices app onto the relevant mobile device and opt-out through the app. When a Consumer opt-outs as to Factual on a particular device, Factual will also stop using and transferring mobile app data from that device for interest-based advertising and ad delivery/reporting on other linked devices. Additionally, when a Consumer opts-out as to Factual on a particular device, Factual will stop using mobile app data coming in from other linked devices for interest-based advertising and ad delivery/reporting to the device from which choice was exercised.

AppChoices is available at these links:

Please note that Consumers who use more than one mobile device should renew their opt-out choices on each device.

Consumers who opt-out from use of their data as part of Factual’s Services may continue to receive interest-based advertising from other companies. Additionally, Factual may continue to collect, use, and transfer mobile app data for purposes other than interest-based advertising or ad delivery/reporting.

Opting out of interest-based advertising by Factual’s Customers and suppliers

In addition to the links above for mobile opt-outs, to opt-out of web-viewing information collection for interest-based advertising by companies that participate in the NAI or the DAA, visit NAI’s opt-out page or DAA’s Consumer Choice Page.

8. Particular U.S. segment disclosures

The NAI requires members to disclose standard interest segments based on health- and wellness-related interests and information, or based on political information or interests, that are used to deliver interest-based advertisements in the United States.

Factual provides Customers with such standard segments to deliver interest-based advertisements and for other purposes; our health segments are based on data that is not considered sensitive under the NAI Code of Conduct. For a list of our standard health and political segments, please click here

9. More information for individuals in the EEA

We will use “GDPR” to refer to the General Data Protection Regulation and UK and Swiss equivalents and, as mentioned above, we will use “EEA” to refer to the European Economic Area, the UK and Switzerland.

a. When Factual is a data controller, what is our legal basis for processing?

POI Data

Factual processes POI Data that is subject to GDPR when it is in Factual’s interests to do this and when these interests are not overridden by the data subjects’ data protection rights. These legitimate interests include giving Customers a reliable set of business and other locations to use in their own services and enabling Factual to determine the businesses and other locations that a device has visited.

Observation Data

Factual processes Observation Data based on consent.

As Factual does not collect Observation Data directly from Consumers, it requires its suppliers to provide transparent disclosures and collect consent on Factual’s behalf.

 

b. How long does Factual, as a data controller, retain data that is subject to GDPR?

To the extent that any POI Data is subject to GDPR, Factual may retain POI Data for as long as Factual has a legitimate interest and this interest is not overridden by the data subjects’ data protection rights.

Factual may retain Observation Data: (a) as needed to provide its services for up to 36 months from the date of collection; and, (b) for other business purposes (including technical developments, legal, accounting, auditing, or bug-detection and prevention) for such period as Factual considers reasonably necessary to protect its legal or business interests (usually up to 6 years).

Factual may retain data beyond the foregoing time periods if required by law.

c. E.U.-U.S. Privacy Shield and Swiss-U.S. Privacy Shield

Factual complies with the E.U.-U.S. and Swiss-U.S. Privacy Shield frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data from the EEA, the UK, and Switzerland. Factual certifies that it adheres to the Privacy Shield Principles. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

Factual is accountable for information that it receives under Privacy Shield and subsequently transfers to a third party, including third-parties that Factual engages to process this information on its behalf. We are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

We are committed to resolving complaints about our collection or use of personal data. If you have inquiries or complaints regarding this Privacy Policy, we encourage you to contact us at privacy@factual.com. If we do not respond in a timely manner or your complaint remains unresolved, you may file a complaint with JAMS. For more information, please visit https://www.jamsadr.com/eu-us-privacy-shield. You may also have the right to invoke binding arbitration for unresolved complaints, as described in Annex I to the Privacy Shield Principles.

d. Consumer rights for individuals in the EEA

You may ask Factual for a copy of your information to correct it, erase it, and to transfer it to other organizations at your request.

In addition, you can object to the processing of your personal data where, for example, you want to opt-out of Factual using your personal data for our services.

Wherever we rely on your consent, you will also be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

These rights may be limited in certain circumstances, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in local implementing legislation. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below.

We want to satisfy queries you may have about the way Factual processes your data. Please contact us with any questions at privacy@factual.com or the information provided above

However, if you have unresolved concerns you may also have the right to make a complaint to the relevant data protection supervisory authority or to seek a remedy through the courts if you believe that your rights have been breached.

10. Children’s privacy

Factual does not knowingly collect personal information from children under 13 years old (16 years old in California, the EEA, the UK and Switzerland) or from websites or online services directed to children under 13 years old (16 years old in the EEA, the UK and Switzerland).

11. More information for California residents

This section contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to the CCPA. This section applies to both Observation Data and POI Data, to the extent that such data is “personal information” under the CCPA.

Personal Information We Collect

We collect the following categories of personal information:

  • Personal and online identifiers – described above under Device information and Cross-device data and POI Data
  • Characteristics of protected classifications under California or federal law – described above under Demographic information
  • Geolocation information – described above under Geolocation data and POI Data
  • Internet or other electronic network activity information – described above under Exposure data
  • Commercial or transactions information – described above under Other data
  • Inferences drawn from the above categories of information, about your predicted characteristics and preferences – described above under Other data
  • Other information about you that is linked to the categories described above

Categories of Sources

We collect all of the categories of personal information listed above from the following categories of sources: Factual’s Customers; other data suppliers (primarily data aggregators, app publishers, and ad tech platforms); and service providers.

Why We Collect, Use, and Share California Information

We use and disclose all of the categories of personal information listed above for our commercial and business purposes, as further described in this Privacy Policy. These commercial and business purposes include, without limitation:

Our commercial purposes, including selling and otherwise disclosing the personal information to our Customers for our services, as further described above under “How does Factual use this data in its services?”

Our business purposes as identified in the CCPA, which include:

  • Auditing related to our interactions with devices;
  • Legal compliance;
  • Detecting and protecting against security incidents, fraud, and illegal activity;
  • Debugging;
  • Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics;
  • Internal research for technological improvement;
  • Internal operations;
  • Activities to maintain and improve our services; and
  • Other one-time uses.

Recipients of California Personal Information

We sell or otherwise disclose all of the categories of personal information listed above to Factual’s Customers, which include the following categories of third parties:
Advertising/marketing companies;
Advertising networks, exchanges, and related services;
Apparel & accessory companies;
Automotive companies;
Business services/agencies;
Business-to-business companies;
Parenting product companies;
Communication services companies;
Consumer packaged goods companies;
Health and wellness product and service companies;
Marketing data companies;
Data analytics providers;
Operating systems and platforms;
Social networks;
Consumer data aggregators;
Educational institutions & companies;
Electronics companies;
Energy and utility companies;
Financial services companies;
Food & beverage companies;
Gift product companies;
Lifestyle & interest product companies;
Manufacturing companies;
Not for profit organizations;
Publishing product companies;
Technology/computer software companies;
Telecommunications companies;
Travel, leisure, & entertainment companies;
Affiliates not under the Factual brand; and
Government, law enforcement, or regulatory bodies.

We disclose all of the categories of personal information listed above to the categories of third parties listed below for business purposes:

Service providers; Affiliates not under the Factual brand; Joint venture partners; and Government, law enforcement, or regulatory bodies.

Your Rights Regarding Personal Information

California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

  • The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you, the categories of sources from which we collected your personal information, our purposes for collecting or selling your personal information, the categories of your personal information that we have either sold or disclosed for a business purpose, and the categories of third parties with which we have shared personal information;
  • The right to request that we delete the personal information we have collected from you or maintain about you.
  • The right to opt out of our sale(s) of your personal information. Please note that if you opt out of certain types of sales, we will be unable to provide you with the services that rely on such sales.
  • The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

To exercise any of the above rights, please contact us using the following information and submit the required verifying information, as further described below:

Verification Process and Required Information

Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. To exercise rights related to Observation Graph data, we will require you to provide, at a minimum, your name, your email address and/or phone number, your mobile device advertising identifier, and an electronic signature. To exercise rights related to POI data, we will require you to provide, at a minimum, your name, your email address and/or phone number, business name and contact information, and an electronic signature.

Authorized Agent

You may designate an authorized agent to make a CCPA request on your behalf. Note that we will need additional information from your authorized agent to verify that they are acting as your authorized agent. To exercise your rights via an authorized agent, we will require your authorized agent to provide, at a minimum, their name, their email address and/or phone number, and a notarized affidavit and/or other legal documentation, in addition to the information described in the section Verification Process and Required Information.

Minors’ Right to Opt In

We do not sell the personal information of California minors under 16 years of age.

12. Data security

Factual uses reasonable physical, managerial, and technical safeguards to preserve the integrity and security of the personal information stored by Factual. Such safeguards will include technical and organizational measures designed to ensure a level of security appropriate to the risk.

13. Changes to this Services Privacy Policy

This Services Privacy Policy may be revised periodically; please revisit this page regularly to remain up to date on any changes.

14. Factual contact information

Please contact us with any questions or comments about this Services Privacy Policy or our practices at:

General privacy email: privacy@factual.com

Data Protection Officer email: DPO@factual.com

General contact address:

Factual
P.O. Box 49348
Los Angeles, CA 90049, USA

Representative address in the EEA, the UK and Switzerland:

Factual 
90 Fetter Lane
London EC4A 1JP