Privacy Policy

1. Introduction

Factor42, Inc. ("Factor42," "we," "us," or "our") is committed to protecting the privacy and security of the personal information we collect and process. This Privacy Policy describes how we collect, use, disclose, and safeguard personal data obtained through our website at factor42media.com (the "Site") and in connection with our digital advertising operations and fulfillment services (collectively, the "Services").

This Policy applies to business contacts, authorized users of our platform, and individuals whose information we receive in the course of providing Services to our clients. It is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

By accessing our Site or engaging with our Services, you acknowledge that you have read and understood this Privacy Policy. If you are accessing our Services on behalf of a business entity, you represent that you have authority to bind that entity to this Policy.

2. Data We Collect

We collect personal data that you provide directly to us, data generated through your use of our Services, and limited data received from third parties in connection with our operations. The categories of personal data we collect include:

2.1 Contact Information

Name, job title, business email address, business phone number, and postal address of individuals who inquire about or use our Services. This information is typically provided when you fill out a contact form, request a demo, or create an account with us.

2.2 Company Information

Legal business name, company size, industry, website URL, and business type. We may also collect information about your organization's advertising operations, platforms used, campaign budgets, and current ad tech stack to properly scope and deliver our Services.

2.3 Billing Information

Billing contact name and email, billing address, and payment method details (processed through PCI-DSS compliant third-party payment processors — Factor42 does not store raw payment card data). We also retain records of invoices issued, fees charged under our management fee and CPM-based pricing structure, and payment history.

2.4 Usage and Analytics Data

When you interact with our Site or reporting dashboards, we automatically collect technical data such as IP addresses, browser type and version, operating system, referring URLs, pages visited, time spent on pages, and feature usage patterns within our platform. This data is used to improve Service quality, detect security incidents, and optimize our reporting tools.

2.5 Campaign and Ad Operations Data

In the course of providing ad trafficking, optimization, and reporting services, we process campaign data on behalf of our clients. This may include audience segments, creative assets, placement targeting data, and impression/click/conversion reporting data. Where this data contains personal information about end users of our clients' advertising (e.g., aggregated demographic data), we process it strictly as a data processor under our clients' instructions and pursuant to the applicable data processing terms.

2.6 Cookie and Tracking Data

We use cookies and similar tracking technologies on our Site as described in Section 6 of this Policy.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• Service Delivery: To onboard clients, manage user accounts, provision platform access, traffic advertising campaigns, generate reports, and provide optimization recommendations.
• Billing and Finance: To issue invoices based on management fees and CPM usage, process payments, and maintain accurate financial records.
• Client Communications: To respond to inquiries, provide customer support, send campaign performance alerts, and deliver operational notifications related to your account.
• Sales and Marketing: With your consent or where otherwise permitted by law, to send information about Factor42's services, case studies, and industry insights. You may opt out of marketing communications at any time.
• Site Improvement and Analytics: To understand how users interact with our Site, identify technical issues, and improve the usability and content of our platform.
• Legal Compliance and Security: To comply with applicable laws and regulations, respond to lawful requests from public authorities, investigate potential fraud or security incidents, and enforce our contractual agreements.
• Business Operations: For internal purposes such as auditing, research, and general business administration.

4. Legal Basis for Processing (GDPR)

For individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR for processing personal data:

• Contractual Necessity (Art. 6(1)(b)): Processing required to perform a contract with you or your employer, including delivering ad operations services, managing accounts, and processing payments.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, such as improving our Services, securing our systems, conducting fraud prevention, and communicating relevant service-related updates — where these interests are not overridden by your rights and interests.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including tax, financial reporting, and data retention obligations.
• Consent (Art. 6(1)(a)): Where we rely on your consent (e.g., for marketing emails or non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

Where we process personal data of end users on behalf of our clients (as a data processor), the client is the data controller and establishes the legal basis for that processing pursuant to our Data Processing Agreement (DPA).

5. Data Sharing & Third Parties

Factor42 does not sell, rent, or trade your personal data. We share personal data only in the following circumstances:

• Service Providers: We engage vetted third-party vendors to assist in operating our business, including cloud hosting providers, payment processors, customer relationship management (CRM) tools, analytics platforms, and email service providers. These vendors are contractually restricted to processing data solely on our behalf and in accordance with this Policy.
• Ad Platform Integrations: In delivering campaign trafficking services, we may interface with advertising platforms (e.g., Google Campaign Manager, The Trade Desk, Meta Ads Manager, Amazon DSP, and others) on your behalf. Data transmitted to these platforms is governed by your agreement with those platforms as well as our service terms.
• Legal Requirements: We may disclose personal data when required by applicable law, court order, or government regulation, or to protect the rights, property, or safety of Factor42, our clients, or others.
• Business Transfers: In the event of a merger, acquisition, asset sale, or other business combination involving Factor42, personal data may be transferred as part of that transaction, subject to standard confidentiality protections and notice to affected individuals.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

6. Cookies & Tracking Technologies

Our Site uses cookies and similar technologies (such as pixels and local storage) to enhance your experience and collect analytics data. The categories of cookies we use include:

• Strictly Necessary Cookies: Required for the Site to function properly, including maintaining session state and security. These cannot be disabled.
• Analytics Cookies: Used to understand how visitors interact with our Site (e.g., pages visited, session duration). We may use tools such as Google Analytics. Data collected is aggregated and pseudonymous.
• Marketing Cookies: Used to understand the effectiveness of our own promotional communications. We do not use third-party behavioral advertising cookies on our corporate website.

You may control cookie preferences through your browser settings or our cookie consent banner. Note that disabling certain cookies may affect Site functionality. For more information about managing cookies, visit allaboutcookies.org.

7. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law. Specific retention periods include:

• Client Account Data: Retained for the duration of the client relationship and for a period of up to seven (7) years following contract termination to meet financial, audit, and legal compliance requirements.
• Campaign Operations Data: Retained for a minimum of three (3) years for audit and performance benchmarking purposes, unless the client requests earlier deletion consistent with contractual terms and applicable law.
• End-User Ad Data (processed on behalf of clients): Deleted within thirty (30) days following contract termination, unless the client instructs otherwise or retention is required by law.
• Marketing Inquiries: Contact form submissions and prospect data retained for two (2) years from the date of last interaction, after which they are deleted or anonymized.
• Site Analytics Data: Aggregated or anonymized after 26 months.

8. Your Rights

8.1 Rights Under GDPR (EEA/UK Residents)

If you are located in the EEA or UK, you have the following rights with respect to your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where there is no overriding legal basis for continued retention.
• Right to Restriction: Request that we limit processing of your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format and transmit it to another controller where technically feasible.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.
• Right to Lodge a Complaint: Lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EEA member state).

8.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share data.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: Factor42 does not sell personal information. We do not share personal information for cross-context behavioral advertising purposes. You may nonetheless submit an opt-out request to privacy@factor42media.com.
• Right to Limit Use of Sensitive Personal Information: Where applicable, request that we limit the use of sensitive personal information to permitted purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@factor42media.com. We will respond to verifiable requests within the timeframes required by applicable law (generally 30 days under GDPR; 45 days under CCPA/CPRA with potential extension).

9. Children's Privacy

Factor42's Services are designed exclusively for business-to-business use and are not directed to individuals under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete such data promptly. If you believe we may have collected information from a minor, please contact us at privacy@factor42media.com.

10. International Data Transfers

Factor42 is headquartered in the United States. If you are located outside the United States, your personal data may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms. Where applicable, we supplement these safeguards with technical and organizational measures to ensure an equivalent level of protection for personal data.

For more information about the safeguards we apply to international transfers, or to request a copy of the applicable SCCs, please contact privacy@factor42media.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law or where we deem it appropriate, notify affected individuals via email or prominent notice on our Site.

We encourage you to review this Policy periodically. Your continued use of the Site or Services following the posting of an updated Policy constitutes your acknowledgment of the changes.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team:

If you are located in the EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.