Kargo is committed to transparency concerning its data practices. Our goal is to provide you with clear and meaningful information on the data we collect, use and share and make sure you understand and can exercise your rights concerning your personal data.
As part of its commitment to consumer privacy, Kargo is a member of the Network Advertising Initiative (NAI) and adheres to the NAI Code of Conduct. Kargo also adheres to the Digital Advertising Alliance (DAA) Self-Regulatory Principles. In addition, Kargo has implemented and follows the specifications and policies of the IAB EU Transparency & Consent Framework (TCF) as part of our compliance with EU data protection law. See https://iabeurope.eu/transparency-consent-framework/ for more information. Kargo’s vendor identification number within the TCF is 972.
This Policy sets out how Kargo uses personal information when it acts as a “data controller” or “business” (i.e. where we decide how and for what purpose personal data is processed).
On the other hand, in particular in relation to Kargo Commerce services, we may also act as a “data processor” or “service provider”. For these Services, our customers and business partners engage us to process personal data of their customers and potential customers, or require us to access personal data held by third-parties (e.g. social networks such as Facebook).
In these cases, our customer is the data controller, and primarily responsible for the data processing activities, and we must process the personal data only on their behalf and in accordance with their instructions.
Where we are a data processor or service provider, you should refer to the Privacy Policies of the relevant controllers and businesses for further information. The relevant data controller or business should enable you to exercise all the same rights as set out in this Policy, and if you contact us then we will have to forward your request to the relevant data controller.
2. Introduction to Kargo
Through its Services, Kargo facilitates the buying and selling of digital ads for our business partners, which include advertising partners, brands, advertising agencies, marketing companies, and online publishers (“publisher partners”). The collection, use and sharing of data may enable these partners, using the Services, to conduct interest-based advertising. Interest-based advertising involves showing you ads on the websites you visit that may be of interest to you based on your browsing history. Ads will appear on the websites you visit whether or not the ads are interest-based. Digital publishers of all sizes, from bloggers to international news organizations, rely on advertiser revenue to support their content. Click here to learn more about interest-based advertising.
Through Kargo Commerce, we also provide services generally to retail brands through our technology platform that is specially designed to facilitate their advertising campaigns across social networks such as Facebook, Instagram, Snapchat, Pinterest, and TikTok.
For this area of Services, our customers provide us with information on their product ranges. We may assist with creative services to enhance this information and design effective campaigns. We work with the social networks to decide which types of users may be most interested in these products, and configure and buy advertising campaigns for our customers. Our customers may also in some cases provide us with information relating to their current or potential customers for inclusion in the relevant campaigns (which may include name, postal address, postal codes, email, product data, loyalty data, IP addresses, pricing and promotional data, and may be provided in hashed or encrypted form). However, normally only the social networks select and know who the audiences are for the campaigns, and neither we nor our customers see their data.
So, in this case, we either process no personal data or, for any personal data that our customers provide to us or ask us to obtain from the social networks, we are a data processor or service provider, and they are the data controller or business. We process such personal data only on our customers’ instructions, and in accordance with applicable privacy laws and the data processing agreements entered into with our customers.
3. Information We Collect
(a) Interest-based advertising
Our goal is to provide you with relevant, engaging advertising content in a way that respects your right to privacy. As described below, we deliver the Services using device data and browsing history. We do not collect or know your name, address, email, date of birth, phone number, or other personal identifying information unless you choose to provide it to us (e.g., if you contact us with an inquiry).
Through the Services, we collect information that allows us to make inferences about your interests for advertising purposes. This data may constitute personal information or personal data protected by applicable laws. Collecting the types of information described below allows us to work with our business partners to show you interest-based advertisements and to measure the success of those advertisements.
Technical Identifiers We use certain types of technical identifiers to identify your device, including:
- Kargo-developed proprietary identifiers
- Cookies (small text files)
- Mobile advertising identifiers (such as Apple IDFA and Google AAID)
- IP address
- Non-personal data inferred from an IP address or other technical identifier, such as non-precise geo-location data, which may include inferred longitude/latitude.
- Device-related data such as phone-type, browser, operating system, connection type.
Online Behavioral Information We collect information about your online browsing activity to determine what types of activities and products you may be interested in. This includes:
- Websites and content viewed
- Mobile applications used
- Dates and times of visits to partner websites
- Engagement with advertisements (e.g. views, clicks, whether a full video was viewed).
Client and Partner IDs Our clients and business partners sometimes create technical identifiers for their own purposes. We may use information from different sources to associate these identifiers with additional information.
Location Information We may collect and process information about your general location. The information we collect may tell us which country, city or zip code you are in, but it does not tell us your precise location.
De-Identified Information Kargo may use de-identified information to support our interest-based advertising activities. We do not retain any personal information connected with the de-identified information.
You do not have to provide any personal information to Kargo, and if you previously consented to providing the data, you can manage your data choices as set out in Section 8 below.
If you do not consent to or opt-out of providing personal data, you will still see advertising on webpages you visit. Without the use of your data, any advertising delivered on our Services may be less relevant to your interests.
(b) Kargo Commerce
As noted above, for Kargo Commerce Services, in general we act as a data processor or service provider only. However, in providing those Services, we may process the following types of personal data relating to relating to their current or potential customers of our customer:
- postal address,
- postal codes,
- product data,
- loyalty data,
- IP addresses,
- pricing and promotional data.
Often this data is provided in hashed or encrypted form so that we cannot identify or contact any particular individual.
(c) General Business Contacts
The personal data of our business contacts that is processed by us is mainly obtained directly from you. Provision of such personal data is necessary to use and purchase our Services, to fulfil requests for information relating to our Services, to organize communication in relation to our business events, and to purchase and pay for goods and services.
The main categories of personal data of our business contacts collected by the Company are:
- phone number,
- e-mail address,
- experience and responsibilities;
- usage data generated by our Services;
- device-related information from cookies or similar technologies;
- any other information provided by you e.g. via correspondence, chat, telephone, or web forms;
- personal data generated from your use of any third-party services and applications which are used in connection with the Services;
- complementary data from private and public sources such as websites and trade directories.
4. How We Collect Information
You can find out more information about cookies at https://www.allaboutcookies.org/
In addition to cookies, we use local web storage on the browser that is used to access our publisher partners’ websites. Local storage, like cookies, is contained on the browser you are using when you see a Kargo advertisement on our publisher partners’ websites. Like cookies, the browser or window type (e.g., private browsing) you utilize on your device may restrict the data that can be stored and the length of time it persists.
Within Kargo Commerce, any personal data that we handle is provided to us by our customers.
5. How We Use the Information We Collect
(a) Online Advertising Related Services
We may use the information we collect to:
- deliver or enable our advertising partners to deliver personalized messages that match your interests, including interest-based advertisements;
- understand the interests of our publisher partners’ users;
- customize user experiences when they use our advertising partners’ services;
- generate and analyze reports and statistics about the performance of advertising campaigns, and improve performance over time, for our business partners and for our own use;
- fulfill the purposes described to you at the point of collection or in accordance with your consent.
We may combine or aggregate any of the information we collect through our Services for any of these purposes.
(b) General Business Contacts
We process personal data to manage and promote the Services, including to provide demonstrations, to contact and market our Services to participants at our business events, and to contact and send marketing material to the visitors of our websites who submit us their information in a form or otherwise request marketing or other information from us.
For this purpose, personal data may be processed for market and customer analysis, reporting and statistical purposes, customized marketing, service notices, database management and maintenance, product suggestions and offers, interaction with external social networks, access to third-party services’ accounts and platforms, heat mapping and newsletters. personal data may be used for direct marketing, including, where applicable, by electronic means. The Company provides an easy way to cancel marketing communications, including within each email.
Further, personal data may be used for invoicing and to send important information; this may include but not be limited to changes of applicable fees, price lists and conditions, or to contact you and provide information customized Services according to your interests.
We also process personal data of staff of our suppliers (or potential suppliers) from whom we obtain goods and services, for the purposes of evaluating their supplies, managing our contracts with them, and paying their invoices.
6 Information of EU Area Users
If you are located in the European Union, European Economic Area, Switzerland or the UK (referred to in this policy as the “EU area”), and your information is subject to applicable EU area laws. Kargo’s legal basis for processing your personal data depends upon the specific context in which we collect or use it. For EU area users, Kargo uses the IAB Europe Transparency and Consent Framework (TCF) as one mechanism for establishing our legal basis. The TCF is designed to allow a publisher to present information and choices to users about third-party vendors, like Kargo, that process data based on you accessing the publisher’s content. The TCF will display information about the purposes for which Kargo processes data and allow you to make choices with respect to those purposes. You can change your preferences at any time as set out in Section 8 below.
(b) Kargo Commerce
Within Kargo Commerce, the relevant data controller or business will be responsible for deciding the appropriate legal basis and providing relevant information to you. On behalf of a data controller or business who is our customer, we may ask for:
- your consent for the processing of certain personal data (for example for a campaign). When collecting such consents, we will inform you of the purposes of the processing, in accordance with the data controller’s instructions, and such processing is carried out only when appropriate consent is received; or
- certain permissions allowing us to perform actions with your social media accounts and to retrieve information, including personal data, from them. This allows our Services to connect with your account on the social network. In the case of Facebook, the following permissions may be asked: About Me, Access Rights (including but not limited to Ad Account Access, Business Manager Access), App Notifications, Contact Email, Manage Advertisements, and Manage Pages. For more information about social network permissions, please refer to the relevant permissions documentation and Data Policy (in the case of Facebook/Meta: https://www.facebook.com/about/privacy/update).
(c) General Business Contacts
If you are one of our business contacts, our legal bases for processing your personal data are that they are necessary:
- for the performance of the contract between us and you (if our customer or supplier is an individual);
- for the purposes of our legitimate interests in operating, promoting and managing our business. This personal data always relates to your business life, is within the expectations of professionals, and is kept securely, and so we have concluded that such interests are compatible with your rights and interests;
- to comply with legal obligations applicable to us, such as recordkeeping, tax, and accounting.
7. How We Share the Information We Collect
We may share information we collect in connection with the provision of our Services for purposes that include but are not limited to the following:
- with our customers for campaign management, insights, and reporting;
- with our advertising partners and technical service providers to enable our advertising partners to deliver personalized messages that match your interests, including interest-based advertisements. These include:
- providers of IT-related services (e.g. data storage, hosting, management, system monitoring and security; code development and error tracking, or maintenance)
- advertising creative services (e.g. Image and video processing)
- data analytics providers (e.g. measuring which advertisements receive the most views, clicks or sales, or categorizing data into interest groups, or through heat maps)
- advertising technology companies (e.g. data management platforms, demand side platforms, or ad-servers);
- with providers of business support services, such as customer relations or email management services, event or webinar providers, supplier management, payment or invoicing services, or audit, tax or legal service providers;
- with our affiliates, representatives and advisors around the world who are involved in the provision of the Services and performing and enforcing our contracts and terms of service;
- with our business partners, such as web publishers, advertisers or advertising agencies, for the purposes described in this Policy;
- as required by law, such as to comply with a subpoena or other legal, regulatory or law enforcement process, or to comply with government reporting obligations;
- with affiliates, service providers, advisors, and other third parties to the extent reasonably necessary to proceed with the negotiation or completion of a merger, acquisition, or sale of all or a portion of our assets.
For users in the EU area, your information will be stored in the United States, the UK, the EU and/or any other country where our partners, processors or subprocessors maintain facilities, and our affiliates and technical service providers outside the EU area may have access to information in order to assist us in providing our Services. In each case, we have in place safeguards that enable these transfers to happen in a way that ensures that the information is handled in accordance with our instructions and using similar standards to those applicable in the EU area. These safeguards may include standard contractual clauses for data exports as approved by the European Commission or other supervisory authorities. A copy of these documents may be made available if we receive a valid request.
8. Your Choices About the Information We Collect
You are able to exercise control over the use of information collected by Kargo to serve you interest-based advertisements. These tools are browser-specific, so you should repeat this process for each browser that you use.
You may opt out of or withdraw your consent for our use of information collected for interest-based advertising purposes by using one of the “opt out” procedures described below:
CLICK TO OPT OUT.
Even if you opt out, you will still see advertising on the web pages you visit. However, such advertising may be less relevant to your interests.
You also may opt out of or withdraw your consent for our use of information collected for interest-based advertising purposes on mobile websites and have an opt-out cookie placed on your device if your device accepts such cookies by visiting either one of the following industry-developed sites and selecting Kargo:
- Digital Advertising Alliance Consumer Choice Page: www.aboutads.info/choices.
- Network Advertising Initiative Consumer Choice Page: www.networkadvertising.org/choices.
App Opt-Out: You may select a system level advertising preference feature on your device and Kargo will honor this preference to opt out your device from interest-based advertising in apps. On Apple iOS devices, this system level advertising preference may be accessed via Settings – Privacy – Advertising – Limit Ad Tracking. On Android devices, open the Google Settings app from your app drawer or from your operating system’s settings menu, tap Ads, and select “Opt-out of Interest-based ads.”
9. US State Laws
Consumers who are resident in US states such as California, Colorado, Virginia, Connecticut, or Utah (and others, as new laws are introduced) may have additional rights under state privacy legislation which defines personal information more broadly, ensures greater transparency and accountability and provides consumers with extended rights as to the collection and use of their personal information.
Your rights under US State Privacy Laws:
If you are resident in one of the states where specific privacy legislation is in effect then, depending on the particular provisions of applicable local laws, you may have some or all of the following rights:
- Right to correction: Consumers have the right to request a business that possesses inaccurate personal information about them to correct such inaccurate personal information, taking into the account the nature of the personal information and the purposes of the processing of the personal information.
- Right to notice: Businesses must inform consumers at or before the point of collection what categories of personal information will be collected and the GDPRpurposes for which these categories will be used. We do this through this Policy.
- Right to confirmation and access: Consumers have the right to request that a business confirm whether or not the business is processing the consumers’ personal data and provide to them: the categories of personal information collected; the categories of sources from which personal information is collected; the business or commercial purpose; the categories of third parties with which the business shares personal information; and the specific pieces of personal information the business holds about a consumer. If a business sells personal information or discloses it for business purposes, consumers have the right to request the categories of information so sold or disclosed.
- Right to a copy: Consumers may ask for personal information that they previously provided to an organization to be provided in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another organization.
- Right to opt out: Consumers have the right to direct businesses that sell or share personal information about them to third parties to stop such sales or sharing, known as the right to opt out. In some states this right extends to a right to opt out of data processing for targeted advertising and/or profiling for significant purposes. If a consumer is a minor, this becomes a right to opt in to the sale or sharing of data (exercised by the minor if the consumer is between 13 and 16 years of age, or by the minor’s parent or guardian if the consumer is under 13 years old). Businesses must wait at least 12 months before asking consumers to opt back in.
- Right to request deletion: Consumers also have the right to request deletion of personal information, but only where that information was collected from the consumer. Like the right to erasure under the GDPR, this right is subject to exceptions. For instance, businesses need not delete personal information necessary for detecting security incidents, exercising free speech, protecting or defending against legal claims, or for internal uses reasonably aligned with the consumer’s expectations.
- Right to limit use of sensitive information; Consumers have the right to restrict a business’s use of sensitive personal information e.g. to use that is necessary to provide goods or services requested, to certain business purposes, or other legally permitted purposes.
- Right to equal services and prices: Businesses must not discriminate against consumers by denying goods or services, charging a different price or rate for goods or services, providing a different level or quality of goods or services, or suggesting that they will do any of these things based upon a consumer’s exercise of any of their legal rights relating to their personal information.
Exercising your rights under US state laws:
If you want to make a request for exercise of any of the above rights, you (or your authorized agent) can write to privacyinfo [at] kargo.com and we will respond within 45 days as required by applicable laws.
If you make such a request, including through an authorized agent, we reserve the right to verify your identity and the agent’s authorization.
However, we may not be able to respond to your request if it is not permitted or foreseen under applicable law.
We transfer personal information collected through our network of partners to third parties and as such are considered as having disclosed or sold or shared personal information (as defined in applicable California laws) over the past twelve months. Please see Section 10 below for more information).
10. Additional Information for California Consumers
10.1. Personal Information Collected in the past 12 months
|Category||Examples||Source||Business or Commercial Purpose||Categories of third parties disclosed to|
|Identifiers||Unique personal identifier, online identifier, Internet Protocol address (e.g. device and cookie IDs)||From partner websites and apps|
From third party data providers
From our clients
|Providing and improving our targeted advertising services which include creating and enriching profiles and audiences for our clients||– Our clients|
– Our data hosting and storage providers
– Our providers of advertising technology and services such as demand side providers, data management platforms, and ad networks
– Our data processing service providers (for purposes such as analytics, database management, customer support)
– Our other group companies
|Commercial information||Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies (e.g. sites visited, apps used, searches, views, clicks, and purchases)||As above||As above||As above|
|Internet or other electronic network activity information||Information regarding your interaction with websites and applications (e.g. sites visited, apps used, searches, views, clicks, and purchases)||As above||As above||As above|
|Geolocation Data||Approximate location from information provided by your device (e.g. IP address)||As above||As above||As above|
|Inferences||Inferences drawn from any of the information above to create a profile||As above||As above||As above|
|Sensitive personal information||Personal information revealing a consumer’s racial or ethnic origin; information concerning a consumer’s health||As above||As above||As above|
|Professional or employment-related information||Contact information used for managing and transacting with business contacts||From individuals directly, e.g. via correspondence, chat, telephone, or web forms.|
From events and online and offline networking.
From private and public sources such as websites and trade directories.
|Promoting and managing our business||Our data processing service providers (for purposes such as analytics, database management, email management, customer support)|
Our other group companies
*“Personal Information” does not include publicly available information, including information that we have a reasonable basis to believe is lawfully made available to the general public by you; from widely distributed media; or by a person to whom you have disclosed it and not restricted the information to a specific audience.
10.2. Personal Information Sold or Shared in the past 12 months
We have sold and/or shared the following categories of Personal information in the past 12 months: (a) Identifiers; (b) Commercial information; (c) Internet or other electronic network activity information; (d) Geolocation Data; (e) Inferences; and (f) Sensitive Personal Data.
Such information is contained in audiences or profiles that we provide to our clients.
10.3. Personal Information disclosed for a business purpose in the past 12 months
We have disclosed the following categories of Personal Information for a business purpose in the past 12 months: (a) Identifiers; (b) Commercial information; (c) Internet or other electronic network activity information; (d) Geolocation Data; (e) Inferences; and (f) Sensitive Personal Data.
These business purposes comprise:
- Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
- Helping to ensure security and integrity.
- Debugging to identify and repair errors that impair existing intended functionality.
- Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf.
- Undertaking internal research for technological development and demonstration.
Undertaking activities to verify or maintain the quality or safety of our Services, and to improve, upgrade, or enhance our Services.
11. Your EU Area Rights
If you are an EU area user and your information is subject to applicable EU area laws, you have additional rights in relation to information that we process about you. These rights include:
- to ask for access to the data
- to ask for errors in the data to be corrected
- to ask for the data to be erased (the “right to be forgotten”)
- if not erased, then to ask us to restrict processing of the data
- to object to its processing for specific purposes
- to ask for a copy of the data to take to another service provider (“data portability”)
Where we process any information based on consent that you have previously given, you are permitted to withdraw your consent at any time (though the processing that took place before withdrawal will still be legal). You may withdraw consent by (1) managing online choices as set out above; or (2) visiting the websites where you have previously indicated your consent.
As indicated above, Kargo does not process contact or ID information such as names or emails. Therefore, unless you provide us with a relevant technical ID from your device, while we will always investigate any request thoroughly, it may be impossible for us to know whether or not we are processing any information relating to you. In these cases, we normally take the approach that it is more protective for you to use the systems referred to above that enable you to directly manage your online choices and cookie settings, and not to ask you for (and then to process) additional information about you in order to investigate such a request.
We are always available through the contacts in Section 15 below to help resolve any issues or questions in relation to processing of your information. If you believe that your rights have not been respected then you are also entitled to make a complaint to the Supervisory Authority or Personal Data Protection Authority in your country to ask them for a resolution.
12. Users Under 16 Years Old
Kargo does not knowingly collect personal information from users under 16 years old. If you become aware that Kargo may have collected information from a user under 16 through the Services, please contact us (see Section 15) and we will take steps to delete such information.
We strive to maintain reasonable administrative, technical, and physical safeguards designed to safeguard the information we collect from unauthorized access, corruption or loss. In general, information is kept in pseudonymous form (i.e. you cannot be personally identified from it without additional data) and we apply security measures such as password protection and Transport Layer Security technology (TLS).
14. Information Retention
We retain information collected for interest-based advertising purposes for up to eighteen months from the date of its collection, unless you reset your device or clear your cache or cookies as referred to above.
If we need to keep your information longer than eighteen months for reporting, accounting, regulatory or legal reasons, then we will retain it only for as long as necessary under the applicable laws, policies or agreement and will use the information only for the purpose for which it was retained.
We retain personal data of business contacts for 3 years from your latest purchase or contact with us. Personal data may be, wholly or in part, retained for a longer or shorter-term if required by applicable law or if there is another justified reason to retain or delete them (e.g. for recordkeeping purposes or in line with limitation periods for legal actions). In those cases, your personal data will be erased without delay after there is no longer any need for such retention.
15. Request for Information Disclosures
Reporting period Jan. 1 2020 – Dec. 31 2020
From Jan. 1 2020 – Dec. 31 2020, Kargo Global Inc. received a total of four (4) requests via the contact information listed in section 15. These requests can be categorized as deletion requests or information requests. Two (2) requests can be categorized as deletion. Two (2) requests can be categorized as information. While no specific requests were made to opt out via direct contact, Kargo provides an opt out link on this page and via the NAI as mentioned in section 1. In the cases of all requests in 2020, we issued a response to the data subject within an average of 6 days (median of 5 days). A member of the team responded to these requests either in the context of requesting more information to verify the identity of the data subject, or providing the data subject a link to an online portal where they could view additional information within their browsers which may be utilized by Kargo technologies. In all cases of the requests in 2020, Kargo did not receive a further reply after our initial response from the data subject.
16. Changes to This Policy
We may update this Policy from time to time to address changes in the Services, changes in the laws or regulations, or for other reasons. If we update this Policy, we will notify you by posting a new Policy on this page. If we make a change that materially affects the way in which we use or share the information previously collected from you through our Services, we will not apply that change to information collected prior to the date of the change.
17. Contact Us
If you have any questions about this Policy or our use of your information, please contact us by email at firstname.lastname@example.org, or by mail at Kargo Global, Inc., 826 Broadway, 4th Floor, New York, NY 10003, Attn: Legal. We welcome your questions and feedback.
Our representative in the EEA is Kargo Media Ireland Limited, of ArcLabs Research and Innovation Centre, Carriganore, Co. Waterford, Ireland.
This Policy was last updated on July 27, 2023