Privacy Policy

1. Introduction

Welcome to BidWave. This Privacy Policy explains how BidWave ("Company", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use our demand-side platform ("Platform"), website at bidwave.net ("Website"), and related services (collectively, the "Services").

BidWave operates as a Demand-Side Platform (DSP) specialising in outcome-focused programmatic advertising, including cost-per-click (CPC), cost-per-install (CPI), and cost-per-action (CPA) campaigns. We are committed to protecting the privacy and personal data of our clients, their end users, and visitors to our Website.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our Services.

2. Who We Are

BidWave is a programmatic advertising technology company. For the purposes of applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) ("GDPR"), BidWave acts as:

• A data controller with respect to personal data collected directly from clients, website visitors, and Platform users;
• A data processor (or joint controller, where applicable) with respect to personal data processed on behalf of our advertising clients and supply-side platform (SSP) partners in the course of delivering programmatic advertising services.

Contact: privacy@bidwave.net

Website: https://bidwave.net

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Data Provided Directly by Clients

• Name, email address, phone number, and business contact details of authorised representatives;
• Company name, registered address, VAT/tax identification numbers;
• Billing and payment information;
• Account credentials and authentication data;
• Correspondence and communications with our team.

3.2 Data Collected Through the Platform (Programmatic Advertising)

• Device identifiers, including advertising IDs (IDFA, GAID), device type, operating system, and browser type;
• IP addresses (which may be truncated or hashed for privacy);
• Bid request data received via OpenRTB 2.6 protocol from SSP partners, which may include app or website information, geo-location data (country, region, city), language, and connection type;
• Ad interaction data: impressions served, clicks, installs, conversions, and other campaign performance events;
• Cookie identifiers and similar tracking technologies (where applicable);
• Contextual signals such as app category, content classification, and publisher information.

3.3 Data Collected via Our Website

• Navigational and usage data, including pages viewed, time spent, referral source, and browser/device information;
• Data submitted through contact forms, registration forms, or other Website features;
• Cookies and similar technologies (see Section 8 below).

4. How and Why We Use Your Data

We process personal data for the following purposes:

4.1 To Provide Our Services

• Operating and maintaining the Platform, including bid management, campaign optimisation, audience targeting, and real-time bidding;
• Delivering, measuring, and reporting on advertising campaigns for our clients;
• Processing payments and managing client accounts;
• Communicating with clients regarding their accounts, campaigns, and technical support.

4.2 To Improve Our Services

• Analysing Platform performance, campaign efficacy, and system reliability;
• Developing new features, products, and technologies;
• Conducting internal research and analytics.

4.3 To Comply with Legal Obligations

• Meeting regulatory, tax, and accounting requirements;
• Responding to lawful requests from public authorities and law enforcement;
• Enforcing our Terms & Conditions and protecting our legal rights.

4.4 To Protect Legitimate Interests

• Detecting and preventing fraud, invalid traffic, and advertising abuse;
• Ensuring the security and integrity of our Platform and systems;
• Managing business operations and corporate governance.

5. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract Performance (Article 6(1)(b)): Processing necessary for the performance of our contractual obligations to clients and partners;
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, including fraud prevention, Platform improvement, and analytics, provided such interests are not overridden by the data subject's rights and freedoms;
• Legal Obligation (Article 6(1)(c)): Processing necessary for compliance with applicable laws and regulations;
• Consent (Article 6(1)(a)): Where required, such as for certain cookie-based tracking or direct marketing communications. Consent may be withdrawn at any time.

6. Data Sharing and Disclosure

We may share personal data with the following categories of recipients:

• SSP Partners: We exchange bid request and response data with supply-side platforms as part of the programmatic advertising ecosystem via the OpenRTB 2.6 protocol;
• Advertising Clients: Campaign performance data, including aggregated and anonymised reports, are shared with our advertising clients;
• Service Providers: Third-party vendors who assist us with hosting, analytics, payment processing, fraud detection, and other operational functions, under appropriate data processing agreements;
• Legal and Regulatory: When required by law, court order, or governmental request, or to protect the rights, safety, or property of BidWave, our clients, or the public;
• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of such transaction, subject to standard confidentiality obligations.

We do not sell personal data to third parties. We do not share personal data with third parties for their own direct marketing purposes without explicit consent.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Client account data: Retained for the duration of the contractual relationship and for a period of up to 5 years thereafter, as required for legal, tax, and accounting purposes;
• Bid request and campaign performance data: Retained for a maximum of 13 months from the date of collection, unless a longer retention period is required for billing reconciliation or dispute resolution;
• Website analytics data: Retained for up to 26 months;
• Fraud detection data: Retained for up to 3 years to support ongoing fraud prevention efforts.

When personal data is no longer required, it is securely deleted or anonymised.

8. Cookies and Tracking Technologies

Our Website may use cookies and similar technologies to enhance your browsing experience, analyse usage, and support our services.

8.1 Types of Cookies

• Essential Cookies: Required for the basic functionality of the Website (e.g., authentication, security);
• Analytics Cookies: Used to understand how visitors interact with our Website, helping us improve user experience;
• Functional Cookies: Remember your preferences and settings.

8.2 Managing Cookies

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Website. Where required by applicable law, we will obtain your consent before placing non-essential cookies.

8.3 Programmatic Advertising Technologies

In the course of delivering advertising services, we may process device identifiers, advertising IDs, and similar identifiers received from SSP partners through bid requests. These are processed in accordance with industry standards and applicable data protection laws.

9. Your Rights

Under applicable data protection laws, including the GDPR, you may have the following rights:

• Right of Access: Request information about the personal data we hold about you;
• Right to Rectification: Request correction of inaccurate or incomplete personal data;
• Right to Erasure: Request deletion of your personal data, subject to applicable legal obligations;
• Right to Restriction: Request restriction of the processing of your personal data;
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format;
• Right to Object: Object to the processing of your personal data based on legitimate interests or direct marketing;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us at privacy@bidwave.net. We will respond to your request within the timeframes required by applicable law (typically within 30 days).

10. International Data Transfers

As a programmatic advertising platform operating globally, personal data may be transferred to, stored, or processed in countries other than your country of residence. Where such transfers occur, we implement appropriate safeguards to ensure an adequate level of data protection, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Data processing agreements with all partners and service providers;
• Assessments of the data protection landscape in recipient countries.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit (TLS/SSL) and at rest;
• Access controls and authentication mechanisms;
• Regular security assessments and monitoring;
• Employee training on data protection and information security.

While we strive to protect personal data, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

12. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such data promptly. If you believe we may have collected data from a child, please contact us at privacy@bidwave.net.

13. Third-Party Links

Our Website or Services may contain links to third-party websites or services. We are not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by updating the effective date at the top of this policy and, where appropriate, by email or through a notice on our Website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Email: privacy@bidwave.net

Website: https://bidwave.net

General Enquiries: hello@bidwave.net