Trust Framework

GDPR Privacy Notice

Last updated: July 16, 2026

This notice explains how eFind Processes Personal Information about people in the European Economic Area, the United Kingdom, and Switzerland, and it sets out the rights those individuals have under the GDPR and the UK GDPR. It builds on our Privacy Policy and gives the additional detail that European and United Kingdom law requires.

Purpose

eFind is committed to Processing Personal Information lawfully, fairly, and transparently. The GDPR and the UK GDPR give individuals in Europe and the United Kingdom specific protections and rights, and they require Controllers to explain, in clear terms, who is responsible for their data, why it is used, what the lawful basis is, and how a person can exercise control over it. This notice does that. It is written to be read alongside our Privacy Policy, which describes our data practices generally. Where this notice gives you more detail or a stronger protection than the Privacy Policy, this notice governs for the individuals and Processing it covers.

Nothing in this notice reduces any right that Applicable Law grants you. If a provision of this notice is ever inconsistent with a mandatory requirement of the GDPR or the UK GDPR, that requirement prevails, and the rest of this notice continues to apply.

Scope

This notice applies to Personal Information that eFind Processes about individuals who are located in the European Economic Area (the EEA), the United Kingdom, or Switzerland, in the following situations:

• when we Process Personal Information as a Controller, meaning we decide why and how it is Processed, such as when we operate our own websites, run our own marketing, manage Advertiser and Publisher Accounts, and measure and improve the Services;
• when we Process Personal Information as a Processor on behalf of an Advertiser, Publisher, or other business customer who is the Controller, which is governed primarily by our Data Processing Addendum; and
• when the GDPR or the UK GDPR applies to our Processing because we offer Services to individuals in those regions or monitor their behavior in connection with the Services.

Where we Process the Personal Information of individuals in Switzerland, we apply the protections in this notice together with the requirements of the Swiss Federal Act on Data Protection, and references in this notice to the GDPR should be read to include the Swiss regime where the context requires. References to the GDPR also include the UK GDPR and the United Kingdom Data Protection Act 2018 unless we say otherwise.

Who It Applies To

This notice is written for Data Subjects in the EEA, the United Kingdom, and Switzerland whose Personal Information eFind Processes. That includes Users who see or interact with Advertisements or visit a Publisher Property, individuals who represent an Advertiser, Publisher, or other business customer, Authorized Users of an Account, prospective customers, visitors to our own websites, and people who contact our support or sales teams. It applies whether you interact with us directly or your Personal Information reaches us through an Advertiser, a Publisher, or another participant in the advertising ecosystem.

If you are an Advertiser, Publisher, or other business customer using the Services to Process Personal Information about your own customers or users, you are typically the Controller for that data and eFind is your Processor. In that case, this notice describes eFind's practices, and the terms of the Data Processing Addendum govern the relationship between us.

Definitions

Capitalized terms used in this document, such as Advertiser, Campaign, Controller, Processor, Personal Information, Sensitive Personal Information, and International Transfer, have the meanings given in the Master Definitions. In this notice, "Data Subject Rights" means the rights described in the section titled Your Rights, "special-category data" means the categories of Personal Information listed in Article 9 of the GDPR, and "supervisory authority" means a data-protection regulator with authority over Processing to which the GDPR or the UK GDPR applies.

How This Notice Supplements the Privacy Policy

Our Privacy Policy is the primary description of the Personal Information we collect, the sources it comes from, how we use and share it, and the choices available to you. This GDPR Privacy Notice does not repeat all of that. Instead, it adds the specific information that the GDPR and the UK GDPR require for individuals in Europe and the United Kingdom, including the identity of the Controller, the lawful bases we rely on, the safeguards we use for International Transfers, and the enhanced rights available to you. Read the two documents together. Where a topic is covered in both, the more protective statement applies to the individuals covered by this notice.

Who Is Responsible for Your Personal Information

eFind as Controller

For most Processing described in this notice, eFind is the Controller. That means eFind decides why your Personal Information is Processed and how it is Processed. The Controller is:

eFind is a Controller when, for example, we operate and secure the Services, manage relationships with Advertisers and Publishers, decide how to measure and improve advertising performance across the platform, protect against Fraud and Invalid Traffic, run our own websites and marketing, and comply with our own legal obligations. In these situations, we are the party that determines the purposes and means of the Processing, and the rights described below can be exercised against us directly.

eFind as Processor

In some situations, eFind acts as a Processor rather than a Controller. This happens when an Advertiser, Publisher, or other business customer uses the Services to Process Personal Information for its own purposes and instructs eFind to Process that Personal Information on its behalf. For example, when an Advertiser uploads a customer list to build an audience, or configures Conversion Tracking that sends its own users' data to us for measurement, the Advertiser is generally the Controller and eFind is the Processor acting on the Advertiser's documented instructions.

When we act as a Processor, our obligations, and the division of responsibility between us and the Controller, are set out in the Data Processing Addendum. If you are an individual whose Personal Information eFind Processes only as a Processor, and you wish to exercise a right such as access or erasure, we will generally direct you to the Controller who instructs us, because the Controller is responsible for responding to you. We will still assist that Controller in meeting its obligations, as the Data Processing Addendum requires.

Categories of Personal Information We Process and Why

The categories of Personal Information we Process, and the purposes for which we Process them, depend on how you interact with the Services. The table below summarizes the main categories and purposes for Processing where eFind is the Controller. Our Privacy Policy describes the full detail, including the sources of each category and the parties with whom we share it.

We do not seek to collect special-category data through the ordinary operation of the Advertising Services, and we design our advertising products to avoid Processing Sensitive Personal Information for targeting. Where any special-category data reaches us, we handle it under the additional conditions described below.

Our Lawful Bases for Processing

Under Article 6 of the GDPR, we may only Process your Personal Information where we have a lawful basis to do so. We rely on the following lawful bases, and we choose the one that fits each purpose. For any given Processing activity, more than one basis may apply, but we will not rely on a basis that is not appropriate for the purpose.

Consent

We rely on Consent where the law requires it or where Consent is the most appropriate basis, for example for certain Cookies and similar technologies, for some direct marketing, and for the Processing of special-category data where no other condition applies. When we rely on Consent, we ask for it in a way that is freely given, specific, informed, and unambiguous, and we keep a record of it. Consent given for one purpose does not extend to a different purpose. Where we obtain Consent for Cookies and similar technologies, our Cookie Policy explains how that works and how to change your choices.

Performance of a Contract

We rely on the performance of a contract where Processing is necessary to provide the Services you or your organization have asked for, or to take steps at your request before entering into a contract. For example, we Process Account and Payment data to open and operate an Account, to run the Campaigns you configure, and to invoice and collect amounts due. Where Processing is necessary to deliver a Service you have chosen, this is generally the basis we rely on.

Compliance with a Legal Obligation

We rely on compliance with a legal obligation where Processing is required to meet a duty imposed on us by Applicable Law, such as keeping financial and tax records, responding to lawful requests from authorities, meeting anti-fraud and anti-money-laundering requirements, and honoring valid Data Subject Rights requests. In these cases we Process only what the obligation requires.

Legitimate Interests

We rely on legitimate interests where Processing is necessary for interests pursued by us or by a third party, provided those interests are not overridden by your interests or your fundamental rights and freedoms. We use legitimate interests for purposes such as securing and improving the Services, measuring and analyzing advertising performance at the platform level, detecting and preventing Fraud and Invalid Traffic, managing our business relationships, and carrying out limited marketing to business contacts.

Before relying on legitimate interests, we carry out a balancing test. In that test we identify the specific interest we are pursuing, confirm that the Processing is necessary to achieve it and that no less intrusive means is reasonably available, and then weigh our interest against the impact on you, taking into account your reasonable expectations and any safeguards we apply, such as minimizing the data, limiting access, and giving you a clear way to object. We only proceed on this basis where our interest is not outweighed by your interests, rights, and freedoms. You can ask us for more information about a specific legitimate-interests assessment by contacting us at support@efind.com, and you have the right to object as described below.

Vital Interests and Public Interest

In rare cases, we may Process Personal Information to protect the vital interests of an individual, such as in a genuine emergency, or where Processing is necessary for a task carried out in the public interest as recognized by Applicable Law. We do not use these bases for ordinary advertising or business purposes.

Processing of Sensitive and Special-Category Data

Special-category data receives extra protection under Article 9 of the GDPR. This includes Personal Information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, as well as genetic data, biometric data used to identify a person, data concerning health, and data concerning a person's sex life or sexual orientation. Related rules apply to data about criminal convictions and offenses.

We design the Advertising Services to avoid Processing special-category data for targeting, and we prohibit Advertisers and Publishers from using the Services to build audiences based on sensitive characteristics, as set out in our Advertising Policies. Where we do Process special-category data, for example if it is contained in a message you send our support team, we do so only where a condition in Article 9 applies. The conditions we rely on most often are your explicit Consent, the establishment, exercise, or defense of legal claims, and reasons of substantial public interest recognized by Applicable Law. We apply additional safeguards to this data, including access controls and minimization, and we retain it only as long as the relevant condition and purpose require.

How to Withdraw Consent

Where we rely on Consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawing Consent does not affect the lawfulness of Processing we carried out before you withdrew it, and it does not affect Processing that we carry out on a different lawful basis. To withdraw Consent, you can use the controls we provide in the relevant part of the Services, adjust your Cookie choices as described in the Cookie Policy, follow the unsubscribe instructions in a marketing message, or contact us at support@efind.com. After you withdraw Consent, we will stop the Processing that depended on it, unless we are required or permitted to continue on another basis.

Your Rights

If the GDPR or the UK GDPR applies to the Processing of your Personal Information, you have the rights described below. These rights are not absolute, and in some cases we may lawfully decline or limit a request, for example where an exemption applies or where honoring the request would adversely affect the rights of others. Where we cannot fully honor a request, we will explain why, to the extent the law allows.

Right of Access

You have the right to ask whether we Process Personal Information about you and, if we do, to receive a copy of it along with information about how and why we Process it. We will provide this in a commonly used electronic form unless you ask otherwise.

Right to Rectification

You have the right to ask us to correct Personal Information about you that is inaccurate and to complete Personal Information that is incomplete.

Right to Erasure

You have the right to ask us to delete your Personal Information in certain circumstances, for example where it is no longer necessary for the purpose we collected it, where you withdraw Consent and there is no other basis, or where you object and there is no overriding legitimate ground. This right does not apply where we are required to keep the data, for example to comply with a legal obligation or to establish, exercise, or defend legal claims.

Right to Restriction

You have the right to ask us to restrict our Processing of your Personal Information in certain circumstances, for example while we verify the accuracy of data you have contested or while we consider an objection you have raised. When Processing is restricted, we store the data but do not otherwise use it, except as the law permits.

Right to Data Portability

Where we Process your Personal Information based on Consent or on a contract and by automated means, you have the right to receive the Personal Information you provided to us in a structured, commonly used, machine-readable format, and to ask us to transmit it to another Controller where this is technically feasible.

Right to Object

You have the right to object to Processing that we base on legitimate interests, on grounds relating to your particular situation. If you object, we will stop the Processing unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or that we need the data to establish, exercise, or defend legal claims. Where we Process Personal Information for direct marketing, you have an absolute right to object, and if you object we will stop Processing your Personal Information for that purpose.

Rights Regarding Automated Decision-Making and Profiling

You have the right not to be subject to a decision based solely on automated Processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, except where the law permits it, such as where the decision is necessary for a contract, is authorized by law with suitable safeguards, or is based on your explicit Consent. Where such automated decision-making occurs, you have the right to obtain human intervention, to express your point of view, and to contest the decision. The section below explains how we approach automated decision-making and profiling in advertising.

How to Exercise Your Rights

To exercise any of these rights, contact us at support@efind.com or by phone at 1-214-444-8126, or use any request tool we provide in the Services. To protect your Personal Information, we may need to verify your identity before we act, and we may ask for information that helps us locate the relevant data. We will respond within the time the law requires, which is generally one month, and we may extend that period where the law allows for complex or numerous requests, in which case we will tell you. We do not charge a fee for handling a request unless the law permits it, for example where a request is manifestly unfounded or excessive. If we act only as a Processor for the Personal Information your request concerns, we will forward your request to the responsible Controller and assist that Controller as required.

Automated Decision-Making, Profiling, and AI

Advertising involves automated Processing. Our systems decide, in real time and at scale, which Advertisements to request, which Bid to submit, and which Placement to fill, and they use signals about Devices, context, and interaction to do so. Some of this Processing is a form of profiling, because it analyzes data to predict interests or the likelihood of an outcome such as a Click or a Conversion. We also use AI-Assisted Advertising features, such as automated bidding and audience modeling, and we expect our use of artificial intelligence in the Services to grow over time.

We approach this Processing responsibly. We do not use automated decision-making that produces legal effects concerning you, or similarly significantly affects you, based solely on automated Processing, unless a lawful condition applies and appropriate safeguards are in place. We build our advertising systems to avoid using special-category data for targeting, and our Advertising Policies prohibit Advertisers from targeting individuals based on sensitive characteristics or in ways that could enable unlawful discrimination. Where automated Processing meaningfully affects you, we provide a route to human review, we let you express your view, and we let you contest the outcome.

As we develop future AI Processing, including generative and predictive features described in our AI Content Policy, we apply the same principles. We assess new uses of AI for their impact on individuals before we deploy them, we keep humans accountable for significant decisions, we test for fairness and try to reduce unfair bias, and we document how our systems use Personal Information. We will update this notice as our AI Processing evolves so that you continue to understand how it affects you.

Data Retention

We keep Personal Information only for as long as we need it for the purposes described in this notice and our Privacy Policy, and then we delete it or de-identify it. How long we keep a given category depends on why we hold it. We consider the purpose of the Processing and whether it is still active, our legal, tax, and accounting obligations, the need to keep records to resolve disputes or enforce our agreements, the need to detect and prevent Fraud and Invalid Traffic, and any request you make to delete your data.

As a general approach, we keep Account and contract data for the life of the relationship and for a limited period afterward, we keep financial and Billing records for the period tax and accounting law requires, we keep advertising and interaction data for shorter periods appropriate to measurement and security, and we keep support communications for as long as needed to handle your matter and any follow-up. Where we no longer need Personal Information but cannot delete it immediately, for example because it is held in a backup, we isolate it and protect it until deletion occurs. Aggregated Data and de-identified data, which no longer identify you, may be kept for longer.

International Transfers

eFind is based in the United States, and we and our Sub-processors may Process Personal Information in the United States and in other countries outside the EEA, the United Kingdom, and Switzerland. Some of these countries have not received an adequacy determination, meaning they are not recognized as providing a level of data protection equivalent to that of the EEA or the United Kingdom. When we transfer Personal Information out of these regions, we use a lawful transfer mechanism and appropriate safeguards.

The safeguards we rely on include the following:

• Adequacy decisions. Where the European Commission or the United Kingdom has decided that a country, territory, or framework provides an adequate level of protection, we may transfer Personal Information on the basis of that decision.
• Standard Contractual Clauses. Where no adequacy decision applies, we put in place the Standard Contractual Clauses approved by the European Commission, which impose contractual data-protection obligations on the parties to the transfer.
• UK Addendum. For transfers subject to the UK GDPR, we use the United Kingdom International Data Transfer Addendum to the Standard Contractual Clauses, or the United Kingdom International Data Transfer Agreement, as appropriate.
• Swiss transfers. For transfers subject to Swiss law, we apply the Standard Contractual Clauses with the adjustments the Swiss Federal Data Protection and Information Commissioner recognizes.

In addition to these mechanisms, we assess the circumstances of a transfer and apply supplementary technical, organizational, and contractual measures where they are needed to protect the data, consistent with our Security Policy. You can ask us for more information about the safeguards that apply to a specific transfer, and where the law allows we will provide a copy of the relevant mechanism, with confidential and commercial details removed. Our engagement of Sub-processors, including those located outside the EEA and the United Kingdom, is described in the Data Processing Addendum when we act as a Processor.

Cross-Border Processing

Because we operate globally, Personal Information we Process may move between eFind entities, service providers, and Sub-processors located in different countries in order to deliver, secure, support, and improve the Services. We treat this cross-border Processing consistently with this notice wherever it happens, we apply the transfer safeguards described above whenever data leaves the EEA, the United Kingdom, or Switzerland, and we require our Sub-processors to protect Personal Information to a standard no lower than the one we apply ourselves. The location of Processing does not change the rights available to you or our responsibilities toward you.

Your Right to Complain to a Supervisory Authority

We would like the chance to address any concern you have about how we Process your Personal Information, so we encourage you to contact us first at support@efind.com. You also have the right to lodge a complaint with a supervisory authority. In the EEA, you can complain to the data-protection authority in the member state where you live, where you work, or where you believe an infringement occurred. In the United Kingdom, you can complain to the Information Commissioner's Office. In Switzerland, you can contact the Federal Data Protection and Information Commissioner. Exercising this right does not affect any other legal remedy available to you, and it does not require you to contact us first.

Our EU and UK Representative and Data Protection Officer

Where the GDPR or the UK GDPR requires eFind to designate a representative in the European Union or the United Kingdom, we appoint one to act as a point of contact for individuals and supervisory authorities on matters relating to Processing that this notice covers. We also maintain a data-protection contact route that reaches the individuals responsible for privacy at eFind, including any Data Protection Officer we appoint. You can reach our privacy team, our Data Protection Officer where one is appointed, and our EU or UK representative through the following contact route:

Please mark your message for the attention of the privacy team and tell us whether you are contacting us in your capacity as an individual in the EEA, the United Kingdom, or Switzerland, so that we can route your request correctly. When we designate a specific EU or UK representative, we will publish the current contact details in our Privacy Policy or through the contact route above.

How We Communicate Changes

We may update this notice from time to time to reflect changes in our Processing, in the Services, or in Applicable Law. When we make a change, we update this notice, and where a change is significant we take additional steps to bring it to your attention, which may include a notice within the Services or a direct message where we have a way to reach you. If a change would require your Consent, we will ask for it before the change applies to Processing that depends on your Consent. We encourage you to review this notice periodically. Your continued use of the Services after an update takes effect indicates that you have had the opportunity to review the current version, and it does not waive any right the GDPR or the UK GDPR gives you.

Related Documents

• Privacy Policy
• California Privacy Notice
• Cookie Policy
• Data Processing Addendum
• Security Policy
• Master Definitions