Effective as of December 21, 2022
View archived Privacy Notice

NextRoll, Inc. (formerly AdRoll, Inc.) and its subsidiaries and affiliates (“we ” “our” or “us”) is an independent marketing technology company that offers intelligent, data-driven advertising and marketing services and solutions to help big and small companies accelerate their growth (“Services”).

We have prepared this Service Privacy Notice to describe the types of data we collect from you, and explain how, why and when we collect this data in order to provide our Services to our Customers. References to “Customer” in this Policy Notice refers to any business, brand, marketer and/or advertiser who uses NextRoll’s Services. This Service Privacy Notice also identifies what rights you have concerning the collection of this data, such as the right to opt-out of interest-based advertising (also commonly referred to as targeted or personalized advertising). If you have additional questions, you can visit our Trust Center or Contact Us.

Please note that this Privacy Notice does not apply to data we collect when you visit a NextRoll website, including https://www.nextroll.com/, www.adroll.com and https://www.rollworks.com/. To learn what data we collect when you visit our websites, please visit the NextRoll Website Privacy Notice.

Table of Contents

• About NextRoll's Services
• What Data we Collect
• How We Use the Data We Collect
• Data Sharing
• Aggregated and De-Identified Data
• Cookies and Related Technologies
• Non-Cookie Technology for Tracking Outside European Territories
• Your Choices and Opting-Out of Interest-Based Advertising and Analytics
• Data Retention
• Security
• International Transfers
• Information for European Territory Residents: Our Legal Basis and Your Rights
• Information For California Residents Only
• Information for Virginia, Connecticut, Colorado, and Utah Residents Only
• Information For Individuals Located in Brazil
• Changes to this Service Privacy Notice
• Contact Us About Questions

NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their businesses. Powered by machine learning and integrated data platforms, NextRoll’s intelligent, data-driven marketing and advertising services and solutions go beyond serving digital ads by providing companies better visibility into which audiences are most interested in certain products and services. By using NextRoll’s proprietary data and machine learning offerings (“NextRoll Technology”), companies can better understand their current customers, find new loyal customers and build lasting customer relationships through intelligence-driven direct marketing activities.

NextRoll has two different business divisions:

• AdRoll is an e-commerce marketing platform for companies that sell their products and services directly to consumers (called “Direct to Consumer” or “D2C” companies). The AdRoll platform makes it easy and affordable for D2C companies to deliver the cross-channel experiences consumers expect – enabling them to sell more to their existing consumers and identify new consumers to introduce to their products and services. AdRoll does this by creating connected, personalized customer journeys that enable brands to reach new and existing customers through digital advertising, email marketing and onsite experiences. AdRoll also helps companies understand the impact of their marketing efforts with advanced measurement and attribution;
• RollWorks offers an account-based platform for businesses who want to sell their products and services to other businesses (called “Business to Business” or “B2B” companies). Our RollWorks Services help B2B companies identify their target accounts and key buyers, reach those accounts across multiple channels and measure program effectiveness in their system-of-record.

Interest-Based Advertising

NextRoll’s Technology helps our D2C and B2B Customers provide ads and send emails to people that are most likely to find them interesting by showing them ads that are relevant to their specific interests. This is called “interest-based advertising”. We show many of these interest-based ads on websites and mobile apps which rely on advertising revenue to support the content they provide - and what we all consume - for free each day.

When you visit a website or a mobile application (each a “Digital Property”) operated by one of our Customers, open an email from a Customer, or get served an ad by us on behalf of our Customer on a third party site, we may collect certain data from your device as described in this Service Privacy Notice. Our platform then uses that data, as well as other data described in What Data We Collect, to help our Customers provide ads and send emails to you that aim to be more relevant to you. To see an example of how this works in practice, see Example of Interest-Based Advertising.

Interest-based advertising enables publishers of Digital Properties to more accurately determine which ads to serve to specific users based on near real-time data. In turn, this allows our Customers to provide more effective advertising that reaches a more precise pool of prospective buyers.

All in all, interest-based advertising promotes better competition in the marketplace (for example, small and medium sized companies have a better opportunity to reach as many prospective buyers as large, well-funded, competitors), and allows our Customers to provide free or low-cost content to their customers due to the resources generated by effective advertising.

Example of Interest-Based Advertising

You’re working from home for the foreseeable future and want to invest in more comfortable work-from-home clothing. You can’t go to the store right now so you decide to peruse some e-commerce sites instead. You go to Google and type in “loungewear” and a list of websites pop up, including one for ABC Sweatshirts. You’re still in the research phase so you browse their site but don’t purchase. Luckily, ABC Sweatshirts is a customer of NextRoll and uses the AdRoll technology for its e-commerce platform. Our technology notes that your device visited ABC Loungwear’s website and was looking at sweatshirts.

Later, as you browse the Internet, we show you ads online from ABC Sweatshirts to encourage you to come back and purchase the sweatshirt, perhaps even with a discount offer or notice of an upcoming sale. We may also show you ads from other companies that sell similar products or services you may be interested in to complete your loungewear outfit, such as sweatpants or home slippers. In addition, if you gave ABC Sweatshirts your email address for marketing purposes, we may also send you emails on behalf of the brand that tell you about its new exclusive line of sweatshirts, special promotions, and more. Alternatively, we may use your email to serve you interest-based ads on social media (for example, your social media provider may match a pseudonymized form of your email address that we provide them with the email address details you have registered with your social media account, enabling us to show you interest-based ads in your social media newsfeed).

Measurement and Attribution

In addition to interest-based advertising, we also provide various analytics to help our Customers measure the success of their advertising campaigns and identify prospective buyers who may be the most interested in their products or services.

For instance, by collecting a unique identifier (such as a cookie ID) from the devices of users who see our Customers’ ads or visit their Digital Properties, we can measure whether those unique identifiers subsequently took a particular action, such as buying a Customer’s product or visiting their Digital Property (sometimes called a “conversion”). In some cases, we may use our cross device data asset to match unique identifiers (which includes browsing activity) to email addresses. Customers are only notified of a match if the email already exists in the Customer ‘s CRM records. AdRoll’s D2C Services can collect, measure and analyze different types of data in conjunction with these unique identifiers and provide useful information to our AdRoll Customers such as what IP address ranges visitors to their Digital Properties are from (indicating the geographic locations of a visitor, which may help indicate what locations to run a particular ad campaign), what products or services located on their Digital Property are attracting more attention (or less), and what ad campaigns ultimately led a cookie ID back to a Digital Property to view more products or make a purchase.

RollWorks’ B2B Services provide similar types of analytics derived from the same sort of data as AdRoll’s D2C Services described above, but with a focus on firmographic information to provide insights on the type of B2B customers that appear to be interested in specific products or offerings on that Customer’s Digital Property. For example, determining which IP address ranges are associated with a unique identifier (such as a cookie ID) so we can identify companies who may be interested in our Customer’s product or service, or, if a unique identifier is linked to an email address that has already been provided to the B2B customer, RollWorks may alert the Customer of increased browsing activity that indicates interest from a particular known account.

Overall, we use the information learned from unique identifier behavior across the Internet to provide reporting to both our D2C and B2B Customers. A more detailed list of all the data we collect is described in What Data We Collect.

We collect the following categories of data in the provision of our Services for the purposes explained below.

Data You or Our Customers Provide To Us

• Email and CRM data from our Customers: Some Customers provide their customer relationship data to us (e.g. name, email address, company address, mobile number) or instruct us to collect clear email addresses on their behalf using NextRoll Technology (“Customer CRM Data”) for processing as part of our Services. By doing so, we help our Customers identify who is showing interest on their Digital Properties as well as serve, measure and analyze interest-based ads to their current or potential customers (we may also trigger these ads by licensing RollWorks B2B Contact Data to a Customer). For example, if you are browsing a software company’s website and submitted your email to download a white paper, the software company may use our Services to contact you and provide you with more information about the software company’s products that appear to be of most interest to you (subject to the marketing preferences you indicate to the software company). We use our Customer’s CRM Data only as a processor for the purpose of assisting that particular Customer with their own advertising efforts and reporting performance back to the Customer's CRM system. We do not share clear email addresses belonging to one Customer with another Customer.

• Shopping Data: Some Customers provide us with data about their buyers’ shopping habits, including non-financial transactional data, product codes and check-out activity in addition to the browsing data that we collect. This data may come from their Digital Properties or other non-financial transactional data they maintain. We use this data to help us better target, personalize and measure the effectiveness of advertising campaigns. This data is also Customer CRM Data and belongs to our Customers and is handled by NextRoll as a processor.

• Hashed email addresses: When a Customer permits us, we collect hashed versions of the email addresses that you have entered on that Customer’s Digital Property. Hashing is a technology process that pseudonymizes email addresses. For instance, when joethecat@nextroll.com is run through a typical hashing function, it becomes a string of digits, such as: 0F0B7B1A1A7E8BDBBC6AA545F8CCD6F83671B32479271BFCB6CC8498912058D5. We take this step to protect email addresses, while being able to use the unique identifier created for the purpose of recognizing you online across Digital Properties and sending you interest-based ads across different devices (computers, tablets and mobile devices) and browsers (also called “cross-device matching”). We describe cross-device matching in further detail in How We Use the Data We Collect.

• Data We Receive in Our Corporate Capacity: We also collect data from our own Customers and visitors to our website(s). To learn more about how we collect and use that data, please see our Website Privacy Notice.

Data We Automatically Collect From Your Device

Unless you have opted-out or have otherwise refused to provide consent, the following is data that we collect from your device automatically:

• Cookies: A unique identifier that NextRoll assigns to you when visiting a Customer’s Digital Property so NextRoll can understand your online journey and have the opportunity to serve ads to you when you visit Publisher’s Digital Properties.

• Device Information: This is technical information about the device you use to access our Customers’ Digital Property, such as your operating system. Additionally, in the case of mobile devices, your device type, and mobile device's unique advertising identifier (such as the Apple IDFA or Android Advertising ID), and any other unique identifier that may be assigned to the mobile device, such as an Android ID or UDID in older Apple phone models, or a non-cookie unique identifier used by Non-Cookie Technologies.

• IP Address: The IP address associated with the device you are using when accessing a Customer’s Digital Property.

• Location Data: This is non-precise information related to your geography derived from your device’s IP address. This does not reveal your precise geographic coordinates (i.e. GPS latitude and longitude) - only country, state, city and zip/postal code, and helps us to display ads that are relevant to your general location (for example, showing ads in French if you are located in France).

• Browser Data: This is technical information about the browser you are using that is captured in order to serve you an ad that can be rendered on your device (for example, Chrome, Firefox, and Safari).

• Activity on Customers’ Digital Properties: This is data about your browsing activity on a Customer’s website or application. This includes, for example, which pages you visited and when, what items were clicked on a page, how much time was spent on a page, whether you downloaded a white paper on a B2B website, what site or ad brought you to the Customer’s website, what items you placed into your online shopping cart and what products were purchased and the price of the products purchased.

• Ad Data:This is data about the online ads we have served (or attempted to serve) to you. This includes , for example, how many times an ad has been served to you, what page the ad appeared on and whether you clicked on or otherwise interacted with the ad.

All of this data is collected to help make sure you get the best and most relevant experience when engaging with our Customers.

Data We Collect From Third Party Sources

• Campaign Performance Data: This data includes information about how well our Customers’ ads and campaigns have performed, whether on our platform or on other advertising platforms.

• Data from Audience Partners: We may collect additional information about you from our audience partners who create and provide us with segments which we use for our Customers (“Audience Partner”). A segment is a grouping of users who share one or more attributes (e.g. demographic or firmographic attributes). We use this data to better understand the Customers’ target audience and to better market the Customers’ products and services to you. We may also work with our Customers and Audience Partners to synchronize their unique, pseudonymous identifiers to our own to enable us to more accurately recognize a particular unique browser or device and the advertising interests associated with it (commonly known as “ID or User Syncing”).

• Data from Advertising Partners: This is data that allows us to match the NextRoll cookie identifier with identifiers that may already be used by other companies in the digital advertising ecosystem that we work with (“Advertising Partners”). For example, we work with ad exchanges, publishers and supply side platforms (i.e. companies that sell advertising space on publishers’ websites) in order to serve our ads. Matching cookie identifiers helps us deliver ads to you and recognize you across browsers and devices and may include pseudonymous advertising identifiers (meaning identifiers that help identify your browser or device, but not you directly) which some Advertising Partners choose to share with us.

Data collected pursuant to RollWorks Business only:

• Email Communications: Customers may provide us with access to their email communications from their prospects when they have engaged us to provide email marketing services. NextRoll acts as a processor of this CRM Data. . When access to this data involves access to Gmail Data, it will be subject to these additional restrictions:

  • We will only use access to read, write, modify or control Gmail message bodies (including attachments), metadata, headers, and settings to provide a web email that allows users to compose, send, read and process emails and will not transfer this Gmail Data to others unless doing so is necessary to provide and improve these features, comply with applicable law or as part of a merger, acquisition or sale of assets;

  • We will not use this Gmail Data for serving advertisements; and

  • We will not allow humans to read this data unless agreed to by the Customer, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the provision of NextRoll’s Services.

• Contact data from third parties:  We obtain and collect contact data from various third-party sources, including from public sources and through licenses with data providers. We may also infer contact data based on email addresses and email naming conventions. This contact data is B2B information – in other words, it is typically a business email address, business street address and a business telephone number. Please note that as part of our RollWorks Services, we do not collect business email addresses from third parties for any individuals who are residing in any European Territories (as defined in International Transfers).

Our goal is to leverage this data to help Customers better identify and engage with you and, in turn, provide you with an ideal online experience whereby ad-sponsored content is available for free and the ads served to you are for products and services that aim to be relevant and interesting to you. The data we collect also helps Customers analyze traffic on their Digital Properties, measure the effectiveness of their ad campaigns and gauge the interest of prospective buyers. Additionally, we use this data to operate, improve and enhance our Services.

Specifically, we use this data for the following purposes:

• Interest-Based Advertising:  To select ads that are more likely to be relevant to you based on data such as your browsing activity, the time of day and time spent visiting specific Digital Properties, and non-precise geographic data inferred about your device(s). For example, we may show you ads for your favorite shopping site (or similar sites we think you may like) for goods or services only available in your city, region or country during your lunch or commute hours.

• Segmenting Audiences:  To segment you into groups (like bargain hunters, high intent visitors, low intent visitors) for certain purposes such as reporting and analytics as well as determining what ads and email content would best peak your interest.  To do so, we use data from Customer Digital Properties you visit in addition to data provided by the Customer and Audience Partners (i.e. demographic and firmographic information about your unique identifier). 

• Ad Delivery:  We use data about your browser or other technical information about your device in order to technically deliver advertising and confirm successful delivery of the ad.  

• Frequency Capping:  We use data about the ads that have been served to you to make sure you will not see the same ad too many times. If we know you’ve already seen one of our Customer’s ads several times, we’ll try to show you a different ad next time.

• Sequencing:  If you are being served a sequence of ads, to make sure we show you the right ad next in the sequence.

• Mapping data to Our Cross-Device Asset: NextRoll’s cross-device asset is used to connect multiple devices to one person, household, and/or online identifiers such as an email address (hashed for security) that a Customer may have collected directly from its customers. The cross-device asset allows companies to better understand their known-customer activity, as well as improves the ability to target and measure ad campaigns (including limiting the number of times the same person or household sees an ad).

  • Cross-device matching: Identifying different devices and browsers that are likely to be associated with you so that ads can be targeted, capped and sequenced across those devices, and so that campaign effectiveness can be measured and analyzed. For example, cross-device matching helps us not show you ads for the shoes you were looking at on your phone but already purchased on your tablet. Instead we’ll try to show you ads for an upcoming triathlon where you can put those shoes to work. It also helps us match devices so we can honor your opt-out choices across all devices we know are connected to the opted-out cookie. You may opt-out of cross-device interest-based targeting by employing the respective opt-out techniques we describe in Your Choices and Opting-Out of Targeted Ads. To learn more about how we use cross-device matching, visit our blog.

  • Syncing Online Identifiers with Customer CRM Data: Customers may use NextRoll Services to match online browsing activity indicated by online identifiers with existing email addresses the Customer has already obtained ( i.e. Customer CRM Data).  Customers may also use this information to understand which consumers or business accounts are showing increased interest to better understand their website audience and respond with appropriate marketing activity.

• Identifying Companies Associated with an IP Range for B2B marketing:  We match IP address ranges to companies who disclose their IP address ranges in order to provide aggregated reports to companies regarding their website traffic.

• Reporting and Attribution:  By analyzing activity on our Customers’ Digital Properties, we provide our Customers insights into how their ad campaigns are performing and surface insights about their site visitors. Reporting may include ad metrics, such as traffic on certain Digital Properties, measuring impact of campaigns, impressions (ads served), clicks (ads you clicked on) and conversions. What qualifies as a “conversion” is defined by the Customer—it might include, for example, a sale or a white paper download or a correlation to an actual or inferred sale, site visit or store visit. This data allows a Customer to determine if an ad is not performing well (few attributed conversions), so that the Customer can update the ad (perhaps with a better deal!).

• Licensing Data:  When we receive an email address for a U.S. resident or obtain attribute data from third party data providers or derive an email address we may license that data to our Customers. For example, our RollWorks Contact Data Product provides our Customers with business email addresses. 

• Conducting Our Corporate Operations:  Data we collect in our corporate capacity (i.e. our own B2B lists of Customers) is used to conduct our business operations and communications. Please see our Website Privacy Notice to learn more about how we use that data.

• Complying with Legal Process:  To satisfy in good faith any applicable law, legal process or proper governmental request, such as to respond to a subpoena (whether civil or criminal) or similar process.

• Investigating Wrongdoing and Protecting Ourselves or Third Parties: To enforce or investigate any potential violation of our Terms of Service, policies or the law, and to protect ourselves, our Customers or any third party from any potential harm (whether tangible or intangible).

We may disclose data about you with the following third parties:

• With a Customer:  We may share data about how you have interacted with a Customer’s Digital Properties, email campaigns or ads.  We may share business contact data collected from third party sources or inferred (for example, based on email naming conventions) with a RollWorks B2B Customer if we think that your business or employer would be interested in that Customer’s products. In regards to RollWorks’ Services, we do not collect contact data about residents of European Territories from third parties.

• With Our Audience Partners:  We share hashed email addresses or other pseudonymous online identifiers with our Audience Partners in connection with audience creation and modeling and creating segments for the Customer based on the Customer’s CRM Data. 

• With Our Advertising Partners:  We disclose cookie ID data and the ad we propose to serve with our Advertising Partners, as necessary, to allow for the successful delivery of ads to your device.

• With Our Service Providers:  We contract with companies who provide services to us to support our business operations (e.g., for example, website and data hosting, fraud prevention, viewability reporting, data hygiene, marketing and email delivery), as well as billing, collections, tech, customer and operational support. 

• With Our Subsidiaries and Affiliates:  Our subsidiaries and corporate affiliates will only process your data for the purposes already explained in this Service Privacy Notice. Our subsidiaries are NextRoll Limited (Ireland), AdRoll Limited (UK) and NextRoll Pty Limited (Australia).

• In Connection with Legal Proceedings:  When we are under a legal obligation to do so, for example, to comply with a binding order of a court or where disclosure is necessary to exercise, establish or defend the legal rights of NextRoll, our Customer or any other third party.

• In Connection with a Sale of Our Business:  If a third party acquires some or all of our business or assets, we may disclose your information in connection with the sale (including during due diligence in preparation for the sale).

NextRoll may aggregate and de-identify data it collects so that it can either no longer be directly or indirectly associated with a natural person or cannot be associated with a natural person at all. NextRoll will then use such data for our machine learning, reporting, analytics and other business purposes.

We may also share aggregated and de-identified data with our subsidiaries and affiliates.

NextRoll Technology uses cookies, tracking pixels and related technologies to provide our Services to our Customers. Cookies are small data files that are served by our platform and stored on your device. You can refuse consent to, or opt-out of, NextRoll cookies at any time, as explained in Your Choices and Opting-out of Interest-Based Advertising and Analytics below. The NextRoll cookie we serve through our NextRoll Technology for this purpose is named “__adroll”, “__ar_v4” and “__adroll_fpc.” 

Our Advertising Partners may also drop cookies for the purposes described in What Data We Collect. Generally, the type of cookies dropped will vary depending on the Advertising Partner. We provide a list of our Advertising Pixel Partners here.

Additionally, we use non-tracking cookies to store user decisions in terms of your ad consent and opt-out choices:

• We may drop a __adroll cookie with value opt-out if you opt-out as described below.
• We may drop a __consent cookie that stores the consent choices you have made regarding data processing and advertising by NextRoll.

A full list of NextRoll cookies is set out below:

In respect of website visitors with IP addresses not from a European Territory, NextRoll and some of its Advertising Partners may use technologies other than cookie technology to recognize your computer, device or browser for the purposes of interest-based advertising, analyzing engagement with ads or content, measuring the effectiveness of a particular ad campaign or marketing effort, to monitor against fraud or misuse of our Services, or in other ways described in this Service Privacy Notice in How We Use the Data We Collect. This use of non-cookie technology may be used in addition to cookies, or separately, to collect and record data about your web browsing activities on browsers, search engines or other platforms that may not utilize NextRoll Technology.

You may opt-out of tracking via non-cookie technologies by employing the respective opt-out techniques described in Your Choices and Opting-Out of Interest-Based Advertising and Analytics Ads.

 You can control how you share your data with NextRoll, including electing to opt-out of interest-based advertising altogether. Please visit our opt-out webpage to opt-out.

Generally speaking, an opt-out allows you to direct NextRoll not to engage in a particular type of data collection. There are many different ways that NextRoll collects data, different purposes for that data collection, and different industry-specific and NextRoll-specific tools for opting-out. We describe below the different options for controlling how NextRoll uses your data:

• Web browser: You can opt-out of receiving interest-based ads served by us or on our behalf by clicking on the blue icon that typically appears in the corner of the ads we serve and following the instructions provided or by clicking on our opt-out page. Please note that this opt-out function is browser-specific and relies on an opt-out cookie. This means if you delete your cookies or upgrade your browser after having opted out, you will need to opt-out again.
• Cross Device Opt-Out:  As described above in How We Use the Data We Collect, we may link multiple browsers or devices to the cookie ID, hashed email address or other unique identifiers associated with you. If you opt-out on a browser or device and we have additional devices or browsers linked to you, we will extend your opt-out decision to any other linked browsers and devices. Since we only link users across browsers and devices in certain conditions, there may be cases where you are still being tracked in a different browser or device we have not linked, and where we are treating you as a different user.
• Mobile Device Opt-Out: To opt-out of receiving interest-based ads that are based on your behavior across different mobile applications, see instructions for iOS and Android devices:
  • iOS 7 or Higher: Go to your Settings > Select Privacy > Select Advertising > Enable the “Limit Ad Tracking” setting; and
  • For Android devices with OS 2.2 or higher and Google Play Services version 4.0 or higher: Open your Google Settings app > Select Ads > Enable “Opt-out of interest-based advertising.”
• Industry Opt-Out Tools and Self-Regulation:

  • NextRoll is a member of the Network Advertising Initiative (NAI) and adheres to the NAI Code of Conduct. You may use the NAI opt-out tool which will allow you to opt-out of seeing interest-based ads from us and from other NAI approved member companies. In addition, the NAI opt-out tool allows you to separately opt-out of “audience matched” advertising through the NAI’s “Audience Matched Advertising Opt-Out.” You can also use the email opt-out tool provided by our Advertising Partner, LiveRamp, to opt-out your email address from their database. Audience matching is a particular type of interest-based advertising where de-identified data (e.g. hashed emails) is tied to “offline” activity or information (this information generally is or can be associated with a consumer’s email address - whether that information is part of our Customer’s own customer lists or in lists we license to the Customer). To do “audience matching,” we or another platform then “match” that information (in de-identified form) to cookie IDs, mobile ad IDs, or other online identifiers. We describe this hashing activity in additional detail in What Data We Collect. Because this “audience matched” information is derived from an email address or information that can be tied to an email address, it is possible to opt-out with an email address. However, when you opt-out this way, you will need to submit all of the email addresses that you use for the opt-out to work.

  • We also comply with the Self-Regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance (DAA). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners, via the DAA website.

  • We also comply with the Canadian Self-regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance of Canada (DAAC). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners, via the DAAC website.

  • Finally, we also adhere to the European Interactive Advertising Digital Alliance (EDAA) guidelines for online advertising. You may opt-out via the EDAA website. 

Customer CRM Data: The data retention period for Customer CRM Data is as follows:

• If either Customer or NextRoll explicitly terminates the NextRoll Services in accordance with our Terms of Service, NextRoll will delete Customer CRM Data within 90 days from the termination date. 

• If a Customer’s account has been suspended for 90 days or more, the Customer CRM Data will be deleted.

• When a Customer has not logged in to their NextRoll account in the past 365 days and there has been no product usage in the past 30 days and no media spend has occurred in the past 30 days, the Customer CRM Data will be deleted when the 366th day of no login activity occurs for the account.

Customers may request deletion of Customer CRM Data by visiting the privacy requests webpage.

Mobile Identifiers and Cookie Identifiers:  Cookies we set expire (and are then deleted) 13 months from the last time your device accessed a Digital Property using NextRoll Technology. If you visit another Digital Property that uses our technology inside that 13-month expiry period, then the expiry period will be reset and measured from that date instead. The expiration period for mobile identifiers is controlled by you on your device.

Personal Data Associated with Mobile and Cookie Identifiers Related to Browsing History:  We delete personal data associated with mobile and cookie identifiers after 12 months (for example, data such as a Customer’s website you visited or ads that you may have clicked).

Personal Data Associated with Advertising Bidding Requests:  Data logged in order to process an advertising bid request we have received from an Advertising Partner (such as a cookie identifier, IP address, the domain url requesting to display the ad, and browser information) are deleted after 7 days. Data we have logged regarding bids we have placed to display an advertisement (including cookie identifiers, mobile identifiers, the advertisement bid on and the advertisement won or displayed to the visitor) are deleted after 15 days.

Personal Data Associated with the Display of an Advertisement:  Data logged for the display of an advertisement (including cookie identifiers, the advertisement won or displayed to you and data indicating whether you clicked on the particular advertisement displayed) are deleted after 12 months.

Hashed Email Addresses:Hashed email addresses collected from Customer site visitors are deleted 12 months from the last date the hashed email was collected.

We apply technical, administrative and organizational security measures to protect the data we collect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against other unlawful forms of processing. NextRoll has also completed the SOC2 Type 2 Audit (Security and Privacy) with no exceptions. This report is only available to Customers by a request to support@nextroll.com.

We may transfer the data we collect about you to countries (including the United States of America) other than the country where we originally collected it for the purposes of performing our Services. In general, the transferring countries will be the countries in which we, our Customers, our Advertising Partners, or their service providers operate.

Those countries may not have the same data protection laws as your country. However, when we transfer your data to other countries, we will protect that data as described in this Service Privacy Notice and take steps, where necessary, to ensure that international transfers comply with applicable laws.

For example, when we transfer your data from a European Territory (as defined below) to our parent company in the United States, we do so under the European Commission's Standard Contractual Clauses. These Standard Contractual Clauses are incorporated in the NextRoll Data Protection Addendum between NextRoll and each of our Customers where applicable. When we transfer your data outside of a European Territory to Advertising Partners (or vice versa), we do so under lawful data export mechanisms which may include Standard Contractual Clauses and Binding Corporate Rules.

Our Legal Basis:  If you interact with our Services from the European Territories, our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it. For these purposes, "European Territories" means the European Economic Area, Switzerland and the United Kingdom.

We will normally process personal data about you based on consent (except where the purpose of processing is based on legitimate interest, as described in the “vendor” details of the Consent Management Tool presented to you while visiting Digital Properties from the European Territories). For example, when you visit a Customer’s Digital Property, you will be asked to consent to NextRoll dropping a cookie.  

If you have questions about, or need further information concerning, the legal basis on which we collect and use your personal data, please email dpo@nextroll.com.

European Residents’ Privacy Rights:  In addition, if you are a resident of a European Territory, you have the following data subject access rights under EU data protection law:

• If you wish to access, correct, update or request deletion of your personal data, please visit our privacy requests webpage to obtain a verifiable request form.

• If you wish to object to us processing your personal data or would like to otherwise restrict the processing of your personal data, we will honor that request. Please visit the Your Choices and Opting-Out of Interest-Based Advertising and Analytics portion of this Service Privacy Notice to select the best opt-out method for you.

• Similarly, if we process your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. You can also refuse consent for NextRoll or our Advertising Partners to drop cookies by visiting our opt-out page or by refusing consent for NextRoll (or changing your consent preferences) when you see a Consent Management Tool displayed on a Customer site which lists NextRoll as a vendor.

• You have the right to complain to a data protection authority about our collection and use of your personal data. Contact details for data protection authorities in the European Territories are available from the European Data Protection Board website. However, if you have any questions about our collection and use of your personal data, we encourage you to contact us first at support@nextroll.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@nextroll.com.

In some cases, we act as a processor for our Customers (for example, when we handle our Customers’ CRM data solely to provide them Services) and, in those cases, you should direct any requests to exercise your data protection rights to the relevant Customer. If you are uncertain whether we process your personal data as a controller or a processor in any specific context, you can contact us at support@nextroll.com and we will advise you accordingly.

This section supplements the information contained in this Service Privacy Notice and applies solely to visitors, users and others who are residents of the State of California, as defined in Section 17014 of Title 18 of the California Code of Regulations. This section is provided to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA), and regulations promulgated thereunder as each may be amended from time to time (collectively, the “CCPA”). Any terms defined in the CCPA have the same meaning when used in this section.

Information We Collect and the Purposes for Which this Information is Used

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). This collection of information is listed in What Data We Collect.

We set out below the CCPA categories of personal information we have collected from consumers within the last twelve (12) months in respect of our Services. Please note that personal information in certain categories may overlap with other categories.

Purposes for Which Personal Information is Collected

All data we collect is primarily for the commercial purpose of providing marketing, advertising (i.e., cross-context behavioral advertising) and analytical Services. However, as part of performing these Services, we also use data collected for the following additional business purposes:

• Auditing Interactions with Consumers: to count ad impressions and verify the quality of ad impressions served to unique visitors identified by cookie id or other unique identifier;

• Debugging and Repair:  the identification and repair of impairments to intended and existing functionalities in our Services and NextRoll Technology, perform debugging and related activities to repair errors that impair the functionality of our Services;

• Security:  to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities;

• Internal Research and Development:  to conduct internal research for technological development of our Services and demonstration of the performance of these Services; and

• Quality and Safety Maintenance and Verification:  to verify the quality or safety of our Services and improve, upgrade or enhance our Services and NextRoll Technology.

For more information on how we use this data, please refer to How We Use the Data We Collect.

Disclosure of Personal Information for a Business Purpose

NextRoll discloses personal data for business purposes as set out in Purposes for which Personal Information is Collected above. We disclose, or otherwise share as indicated below, the categories of personal information to the categories of third parties as set out in Data Sharing.

Sharing Personal Information

In the preceding twelve (12) months, we have shared the following categories of personal information for the commercial purpose of providing cross-context behavioral advertising (known as retargeted or interest based advertising) services:

• Category A (Identifiers). By serving ads on digital publisher sites such as news, blogs and weather sites we have shared personal information in the form of cookie string data and pseudonymous data (e.g. hashed emails) from Category A (identifiers) with Advertising Partners and Advertising Partners.

Sales of Personal Information

In the preceding (12) twelve months, we have sold the following categories of personal information:

• Category A (Identifiers). Pursuant to our RollWorks B2B Contact Data Service, we have sold personal information in the form of business emails from Category A (Identifiers) to Customers.

NextRoll does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age. 

To opt-out of the sale or sharing of your personal information visit our Do Not Sell or Share My Personal Information page.

Sensitive Personal Information

NextRoll may use or disclose sensitive personal information for purposes other than those specified in Section 7027(m) of the CCPA to the extent such information constitutes sensitive personal information. Please see Information We Collect and the Purposes for Which this Information is Used.

Your Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes the rights of California residents and provides information on how to exercise those rights. 

Right to Know and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, (see Exercising Right to Know, Data Portability, Right to Deletion, and Right to Correct) we will disclose to you:

• The categories of personal information we collected about you;

• The categories of sources for the personal information we collected about you;

• Our business or commercial purpose for collecting or selling that personal information;

• The categories of third parties with whom we share that personal information;

• The specific pieces of personal information we collected about you (otherwise known as a data portability request); and

• Two separate lists where we have sold or disclosed your personal information for a business purpose:

  • Sales: identifying the personal information categories that each category of recipient purchased; and

  • Disclosures for a business purpose: identifying the personal information categories that each category of recipient obtained

Right to Delete

You have the right to request that we delete any of your personal information that we collect from you and retain, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Right to Know, Data Portability, Right to Deletion, and Right to Correct), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relations with you or otherwise perform our contract with you;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for such activities;

• Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided by law;

• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

• Comply with a legal obligation; and

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Right to Correct

You have the right to request that a business correct inaccurate personal Information that is maintains about you, taking into account the nature of the personal information and the purposes of the processing of the personal Information. 

Once we receive and confirm your verifiable consumer request (see Exercising Right to Know, Data Portability, Right to Deletion, and Right to Correct), we will use commercially reasonable efforts to correct (and direct our service providers to do the same) your personal information, unless an exception applies.

Exercising Right to Know, Data Portability, Right to Deletion, and Right to Correct

To exercise the right to know, data portability and deletion rights described above, please submit the consumer request to us by either:

• Calling us at 1-844-740-7126; or

• Visiting our privacy requests webpage.

After submitting the request, a form will be sent to the requestor to verify the consumer request.

On the verification form, the requestor must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and

• Describe the request with sufficient detail that allows us to properly understand, evaluate and respond to it.

Only you, or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. 

We cannot respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; and (ii) confirm the personal information relates to you.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We will deliver our written response to you electronically unless you indicate delivery to be by mail.

The response we provide will also explain the reasons we cannot complete a request, if applicable. Please note that personal information deleted during this period as set out in Data Retention will not be provided.

The format of our responses to you concerning personal information collected, disclosed or sold will be provided in a readily useable format that should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

CCPA Metrics

To view metrics regarding consumer requests to know, delete, and opt out, for the previous calendar year (January 1 - December 31) please visit our CCPA Metrics webpage. 

Right to Limit Collection of Sensitive Personal Information

You have the right to limit the use or disclosure of sensitive personal information by the business by visiting our opt-out page or Do Not Sell or Share My Personal Information page, or through the instructions provided in Your Choices and Opting-Out of Interest-Based Advertising and Analytics Ads.

Right to Opt out of the Sale or Sharing of Your Personal Information 

To exercise the right to opt-out of the sale or sharing of your personal information you (or your authorized representative) may visit  the Do Not Sell or Share My Personal Information webpage.

Opt Out Preference Signals

If you are visiting a site with NextRoll’s Technology, you may opt-out of the sale or sharing of your data by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (“GPC”) (on the browsers and/or browser extensions that support such a signal). If you do not have an account on the site you are browsing or if you are not logged into your account while browsing, your request to opt-out will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to NextRoll. If you would like us to make the connection between your browser and your account when you send the opt out request or GPC signal, and you have not yet opted out, you can do so here.

Please note that your use of sites that have NextRoll’s Technology may result in tracking, collecting and processing of your personal information. Please also check for the Do Not Sell or Share My Personal Information or Privacy Choices link on the sites you visit. 

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services;

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

• Provide you a different level or quality of goods or services; 

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services; or

• Retaliate against an employee, applicant, or independent contractor’s right to exercise their CCPA rights.

Exercising Your Consumer Rights.

US state privacy regulations provide Virginia, Connecticut, Colorado, and Utah residents with specific rights regarding their personal information. For more information, please see the Connecticut Data Privacy Act, Colorado Privacy Rights Act, Virginia Consumer Data Protection Act, and Utah Consumer Privacy Rights Act.

Consumers in these states can exercise their rights via the methods described in Exercising Right to Know, Data Portability, Right to Deletion, and Right to Correct. To appeal NextRoll’s decision as a Controller with regard to a consumer request, or to contact NextRoll, please view the Contact Us About Questions section.

The Sale of Personal Information and Processing for Targeted Advertising

For information on the sale of your personal information and how to opt out, see Sales of Personal Information.  NextRoll processes personal information for targeted advertising. See How We Use the Data We Collect above. To opt out of targeted advertising, see Your Choices and Opting-Out of Interest-Based Advertising and Analytics.

Please view NextRoll’s disclosures pursuant to the Brazilian Data Protection Law, the Lei Geral de Proteção de Dados Pessoais (“LGPD”), here.

We may update or modify this Service Privacy Notice at our discretion at any time. When we make changes to this Service Privacy Notice we will post the updated notice online and update the notice’s effective date. Please review this Service Privacy Notice periodically.

If we are required by applicable law to obtain your consent to any material changes before they come into effect, then we will do so in accordance with law.

If you have any questions about this Service Privacy Notice or our privacy practices, or want to appeal NextRoll’s decision as a Controller with regard to a consumer request, you can contact support@nextroll.com.

If you are located in a European Territory then, where we process your data as a data controller, NextRoll Limited is the data controller of your information. To contact NextRoll Limited please email support@nextroll.com or write to us at the following address:

NextRoll Limited
Attn: Legal
Level 6
1, Burlington Plaza
Burlington Road
Dublin 4, Ireland

If you wish to escalate your inquiry after contacting the support team, you are welcome to contact our Data Protection Officer at dpo@nextroll.com:

Lucid Privacy Group
NextRoll Data Protection Officer
1050 Page Street
San Francisco, CA 94117
USA

Effective as of June 24, 2021
View archived Privacy Policy

NextRoll, Inc. (formerly AdRoll, Inc.) and its subsidiaries and affiliates (“we,” “our” or “us”) is an independent marketing technology company that offers intelligent, data-driven advertising and marketing services and solutions to help big and small companies accelerate their growth (“Services”).

Please note that this Privacy Notice only applies to data that we collect when you visit a NextRoll website or a mobile application, including connect.adroll.com, app.adroll.com, www.nextroll.com, www.adroll.com, pages.adroll.com, www.rollworks.com, pages.rollworks.com, https://blog.adrollgroup.com, help.adroll.com, tech.adroll.com, or developers.adroll.com (each a "Digital Property"). To learn what data we collect when you visit the websites of our Advertisers, please visit the NextRoll Service Privacy Notice.

Table of Contents

• About NextRoll's Services
• What Data We Collect
• How We Use the Data We Collect
• Data Sharing
• Aggregated and De-Identified Data
• Cookies and Related Technologies
• Non-Cookie Technology for Tracking Outside European Territories
• Your Choices and Opting-Out of Interest-Based Advertising and Analytics
• Data retention
• Security
• International Transfers
• Information for European Territory Residents: Our Legal Basis and Your Rights
• Information for California Residents Only
• Changes to this Privacy Notice
• Contact Us About Questions

NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their businesses. Powered by machine learning and integrated data platforms, NextRoll’s intelligent, data-driven marketing and advertising services and solutions go beyond serving digital ads by providing companies better visibility into which audiences are most interested in certain products and services. By using NextRoll’s Technology, companies can better understand their customers, find new loyal customers and build lasting customer relationships through intelligence-driven marketing activities.

All told, NextRoll’s proprietary data and machine learning offerings (“NextRoll Technology”) are aimed at a single mission: helping companies of all shapes, sizes and industries accelerate their growth.

NextRoll has two different business divisions:

• AdRoll is an e-commerce marketing platform for companies that sell their products and services directly to consumers (called “Direct to Consumer” or “D2C” companies). The AdRoll platform makes it easy and affordable for D2C companies to deliver the cross-channel experiences consumers expect – enabling them to sell more to their existing consumers, and also to identify new consumers to whom they can build relationships with to sell their products and services. AdRoll does this by creating connected, personalized customer journeys that enable brands to reach new and existing customers through digital advertising, email marketing and onsite experiences, and helps companies understand the impact of their marketing efforts with advanced measurement and attribution; and
• RollWorks offers an account-based platform for businesses who want to sell their products and services to other businesses (called “B2B” companies). Our RollWorks Services help B2B companies identify their target accounts and key buyers, reach those accounts across multiple channels and measure program effectiveness in their system-of-record.

The NextRoll websites are a collection of sites that we use to describe our Services to potential customers, to provide our Services to our Customers, and to support Customers and partners as they seek to identify, deploy and measure their marketing and advertising efforts with us over time.

For more information on the data collected through our Services, please see our Service Privacy Notice.

We may collect the following categories of information on our Digital Properties and use them for the purposes explained below.

Data You Provide To Us

• Contact Information: You may provide us with your name, address, phone number and email when you set up an account with us and you may provide your name, title, company, email, address and/or phone number when you sign up for an event with us online or download content from our Digital Properties.
• Account Information: If you open an account, we will collect your username and password and other information necessary to open and access your account.
• Customer Service Information: Information you may provide to our customer service including your email address for purposes of responding to your inquiries and survey responses.
• Financial Information: Credit card number or other payment account information. This information is collected directly by our payments processor and not stored by NextRoll.
• Hashed email addresses: We collect hashed versions of the email addresses that you enter on our Digital Properties. Hashing is a technology process that pseudonymizes (i.e. digitally scrambles) email addresses. For instance, when joe_the_cat@nextroll.com is run through a typical hashing function, it becomes the following string of digits: 0F0B7B1A1A7E8BDBBC6AA545F8CCD6F83671B32479271BFCB6CC8498912058D5. We take this step to de-identify data and protect email addresses. We use the hashed email created for the purpose of recognizing you and sending your interest-based ads across different devices (computers, tablets and mobile devices) and browsers (also called “cross-device matching”). We describe cross-device matching in further detail in How We Use the Data We Collect.
• Information about your business: You may use the tools available on NextRoll’s Digital Properties to learn more about how NextRoll’s Services can help you grow your business. If you are an existing Customer, we may use the information you provide about your business when using our online tools to add to your existing Customer profile with NextRoll.

Data We Automatically Collect From Your Device

• Cookies: A unique identifier that NextRoll assigns to you when visiting one of our sites so we can understand your online journey and have the opportunity to serve ads to you when you visit a publisher’s site.
• Device Information: This is technical information about the device you use to access our Digital Properties such as your device's IP address and operating system. Additionally, in the case of mobile devices, your device type, unique advertising identifier (such as the Apple IDFA or Android Advertising ID) and any other unique identifier that may be assigned to the mobile device, such as an Android ID or UDID in older Apple phone models, or a non-cookie unique identifier used by Non-Cookie Technologies.
• IP Address: The IP address associated with the device you are using when visiting a NextRoll Digital Property.
• Location Data: This is non-precise information related to your geography derived from your device’s IP address (e.g. laptop, desktop or mobile etc.). This does not reveal your precise geographic coordinates (i.e. your GPS latitude and longitude) - only country, state, city and zip/postal code level location data. This helps us to display ads that are relevant to your general location (for example, showing ads in French if you are located in France).
• Browser Data: This is technical information about the browser you are using that is captured in order to serve you an ad that can be rendered on your device. An example of browser information is the technical information that identifies your browser as, for example, Chrome, Firefox, Safari etc.
• Activity on our Digital Properties: This is data about your browsing activity on our Digital Properties and your interactions with our other tools or dashboards. For example, which pages you visited and when, what items were clicked on a page, how much time was spent on a page or whether you downloaded a white paper.
• Ad Data: This is data about the online ads we have served (or attempted to serve) to you. It includes information such as how many times an ad has been served to you, what page the ad appeared on and whether you clicked on or otherwise interacted with the ad.

All this data is collected to help make sure you get the best and most relevant experience when engaging with NextRoll.

Data We Collect from Third Party Sources

• Data from Audience Partners: We may collect additional information about you from our audience partners who create and provide us with segments of our own customers (“Audience Partner”). A segment is a grouping of users who share one or more attributes (e.g. firmographic attributes). We use this data to better understand our target audience and to better market our Services to you.
• Data from Advertising Partners: This is data that allows us to match the NextRoll cookie identifier with identifiers that may already be used by other companies in the digital advertising ecosystem that we work with (“Advertising Partners”). For example, we work with ad exchanges, publishers and supply side platforms (i.e. companies that sell advertising space on publishers’ websites) in order to serve our ads. Matching cookie identifiers helps us deliver ads to you and recognize you across browsers and devices, and may include pseudonymous advertising identifiers (meaning identifiers that help identify your browser or device, but not you directly) which some Advertising Partners choose to share with us.
• Contact Data from Third Parties: We obtain and collect contact data from various third party sources, including from public sources and through licenses with data providers. This contact data is B2B information – in other words, it is typically a business email address, business street address, or sometimes, a business telephone number.

Specifically, we use this data for:

• Interest-Based Advertising: Serving you ads for certain NextRoll Services that are more likely to be relevant to you based on your browsing activity, the time of day you visit our Digital Properties and the time you spend on them, and non-precise geographic data inferred about your device/s. For example, we may show you ads for our Service only available in your city, region or country during your lunch or commute hours. For more information about how our Services work, please see our Service Privacy Notice.
• Segmenting Audiences: We use data from our Digital Properties you visit in addition to data from Audience Partners to segment you into groups (like high or low intent visitors) for reporting, analytics and determining what ads and email content would best peak your interest.
• Ad delivery: We use data about your browser or other technical information about your device in order to deliver advertising and confirm successful delivery of the ad.
• Frequency Capping: We do this to make sure that you don't see the same NextRoll ad too many times.
• Sequencing: If you are being served a sequence of ads, we do this to make sure we show you the right ad next in the sequence.
• Mapping Data to our Cross-Device Asset: NextRoll Technology includes its cross-device asset which is used to connect multiple devices to one person, household, and/or online identifiers such as an email address (hashed for security) that you may have submitted to NextRoll. Our cross-device asset allows us to better understand your online activity and helps us improve our ability to target and measure ad campaigns (including limiting the number of times you or your household sees an ad for NextRoll Services).
  • Cross-Device Matching: Identifying different devices and browsers that are likely to be associated with you so that ads can be targeted, capped and sequenced across those devices, and so that campaign effectiveness can be measured and analyzed. For example, cross-device matching helps us not show you ads for the shoes you were looking at on your phone but already purchased on your tablet. Instead we’ll try to show you ads for an upcoming triathlon where you can put those shoes to work. It also helps us match devices so we can honor your opt-out choices across all devices we know are connected to the opted-out cookie. You may opt-out of cross-device interest-based targeting by employing the respective opt-out techniques we describe in Your Choices and Opting-Out of Targeted Ads. To learn more about how we use cross-device matching, click here.
  • Syncing Online Identifiers with Customer CRM Data: If you have provided us with your email address, we may match your online browsing activity indicated by online identifiers. We may use this information to see if you are showing increased interest in our products and services to better understand our website audience and to respond with appropriate marketing activity.
• Identifying Companies Associated with an IP Range for B2B Marketing: We match IP address ranges to companies who disclose their IP address ranges to analyze and report our website traffic.
• Reporting and Attribution: Analyzing how our ads are performing and gaining insights into our Customers and prospective customers. Reporting may include ad metrics such as attribution (described above), impressions (ads served), clicks (ads you clicked on) and conversions (for example, if you create an account with us or download a white paper from our site). This helps us identify ads that are most useful to you and demonstrates NextRoll’s value. Relatedly, this also helps us identify an ad that is not performing well, allowing us to update our ad or ad campaign strategy.
• Providing our Services and Customer Support: For example, to monitor usage of features, manage campaigns and log data for audit purposes. We may contact you when you ask us for support or when it appears to us that you might need support. We maintain records of our communications with you for future reference.
• Billing: Invoice you and collect fees for services we have provided.
• Troubleshoot Problems: To monitor and fix our website performance, for example, if the site is slow, not loading properly, or to investigate aberrations in performance of our Services.
• Prevent Potential Fraud and Enforce our Terms of Service: To prevent fraud on our sites or through the use of our Services,to enforce our Terms of Service or other policies or investigate any potential violation of those Terms and policies, any potential violation of the law, or to protect ourselves, our Customers or any third party from any potential harm (whether tangible or intangible).
• Customize, Measure and Improve our Websites and Services: To provide customized content and to measure which content is most helpful (or unhelpful) to our Customers, which helps improve our website and our services. For example, if we notice higher visits to certain Help Center articles or receive higher customer support tickets for specific issues, we can improve our support materials or identify areas where we can make our product better for our Customers.
• Contact You About Your Account or our Services, Including to Market our Services to You or Provide Updates: We may use your contact information to contact you about your account, for example, in relation to the performance of your campaigns, to follow up on billing issues or to tell you about new Services we are offering. We may send you product updates, performance information, surveys or communicate with you in other ways about our services. When we can legally do so, we may augment the information you give us in order to contact you by phone or even snail mail. You can opt-out of receiving emails by unsubscribing through the link at the bottom of our emails or by updating your email preferences here. You can let us know if you don’t want to receive phone calls or other marketing materials from us by contacting support@nextroll.com.
• Conducting Our Corporate Operations. Data collected in our corporate capacity, such as our own B2B lists of Customers and prospective customers, is used to conduct our business operations and send communications.
• Complying with Legal Process: To satisfy in good faith any applicable law, legal process or proper governmental request, such as to respond to a subpoena (whether civil or criminal) or similar process.
• Investigating Wrongdoing and Protecting Ourselves or Third Parties: To enforce or investigate any potential violation of our Terms of Service and policies, any potential violation of the law and to protect ourselves, our Customers, or any third party from any potential harm (whether tangible or intangible).

We may disclose data about you:

• With our Audience Partners: We share hashed email addresses or other pseudonymous online identifiers with our Audience Partners in connection with audience creation and modeling and creating segments.
• With our Advertising Partners: We disclose cookie ID data and the ad we propose to serve to you with our Advertising Partners, as necessary, to allow for successful delivery of ads to your device.
• With our Service Providers: We contract with companies who help with parts of our business operations (e.g., website and data hosting, fraud prevention, viewability reporting, data hygiene, marketing and email delivery), as well as billing, collections, tech, customer and operational support.
• With our Subsidiaries and Affiliates: These entities will only process your data for the purposes already explained in this Website Privacy Notice. Our subsidiaries are NextRoll Limited (Ireland), AdRoll Limited (UK) and NextRoll Pty Limited (Australia).
• In connection with legal proceedings: When we are under a legal obligation to do so, for example to comply with a binding order of a court, or where disclosure is necessary to exercise, establish or defend the legal rights of NextRoll, our Customers or any other third party.
• In connection with a sale of our business: If a third party acquires some or all of our business or assets, we may disclose your information in connection with the sale (including during due diligence in preparation for the sale).

NextRoll may aggregate and de-identify data it collects so that it can either no longer be directly associated with a natural person or cannot be associated with a natural person at all. NextRoll will then use such data for our machine learning, reporting, and other business purposes.

We may also share aggregated and de-identified data with our subsidiaries and affiliates and third parties, including with our Advertising Partners. For example, we may conduct industry wide surveys to publish benchmark reports, or to include statistics when collaborating with researchers or other companies on industry white papers.

Our websites use cookies, tracking pixels and related technologies to operate and personalize our sites. For example, to provide personalized content on our site, enable customer service chat functionality, for analytics purposes, and to target ads to you about our products and services on other websites.

We also use cookies, tracking pixels and related technologies to provide our services for our Customers. Cookies are small data files that are served by our platform and stored on your device. You can refuse consent to, or opt-out of, NextRoll cookies at any time, as explained in Your Choices and Opting-out of Interest-Based Advertising and Analytics below. For more information regarding data associated with cookies, please refer to Data Retention.

Tracking cookies enable us to identify your device when you move between different Digital Properties, so that we can serve targeted advertising to you.

• Specifically, the NextRoll cookie we serve through the NextRoll platform for this purpose is named “__adroll,” “__ar_v4” and “__adroll_fpc”.

Our Advertising Partners may also drop cookies for the purposes described in What Data We Collect. Generally, the type of cookies dropped will vary depending on the Advertising Partner. We provide a list of our Advertising Pixel Partners here.

Additionally, we use non-tracking cookies (not unique) to store user decisions in terms of your ad consent and opt-out choices:

• We may drop an __adroll cookie with value opt-out if you opt-out as described below.
• We may drop a __consent cookie that stores the consent choices you have made regarding data processing and advertising by NextRoll.

A full list of NextRoll cookies is set out below:

In respect of website visitors with IP addresses not from a European Territory, NextRoll and some of our Advertising Partners may use technologies other than cookie technology to recognize your computer, device or browser for the purpose of interest-based advertising, analyzing engagement with ads or content, measuring the effectiveness of a particular ad campaign or marketing effort, monitoring against fraud or misuse of our Services, or in other ways described in this Website Privacy Notice in How We Use the Data We Collect. This use of non-cookie technology may be used in addition to cookies, or separately, to collect and record data about your web browsing activities on browsers, search engines or other platforms that may not utilize NextRoll Technology. You may opt-out of tracking via non-cookie technologies by employing the respective opt-out techniques described in Your Choices and Opting- Out of Interest-Based Advertising and Analytics Ads.

You can control how you share your data with NextRoll, including electing to “opt-out” of interest-based advertising altogether. Please visit our opt-out webpage to opt out.

Generally speaking, an opt-out allows you to direct NextRoll not to engage in a particular type of data collection. There are many different ways that NextRoll collects data, different purposes for that data collection and different industry-specific and NextRoll-specific tools for opting-out. We describe below the different options for controlling how NextRoll uses your data:

• Web browser: You can opt-out of receiving interest-based ads served by us or on our behalf by clicking on the blue icon that typically appears in the corner of the ads we serve and following the instructions provided or by clicking here. Please note that this opt-out function is browser-specific and relies on an “opt-out cookie.” This means if you delete your cookies or upgrade your browser after having opted out, you will need to opt-out again.
• Cross Device Opt-Out: As described above, How We Use the Data We Collect, we may link multiple browsers or devices to the cookie ID, hashed email address or other unique identifiers associated with you. If you opt-out on a browser or device and we have more browsers or devices linked to you, we will extend your opt-out decision to the other linked browsers and devices. Since we only link users across browsers and devices in some conditions, there could be cases where you are still being tracked in a different browser or device we have not linked, and where we are treating you as a different user.
• Mobile Device Opt-Out: To opt-out of receiving targeted ads that are based on your behavior across different mobile applications see the following instructions, for iOS and Android devices:
  • iOS 7 or Higher: Go to your Settings > Select Privacy > Select Advertising > Enable the “Limit Ad Tracking” setting; and
  • For Android devices with OS 2.2 or higher and Google Play Services version 4.0 or higher: Open your Google Settings app > Select Ads > Enable “Opt-out of interest-based advertising.”
• Industry Opt-Out Tools and Self-Regulation:
  • NextRoll is a member of the Network Advertising Initiative (NAI) and adheres to the NAI Code of Conduct. You may use the NAI opt-out tool here, which will allow you to opt-out of seeing personalized ads from us and from other NAI approved member companies. In addition, the NAI opt-out tool allows you to separately opt-out of “audience matched” advertising through the NAI’s “Audience Matched Advertising Opt-Out” tool. You can also use the email opt-out tool provided by our Advertising Partner, LiveRamp, to opt your email address from their database. Audience matching is a particular type of interest-based advertising where de-identified data (e.g. hashed emails) is tied to “offline” activity or information (generally, information that is or can be associated with a consumer’s email address) and matches that de-identified data to cookies, mobile ad IDs or other online identifiers. We describe this hashing activity in detail in What Data We Collect. Because this “audience matched” information is derived from an email address or information that can be tied to an email address, it is possible to opt-out with an email address. However, when you opt-out in this way, you will need to submit all of the email addresses that you use for the opt-out to work.
  • We also comply with the Self-Regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance (DAA). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners via the DAA website.
  • We also comply with the Canadian Self-regulatory Principles for Online Behavioral Advertising as managed by the Digital Advertising Alliance of Canada (DAAC). You may opt-out of receiving personalized ads from other companies that perform ad targeting services, including some that we may work with as Advertising Partners via the DAAC website.
  • Finally, we also adhere to the European Interactive Advertising Digital Alliance (EDAA) guidelines for online advertising. You may opt-out via the EDAA website.
• Reminder to Users Residing in a European Territory: If you are located in a European Territory you will also have additional data protection rights. These are described in Information for European Territory Residents: Our Legal Basis and Your Rights.

You can also request that we stop email marketing to you. You can use the “unsubscribe link” in our marketing emails or contact support@nextroll.com.

We retain data for as long as necessary to perform our Services and for the purposes described in this Website Privacy Notice. For example, we may retain:

• billing information as necessary to meet audit requirements;
• login information to confirm when Customers accepted our Terms of Service; and
• information as long as necessary to meet legal requirements, resolve disputes or enforce agreements.

We retain cookie data such as device and browser information, ad data and data collected on our Digital Properties as follows:

• Mobile Identifiers and Cookie Identifiers: Cookie identifiers we collect expire (and are then deleted) 13 months from the last time your device accessed a Digital Property using our technology. If you visit another Digital Property that uses NextRoll Technology inside that 13-month expiry period, then the expiry period will be reset and measured from that date instead. The expiration period for mobile identifiers is controlled by you on your own device.
• Personal Data Associated with Mobile and Cookie Identifiers Related to Browsing History: We delete personal data associated with mobile and cookie identifiers after 12 months. For example, data such as a NextRoll Digital Property you visited or NextRoll ads that you may have clicked.
• Personal Data Associated with Advertising Bidding Requests: Data logged in order to process an advertising bid request we have received from an Advertising Partner (such as cookie identifier, IP address, the domain url requesting to display the ad and browser information) are deleted after 7 days. Data we have logged regarding bids we have placed to display an advertisement (including cookie identifiers, mobile identifiers, the advertisable bid on and the advertisable won or displayed to the end-user) are deleted after 15 days.
• Personal Data Associated with the Display of an Advertisement: Data logged for the display of an advertisement (including cookie identifiers, the advertisement won or displayed to you and data indicating whether you clicked on the particular advertisement displayed) are deleted after 12 months.

We apply technical, administrative and organizational security measures to protect the data we collect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against other unlawful forms of processing.

We may transfer the information we collect about you to countries (including the United States of America) other than the country where we originally collected it for the purposes of performing our Services. In general, these countries will be the countries in which we or our service providers operate.

Those countries may not have the same data protection laws as your country. However, when we transfer your information to other countries, we will protect that information as described in this Website Privacy Notice and take steps, where necessary, to ensure that international transfers comply with applicable laws.

For example, when we transfer your information from a European Territory (as defined below) to our parent company in the United States, we do so under the European Commission's Standard Contractual Clauses. When we transfer your data outside of a European Territory to Advertising Partners (or vice versa), we do so under lawful data export mechanisms which may include Standard Contractual Clauses and Binding Corporate Rules.

Our Legal Basis: If you are a visitor from the European Territories, our legal basis for collecting and using the personal data described above will depend on the personal information concerned and the specific context in which we collect it. "European Territories" mean the European Economic Area and Switzerland. For the purpose of this Website Privacy Notice, the term "European Territories" shall continue to include the United Kingdom.

We will typically collect personal data from you based on your consent. For example, when you visit one of our Digital Properties, you will be asked to consent to NextRoll dropping a cookie. We also collect personal data where the purpose of processing is based on NextRoll’s legitimate interest, as described in the “vendor” details of the Consent Management Tool presented to you . For example, to administer our platforms and provide our Services and fulfil our contractual obligations as a service provider.

If you have questions or need further information concerning the legal basis on which we collect and use your personal data, please contact us first at support@nextroll.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@nextroll.com.

European Residents Privacy Rights: If you are a resident of a European Territory, you have the following enhanced rights under EU data protection law:

• If you wish to access, correct, update or request deletion of your personal information, please complete the information on this webpage to obtain a verifiable request.
• If you wish to object to us processing your personal data or would like to otherwise restrict the processing of your personal data, we will honor that request. Please visit the Your Choices and Opting-Out of Interest-Based Advertising and Analytics portion of this Privacy Notice to select the best opt-out method for you.
• Similarly, if we process your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. You can also refuse consent for NextRoll or our Advertising Partners to drop cookies by visiting our opt-out page or by refusing consent for NextRoll when you see a “consent banner” displayed on websites which lists NextRoll as a vendor.
• You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Territories are available from the European Data Protection Board website. However, if you have any questions about our collection and use of your personal data, we encourage you to contact us first at support@nextroll.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@nextroll.com.

This section supplements the information contained in this Website Privacy Notice and applies solely to visitors, users, and others who are residents of the State of California, as defined in Section 17014 of Title 18 of the California Code of Regulations. This section is effective as of January 1, 2020, to comply with the California Consumer Privacy Act of 2018 (“CCPA”).

Any terms defined in the CCPA have the same meaning when used in this section.

For the purposes of this section “Services” shall mean performing advertising and marketing services for NextRoll’s purposes as well as maintaining or servicing NextRoll Customer accounts, providing Customer service, processing or fulfilling orders and transactions, verifying Customer information and processing payments.

Information We Collect and the Purposes for Which this Information is Used

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). This collection of information is listed in What Data We Collect.

We set out below the CCPA categories of personal information we have collected from consumers within the last twelve (12) months who are NextRoll Customers and/or visitors of the NextRoll’s Digital Properties. Personal information in certain categories may overlap with other categories.

For clarity, under CCPA personal information does not include:

• Publicly available information from government records;
• De-identified or aggregated consumer information; and
• Information excluded from the CCPA's scope such as:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Purposes for Which Personal Information is Collected

NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their business. All data we collect pursuant to this Website Privacy Notice is for the business purpose of performing advertising and marketing services for our own purposes as well as maintaining or servicing our Customer accounts, providing Customer service, processing or fulfilling orders and transactions, verifying customer information and processing payments. We also use data collected (as identified above) for the following additional business purposes:

• Auditing Interactions with Consumers: count ad impressions and verify the quality of ad impressions served to unique visitors identified by cookie IDor other unique identifier;
• Debugging and Repair: the identification and repair of impairments to intended and existing functionalities in our Services and NextRoll Technology, perform debugging and related activities to repair errors that impair the functionality of our Services;
• Security: detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities;
• Internal Research and Development: conduct internal research for technological development of our Services and demonstration of the performance of these Services; and
• Quality and Safety Maintenance and Verification: verify the quality or safety of our Services and improve, upgrade or enhance our Services and NextRoll Technology.

For more information on how we use this data, please refer to How We Use the Data We Collect.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose (as set out above).

Disclosures of Personal Information for a Business Purpose

NextRoll’s performance of its Services do not amount to a sale of personal information. Instead, NextRoll discloses personal data for business purposes, primarily to perform advertising, marketing and analytics and those purposes set out in Purposes for which Personal Information is Collected above. However, NextRoll always provides consumers with the ability to opt-out of interest-based advertising (and control their data collection in additional ways). You may opt-out of interest-based advertising by visiting our opt-out page or through the instructions provided in the Your Choices and Opting-Out of Interest-Based Advertising and Analytics.

In the preceding twelve (12) months, we have disclosed the following categories of personal information for our business purposes:

• Category A: Identifiers;
• Category B: California Customer Records personal information categories;
• Category D: Commercial information;
• Category F: Internet or Similar Network Activity; and
• Category G: Geolocation.

We disclose your personal information for a business purpose to the categories of third parties set out in Data Sharing.

Sales of Personal Information

We do not consider that the performance of our Services constitutes a ‘sale of personal information’ under the CCPA. Instead, in the course of performing our Services, we disclose personal information for business purposes.

Your Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes the rights of California residents under CCPA and provides information on how to exercise those rights.

Right to Know and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting or selling that personal information;
• The categories of third parties with whom we share that personal information;
• The specific pieces of personal information we collected about you (otherwise known as a data portability request); and
• Two separate lists where we have sold or disclosed your personal information for a business purpose:
  • Sales: identifying the personal information categories that each category of recipient purchased; and
  • Disclosures for a business purpose: identifying the personal information categories that each category of recipient obtained

Right to Delete

You have the right to request that we delete any of your personal information that we collect from you and retain, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Right to Know, Data Portability and Right to Deletion), we will delete (and direct our services providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relations with you or otherwise perform our contract with you;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; and
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Right to Know, Data Portability and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit the consumer request to us by either.

• Calling us at 1-844-740-7126; or
• Visiting our privacy requests webpage.

After submitting the request, a form will be sent to the requestor to verify the consumer request.

On the verification from, the requestor must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable request for access of data portability twice within a 12-month period. We cannot respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; and (ii) confirm the personal information relates to you.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

As mentioned above in Sales of Personal Information, we have elected to honor sale opt-out rights. Please see Personal Information Sales Opt-Out and Opt-In Rights.

Response Timing and Format

We will deliver our written response to you electronically unless you indicate delivery to be by mail.

Any disclosures we provide to you will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot complete a request, if applicable. Please note that personal information deleted during this period as set out in Data Retention will not be provided.

The format of our responses to you concerning personal information collected, disclosed or sold will be provided in a readily usable format that should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out Rights

To exercise the right to opt-out of interest-based advertising, you (or your authorized representative) may submit a request to us by visiting the Do Not Sell or Share My Information webpage.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We may update or modify this Website Privacy Notice at our discretion and at any time. When we make changes to this Website Privacy Notice, we will post the updated notice online and update the notice’s effective date. Please review this Website Privacy Notice periodically.

If we are required by applicable data protection laws to obtain your consent to any material changes before they come into effect, then we will do so in accordance with law.

NextRoll Limited
Attn: Legal
Level 6
1, Burlington Plaza
Burlington Road
Dublin 4, Ireland

If you wish to escalate your inquiry after contacting the support team, you are welcome to contact our Data Protection Officer at dpo@nextroll.com or by writing to the following address:

Address:
Lucid Privacy Group
Attention: NextRoll Data Protection Officer
1050 Page Street
San Francisco, CA 94117
USA