The data we collect about you depends on the Services that you use and how you use them, and it also depends on your relationship with CSA: if you are a web user, a business partner, a prospect, an employee etc.

3.1. End-user data

CSA is a company operating in the field of marketing and advertising technology. We provide digital advertising and analytics services for the benefit of our business customers, giving them the ability to reach users who are most likely to be interested in their products and services. Our proprietary platform possesses cross-channel and cross-screen capabilities to transform data into insight, action and performance. We use the data collected and processed to inform audience targeting and generation of insights about Chinese consumers, and we let our clients use our SaaS platform or we run campaigns on behalf of our clients.

For Europe-based users:

CSA does not target users in the UK and the EU/EEA and it is not our intention to process the personal data of users located there. In order for us to process your data, you will normally have consented to and accepted data processing and cookies or similar technologies from one of the publishers that we collect data from. So, it is possible that when visiting Chinese language websites, you may have consented to data processing or accepted cookies which might lead to us processing your data even if you are located outside of China. On the other hand, we will target Chinese travellers when visiting Europe with advertising campaigns that are run on behalf of our clients. Remember you can change your preferences at any time (please see Section 11) and you can also exercise your rights by contacting us as set out in Section 13.

CSA relies upon consent as a legal basis for most data we process for targeted advertising purposes. However, we and our clients also have a legitimate interest (which is compatible with your privacy rights and interests) to collect and process personal data for the following purposes:

• Understanding whether users have made purchases after having seen ads (view-through measurement)

• Counting the number of times users who have seen ads have proceeded to buy a product or service (conversion tracking); this is necessary to understand the overall return on investment of that ad

• Understanding browsing behaviours of aggregated users; this is necessary for us to improve and develop our solutions and services

• Ensuring ads are not shown to the same users more than a certain number of times (frequency capping)

• Counting the number of times ads have been seen (frequency measurement)

• Counting the number of times ads seen have been clicked on (click count); needed to understand which creative formats generate interest and engagement as we always want to serve relevant ads

• Understanding whether ads are seen by users (viewability measurement): this is needed to optimize advertising investment

• Checking for fraudulent behaviour (e.g. many clicks from the same IP address or other unusual patterns).

3.2 Business contacts data

If you are a business contact, e.g. if you work for a business partner, a client, an agency, a publisher, a data provider or other supplier, a prospect, a PR contact or influencer etc. we may hold some personal data about you. We will need that data in order to communicate with you, invoice and collect payments, make payments, and manage contracts and products and services that we offer or obtain. That data may include your name, business email address, billing address, office address, business phone numbers, title, expertise, employer etc. We would only hold this information where it is necessary for the intended purpose; e.g. it may be because you are a client (and we had to invoice you, offer our services to you etc.) or you may be a prospect and we would have obtained that information from exchanging emails or business cards, from public sources, or during meetings or events etc.

For UK and EU/EAA users:

Under the current law, we would not have to obtain consent in order to keep this data as we require it in order to manage our contract with your organization, or the data processing is necessary for our legitimate interests in managing and marketing our services or evaluating new services and supplies. Still you can exercise your data subjects’ rights in relation to that personal data and contact us as set out in Section 13.

Our retention policy for this data is as follows, i.e. we will delete your data:

• Three years after the last contact

• Five years after the end of the contractual relationship.

3.3. Employee data

If you are an employee of CSA, we suggest you refer to our HR policy and our employee handbook for your region. If you are applying for a position with CSA, we will provide the relevant data processing information in a separate candidate’s privacy notice.