For advertisers
Find answers about data protection, consent and your responsibilities.
A controller decides the purposes and essential means of processing. TradeTracker acts in that role where it makes those decisions for its services. Assess the role for each processing activity covered by GDPR. Working with an advertiser or publisher does not automatically create joint controllership for every activity.
Related glossary: GDPR
Legitimate interest requires a defined interest, necessary processing and a balancing assessment of its impact on individuals. Document that assessment. Using limited or pseudonymous data does not automatically establish this basis. Assess any separate consent requirements for cookies or similar technologies as well.
Related glossary: GDPR
You are generally a controller for purposes and essential means you determine, such as your own newsletter. Your role may differ for other processing. For activities covered by GDPR, identify who decides and who acts on another party’s instructions, then record the resulting responsibilities in appropriate agreements.
For processing covered by GDPR, identify the purpose and an appropriate lawful basis before processing. Bases include consent, contractual necessity, legal obligation and legitimate interest, each with its own conditions. A technical tracking choice does not determine the lawful basis or replace a separate assessment of cookie requirements.
Related glossary: GDPR, Consent management
That depends on their roles in the specific processing. A processor acting on a controller’s instructions requires processor terms; joint controllers need a different arrangement allocating their responsibilities. For processing covered by GDPR, align the actual data flows with the applicable agreement.
Related glossary: Advertiser, GDPR
An organisation may be a controller for one activity and a processor for another. A joint-controller arrangement, processor terms and privacy information therefore serve different purposes. When reviewing documents for GDPR-covered activities, consider the purpose, data and allocation of roles for that particular processing.
Related glossary: GDPR
Identify which party processes which data, for what purpose and in what role. Responsibilities for information, individual rights and any required consent should match that setup. Use the applicable publisher agreement and any additional arrangements as the starting point for your collaboration.
Identify the data the provider receives and whether it acts on another party’s instructions or determines its own purposes. Align instructions, security, further service providers and deletion arrangements with that role. A technical connection or data transfer alone does not make the provider a joint controller.
Explain clearly which data is used, why, the relevant parties or recipient categories, and how visitors can exercise their rights and choices. Describe your actual implementation and link to relevant privacy and cookie information. Check that any sample wording fits your data flows before using it.
Related glossary: Transparency, GDPR
Provide an accessible way to manage cookie preferences and withdraw any consent. Make sure your consent platform and tracking implementation communicate and apply those choices. Direct questions about TradeTracker’s processing to its official privacy information and contact route. Cookie preferences and privacy requests have distinct effects.
Related glossary: Consent management, Transparency
Cookie and similar-technology rules concern storing or accessing information on a device. GDPR requires a lawful basis when personal data is processed. Both can apply to the same setup. A valid GDPR basis does not remove a separate device-related consent requirement.
Related glossary: Consent management, GDPR
No. Technologies without cookies can still access device information or process personal data. Assess their operation, purposes and applicable rules for each implementation. S2S, first-party tracking and fingerprinting do not provide a general exemption from required choices or a visitor’s refusal.
Related glossary: Cookieless tracking, Consent management
Respect the applicable choice throughout the relevant measurement flow. What can still be recorded depends on the implementation and applicable rules. Do not automatically switch technology to continue the same refused processing. Check how consent or refusal is communicated to the next steps.
Related glossary: Consent management, Affiliate tracking
A choice on the publisher site does not automatically authorise different purposes or parties at the advertiser. The advertiser’s implementation must apply the relevant choice there. Check consent signalling and the separate processing activities before interpreting differences in measurement.
Related glossary: Consent management, Conversion path
Agree which click reference and transaction data are sent, for what purpose, for how long and under whose responsibility. Order and click references can be personal data when linkable to an individual. S2S changes how data is transported; data-use and security requirements still matter.
Related glossary: S2S tracking, Click ID
Where consent is required, visitors need a genuine choice and an accessible way to change it. For EU/EEA audiences, make refusal and withdrawal straightforward and apply the choice in the technology. Leaving the website is not a substitute for a valid choice. Assess the rules applying to your Indian and international audiences separately.
Related glossary: Consent management
Retention depends on the data type, purpose and any legal obligations. For a particular dataset, confirm the applicable period and deletion or anonymisation process under the current arrangements. Do not assume one universal period covers account data, transactions, security logs and backups.
Related glossary: GDPR
For your collaboration, confirm where data is processed, which providers are involved and whether access or transfers occur from other countries. Transfers outside the EEA may need additional safeguards when GDPR applies. The server’s location alone does not describe every data flow.
Related glossary: Cross-border e-commerce, GDPR
Access should match the user’s task and permissions. Pseudonymisation and masking can reduce exposure, but pseudonymous data can still be personal data. Data protection requires an appropriate combination of access control, security, purpose limitation and retention rules.
Related glossary: GDPR, Transparency
Use TradeTracker’s official privacy contact route and describe the data or service concerned. Relevant references can help locate records; share only what is necessary. TradeTracker assesses the request and any applicable legal exceptions. A deletion request does not automatically require immediate removal of every administrative record.
Related glossary: GDPR, Transparency
Each party must identify the processing for which it is responsible and apply appropriate measures. Responsibility does not begin or end solely at a domain change. Align data sharing, visitor information and responsibilities with the actual collaboration and document them appropriately.
Related glossary: Affiliate tracking, GDPR
Review appropriate technical and organisational measures, such as restricted access, protected transmission, logging and procedures for incidents and data requests. Ask for current security information for the relevant service. A general FAQ does not certify a particular audit frequency, storage location, certification or recovery guarantee.
Related glossary: GDPR, Transparency
Use the privacy information and contact options on the official TradeTracker website. Describe your question or request and identify the relevant service or collaboration. Do not include passwords, API keys or complete customer files. Your account manager can help identify the appropriate contact route.
Related glossary: GDPR
Ask Tarun for an explanation or a practical example. For account-specific help, contact your TradeTracker team.
Already a partner? Member login
