Privacy Statement

Statement about mobile devices and data privacy detailing our approach with respect to data we receive from our partners

LAST UPDATED: January 7, 2020

1. Introduction and Background

Advan Research Corporation, LLC., a U.S. corporation with offices at 545 5th Ave., Ste 316, New York, NY 10017 ("Advan, "we", "us") is committed to protecting and respecting privacy and the protection of information that may be used to identify you directly or indirectly ("Personal Data").

This Statement explains our approach with respect to data we receive from our partners, such as data aggregation services (the "Partners"). The technologies utilized by the Partners interact with mobile devices in the physical world through cellphone (aka "mobile") applications (collectively "Apps" and individually, "App"), GPS, mobile device Bluetooth connections, and Wi-Fi connections. In this Statement we also provide information on some of the methods available to individual users of mobile devices ("you" or "user") to limit the collection of data from or about their mobile devices by the Partners.

2. How Does Advan Obtain Data And What Data Do We Obtain?

We receive data from our Partners. Some of the data we receive from our Partners may constitute Personal Data under applicable laws.

The data provided by the Partners may include:

• IDFA and/or advertising identifier ("Advertising ID") or a hashed version of the same
• Location of the mobile device expressed as the latitude, altitude, and longitude of the mobile device and the derived identity of the location, such as a fastfood restaurant
• The timestamp of each observation, in some cases including the GMT offset of the timestamp
• The dwell time of a device in that location
• The county, state, country or other location information pertaining to the device's location
• Mobile device operating system and operating system version
• Mobile device make and model
• The name and version of an App
• Other metadata associated with the mobile device, such as network type, application data, and IP address
• The category of the App that collected data (i.e. casual gaming, weather, social media)
• GPS horizontal and vertical accuracy
• If the App was in active use or in the background when data was collected
• The speed at which the device was traveling
• If the device was being charged at the time of data collection
• The direction that the device was traveling
• If the device is connected to a WiFi or cellular network
• WiFi SSID (network name) or BSSID (MAC address for the router)
• Nearby SSID or BSSID and the signal strength

The data provided by our Partners does not include data that directly identifies you, such as your name, mobile phone number, or your email address.

We process the data provided by our Partners based on our legitimate interest of providing, improving, and analyzing our location-based products and services and, where appropriate or as required by law, based on your consent that you have provided to our Partners. Please be reminded that you have the right to withdraw your consent at any time. We balance our legitimate interests with the privacy interests of the users of mobile devices and incorporate privacy-enhancing technologies such as data aggregation and data retention limitations into our data processing platform.

3. What Do We Do With Partner-Provided Data And For What Purposes Is It Used?

We analyze and contextualize the data provided by our Partners for purposes of providing traffic, visitation and people-based movement measurements to our clients. Example use cases for the data are investing purposes, advertising, audience segmentation, people-based movement analytics, improving business decision making by better understanding of customer movement patterns, assisting municipalities in urban planning by enhanced understanding of movement patterns, or similar purposes that utilize location-analyzed data. We may also provide all or a portion of the data with certain clients for their own business purposes. The data may also be used for the purpose of improving and analyzing the various services provided by us.

4. In What Ways Can I Control the Collection of Mobile Device Data?

Data Collected Through Apps

a) Privacy Policies

First, please familiarize yourself thoroughly with the privacy policy of any App you download on your mobile device, checking in particular what types of data the App collects from or about your device(s). Do not download an App if you do not feel comfortable with the data collection practices described in the applicable privacy policy. If you have already downloaded such an app, delete it.

b) Device Settings

All major mobile device operating systems enable the users of mobile devices to control the types of data collected in and through Apps.

i) iOS

Apple instructions on how to control iOS device location settings can be found here

Apple instructions on how to limit ad tracking on iOS devices can be found here

For other privacy-related settings on iOS, please go to Settings from your mobile device"s home screen, and select "Privacy."

ii) Android

Android instructions on how to control device location settings can be found here

Android instructions on how to limit ad tracking on Android devices can be found here

Data Collected Via Bluetooth

All major mobile device operating systems enable the users of mobile devices to disable Bluetooth from functioning.

i) iOS

You can disable Bluetooth by going to "Settings" from your Device"s home screen; select "Bluetooth"; and turn Bluetooth off.

ii) Android

You can disable Bluetooth by going to the Settings app, then "Wireless and networks," where you can disable Bluetooth.

5. How Does Advan Disclose the Partner-Provided Data to Third Parties?

We may disclose the data provided by the Partner with third parties such as advertising networks, advertising publishers, and advertisers, research companies, data brokers, financial institutions, data analytics platforms, in accordance with the terms of the agreements, and only for the purposes of performing such agreements, that we have in place with such third parties. Such disclosures do not include any data that can directly identify a user of a mobile device, such as a name, mobile phone number, or an email address.

We may also disclose data provided by our Partners to:

• Our service providers, such as data storage providers;
• 
  
• Public authorities, such as law enforcement, if we are legally required to do so or if we need to protect our rights or the rights of third parties; and


• Our subsidiaries and affiliates; or a subsequent owner, co-owner or operator of our services and their advisors in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of our stock and/or assets, or in connection with bankruptcy proceedings, or other corporate reorganization.

6. How Do I Check Whether Advan Has the Advertising ID of My Mobile Device and Can I Block It From Further Use by Advan?

You can find your mobile device"s Advertising ID on iOS by going to Settings, General, and by clicking on "About", and on Android by going to Settings, then selecting "Ads". You can email Advan at privacy@advan.com, including the Advertising ID in your email, and request the blocking of the Advertising ID from further use or disclosure by Advan. If we have that Advertising ID, once we have blocked the Advertising ID, you will receive a confirmation email from us. Please bear in mind that the blocking of the Advertising ID by Advan following your request to that effect will not have an impact on any uses or disclosures that have already taken place. If you choose to reset your mobile device"s Advertising ID, you will have to request blocking of the Advertising ID from further use or disclosure by Advan once again. Please also bear in mind that any additional devices you may possess have other Advertising IDs. Finally, please be aware that the use of any of the measures enlisted in this Statement does not mean that no advertising will be directed at your mobile device.

7. Other Rights You Have

We take steps to help ensure that you able to exercise your rights regarding Personal Data about you in accordance with applicable law. If you would like to access, erase, or object to, or restrict the processing of Personal Data we collect, you may submit a request to privacy@advan.com. We will promptly review all such requests in accordance with applicable laws. Depending on where you live, you may also have a right to lodge a complaint with a supervisory authority or other regulatory agency if you believe that we have violated any of the rights concerning Personal Data about you. We encourage you to first reach out to us at privacy@advan.com, so we have an opportunity to address your concerns directly before you do so.

8. How Long Does Advan Keep The Data

As a matter of policy, Advan retains data received from our Partners as long as the data is needed for the purposes described above in Section 3 or as long as required by law.

Finally, unless we are legally required to do otherwise, if you submit a request in accordance with the instruction set out in Section 6 above, we only retain that Advertising ID for purposes of blocking it from further use and disclosure by Advan.

9. The EU General Data Protection Regulation (GDPR)

As of May 25, 2018, a new data privacy law known as the EU General Data Protection Regulation (or the "GDPR") will be in effect through the EEA countries and Switzerland. The GDPR requires Advan and any of our clients that receive data that may constitute Personal Data, to provide users with certain information about the processing of their "Personal Data." "Personal Data" is a term used in Europe that means, generally, data that identifies or can identify a particular unique user or device "“ for instance, names, addresses, cookie identifiers, mobile device identifiers, precise location data and biometric data.

To comply with the GDPR, we provide the below representations and information, which are specific to persons located in EEA countries or Switzerland; please refer to our policies above if you reside outside those geographical regions:

a. Legal grounds for processing your Personal Data

The GDPR requires us to tell you about the legal basis we"re relying on to process any Personal Data about you. The legal basis for us processing your Personal Data for the purposes set out in Section 3 above is typically because:

• You provided your consent. In order to provide our services that involve use of precise location information related to other Personal Data, (and to store and gain access to information stored on your device such as mobile advertising IDs), we rely on your consent. To obtain this consent, we rely on our own compliance steps and our partners" compliance steps, designed to ensure that consent is collected and passed on to partners, and to ensure that we only facilitate the collection of legally obtained data. We do this to fulfill our obligations under the ePrivacy Directive. We may choose to obtain consent in other cases as well, in which case we will adhere to applicable laws relating to such consent and its withdrawal.

The processing is in our legitimate interest. In some cases, we use legitimate interest as a legal basis for processing Personal Data. We rely on legitimate interest when we use Personal Data to maintain the security of our services, such as to detect fraud or to ensure that bugs are detected and fixed. We also rely on legitimate interest when we use our own customers" data to communicate with them about our Services.

• Contractual Relationships. Sometimes, we process certain data as necessary under a contractual relationship we have (such as our customer records and contact information); Legal Obligations. Finally, some processing of data may be necessary for us to comply with our legal or regulatory obligations.

b. Transfers of Personal Data

As Advan works with global companies and technologies, we may need to transfer your Personal Data outside of the country from which it was originally provided. For instance, we may transfer your data to third parties that we work with who may be located in jurisdictions outside the EEA or Switzerland, and which have no data protection laws or laws that are less strict compared with those in Europe.

When we transfer Personal Data outside of the EEA or Switzerland, we take steps to make sure that appropriate safeguards are in place to protect your Personal Data. In general, our data transfers of our Personal Data are safeguarded by European Standard Contractual Clauses and Data Processing Agreements where this is required by European Data Protection Law. Feel free to contact us at the contact information below for more information about the safeguards we have put in place to protect your Personal Data and privacy rights in these circumstances.

c. Personal Data Retention

Our data retention policies are explained in section 8 above.

d. Your Rights as a Data Subject

The GDPR provides you with certain rights in respect of Personal Data that data controllers hold about you, including certain rights to access Personal Data, to request correction of the Personal Data, to request to restrict or delete Personal Data, and to object to our processing of your Personal Data (including profiling for online ad targeting).

• Right to Access: If you wish to exercise your right to access Personal Data we process as a data controller, you may do so by requesting access through the e-mail address privacy@advan.com. When we receive your request, we will provide you with current, step-by-step instructions to follow in order to obtain access. As we are required to verify a requestor"s identity prior to providing Personal Data, we will assess requests to exercise certain data access rights on a case-by-case basis: in doing so, we consider (a) the difficulty of verifying whether data that we hold and data we have linked to it truly and solely belongs to the data subject making the request, along with (b) the potential adverse affects on disclosure of personal data to the wrong individual. Because such improper disclosure would likely adversely affect the privacy rights and freedoms of the data subject, we may limit the Personal Data we make available.

Please note that we will only grant requests for access for Personal Data for which we are a data controller, as explained further in sub-section (e) below. Where we act as a processor for one of our customers, we will refer your request to that customer. Please identify the customer your request refers to (if possible), to simplify this process.

• Right to Correct: If you wish to exercise your right to correct Personal Data, you may do so by contacting us at the contact information below.
• Right to Object to Processing or to Withdraw Consent: By using the device-based "opt-out" signals described in Section 6 of this Privacy Policy, you may withdraw consent for processing on which we rely on consent. If you do so, we will cease processing your Personal Data for purposes of our services within 30 days or less. We rely on our partners to notify us of these opt-out signals.
• Right to Erasure. You also have the right to obtain the erasure of Personal Data concerning you that we hold as a controller. The above opt-out process satisfies this right on a going forward basis. When a user opts-out through our partners (or through mobile device settings), and we receive this signal, we no longer collect Personal Data to provide our advertising services. We will also manually delete your Personal Data if you prefer that we do so; please contact us at privacy@advan.com for further instructions if you wish to exercise this right manually. Please note, however, that we may retain copies of certain Personal Data on inactive or back-up files, for our own internal and necessary purposes, such as auditing, accounting and billing, legal or bug-detection. We will in most cases delete such data within 60 months, absent a compelling reason to retain it.
• Right to Lodge Complaints. You have the right to lodge a complaint with a supervisory authority. However, we hope that you will first consult with us, so that we may work with you to resolve any complaint or concern you might have.

e. Advan as a data controller and a data processor

EU data protection law makes a distinction between organisations that process Personal Data for their own purposes (known as "data controllers") and organisations that process Personal Data on behalf of other organisations (known as "data processors"). As noted above, we are not always a data controller of the data in our possession, but are sometimes a data processor for other companies such as our customers. In such cases, we may direct your inquiry to the relevant data controller, since data controllers are the ones with primary responsibility for your Personal Data.

f. Sharing of Personal Data

Advan may share Personal Data with its trusted partners (i.e., the companies for whom it is obtaining consent and to whom it directly provides Personal Data) for the same purposes described in this Privacy Policy.

10. Changes to This Statement

From time to time we may change this Statement. You can tell when changes have been made to the Statement by referring to the "Last Updated" legend on top of this page. Please review this Statement regularly to ensure that you are aware of any changes.

11. Questions or Concerns?

Should you have any questions regarding this Statement or your privacy, please contact our Data Protection Officers at privacy@advan.com. We seek to promptly resolve any questions or concerns you may have.