A. Who is the data controller?

The processing of personal data in connection with the services described above is carried out by
LOCALA MENA LLC-FZ (“Locala MENA”), a Limited Liability Company (Free Zone) registered under
number 107048, with registered office at Dubai Media City Building 1, Office 108, Dubai, United Arab Emirates,
acting as the data controller.

↑ Back to contents

B. Information we process

We process data about you that is associated with the mobile advertising identifier of your device. If you have
given consent, our partners provide us with information collected via your mobile advertising identifier
(such as IDFA for Apple or AAID for Android) when you use mobile apps or websites. Your consent is obtained by
the publisher operating the websites and apps you use.

• Consent data: the consent string used to verify that you authorize us to process your data.
• Indirect identification data: MAID (mobile advertising ID), IP address.
• Browsing data: information about the devices or browsers used (device type, operating system, device language, screen size, device time and time zone) and information about ads viewed or clicked (e.g. impressions, clicks).
• Precise geolocation data: latitude/longitude of the device; we may associate this with specific zones or locations (e.g. around a client’s store) and infer the presence of a user within those areas at a given time.
• Tracking tools: pixels or similar tools used by us and our customers or partners, where you have consented.

This data does not directly identify you. We do not use your name, postal address, or similar directly identifying data.

In accordance with Article 1 of the UAE PDPL, we do not collect Sensitive Personal Data
(such as religious beliefs, racial origin, or health data) for advertising purposes.

↑ Back to contents

C. How do we use the information?

Under Articles 5 and 6 of the UAE PDPL, the primary legal basis for our processing of personal data for advertising purposes is consent.

C.1 Dissemination of targeted or non-targeted advertisements

C.2 Audience creation

C.3 Measurement of in-store visits

C.4 Trend analysis

C.5 Selection of premium advertising inventories

C.6 Compliance with our legal obligations

The retention periods above do not preclude the exercise of the rights in Section E, insofar as they can be legally exercised.

↑ Back to contents

D. Information sharing

1. Data recipients

Locala MENA may give access to your data to the following categories:

• Locala MENA staff who process your data as part of their duties;
• Locala Group entities, including subsidiaries and affiliates;
• Partners and service providers, including performance measurement providers;
• SSP platforms involved in RTB processes;
• Clients (advertisers or media agencies) acting as independent controllers under their own privacy policies;
• Authorized third parties under law or regulation, and our advisors;
• In corporate transactions (e.g. merger/acquisition), potential buyers or investors under contract.

2. International transfers

As an international group, data may be transferred outside the UAE. In such cases, Locala MENA ensures compliance
with Articles 22 and 23 of the UAE PDPL by ensuring that the receiving jurisdiction provides an adequate level of
protection or that appropriate safeguards (such as standard contractual clauses) are in place.

Some hosting servers are located in the United States. Our hosting provider is Amazon Web Services (AWS),
certified under the Data Privacy Framework (DPF).

If we engage other processors or partners outside the MENA region, we do so only after adopting appropriate
measures to ensure an equivalent level of protection and security.

For questions, see I. Contact us.

↑ Back to contents

E. Your rights

1. User rights under applicable regulations

You may exercise the following rights by contacting us using the details in I. Contact us:

• Access: obtain free access, a copy of your data, and information about how it is processed.
• Rectification: request correction of your personal data.
• Restriction: request restriction where (i) you contest accuracy, (ii) processing is unlawful and you oppose erasure, (iii) processing is no longer necessary for us but needed for legal claims, or (iv) you object and overriding grounds are being assessed.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time.
• Objection: object to processing based on our legitimate interests, subject to compelling legitimate grounds or legal claims.
• Portability: for data processed on the basis of contract performance.
• Deletion/erasure: where processing is no longer necessary, consent is withdrawn, objection is raised, processing was unlawful, or erasure is required by law.

To facilitate handling, please include “Exercise of rights relating to my personal data” in the subject line.
We will respond within one (1) month of receipt. If your request is imprecise or incomplete, we may ask for additional information.

2. Behavioral advertising & mobile advertising identifier

We use information to help our customers deliver advertising that is of interest to users (targeted advertising).
To learn more or opt out of certain third-party behavioral advertising, visit
digitaladvertisingalliance.org.

Mobile advertising identifiers are unique to devices (e.g. AAID for Android; IDFA/IFA for Apple).

Manage preferences:

• iOS: Settings → Privacy & Security → Apple Advertising → disable “Personalized Advertising”. To manage app data access, see Apple’s “Manage sharing and access”.
• Android: Settings → Google → Ads → “Delete ad ID”. To manage app data access, adjust app permissions.

Following these steps will stop partners from collecting data via your mobile advertising ID and stop our ads from being displayed on your mobile device.
You can also contact us via this form or via the details in I. Contact us to withdraw consent previously given.

To locate your device ID:

• Android: Settings → Google → Ads.
• iOS: use a third-party app such as “My Device ID by AppsFlyer”.

↑ Back to contents

F. Adherence to the IAB Europe Transparency & Consent Framework (TCF)

Locala MENA is a member of IAB Europe’s TCF and complies with its specifications and policies. In line with TCF
principles, we automatically collect information about mobile devices, subject to prior end-user consent in the EU.
That consent is collected by partner publishers and transmitted to us as a consent string in accordance with TCF standards.

Locala MENA is identified under number 119 within the TCF.

↑ Back to contents

G. Specific provisions applying to residents of California (USA)

• Rights under the CCPA: request access and details on practices; request deletion; opt out of the sale of personal data; and no discrimination for exercising privacy rights.
• Disclosure duties: categories collected, business/commercial purposes, sources, categories disclosed or sold in the last 12 months, and categories of third parties are described in this Policy.
• Deletion: ability to request deletion of personal data.
• Non-discrimination: we do not discriminate for exercising privacy rights.
• Sales of data: Locala MENA does not sell your personal data. Where we act as a service provider for publishers, purposes are limited accordingly.

↑ Back to contents

H. Changes to this Policy

We may modify this Policy. We will inform you of material changes and encourage you to review it regularly.

↑ Back to contents

I. Contact us

Locala MENA has a Data Protection Officer (DPO).

For questions about this Policy, contact us:
• Email: privacy@asklocala.com
• Post: LOCALA – Attn: DPO, 55 rue d’Amsterdam, 75008 Paris, France

↑ Back to contents