Privacy Policy

Yule operates as a Demand-Side Platform (DSP), providing digital advertising solutions through optimized technologies. Our real-time bidding (RTB) system enables advertisers to bid for ad placements when a webpage loads, an application is used, or another digital media source is accessed. We do not directly interact with End Users visiting our Customers' websites or apps; instead, the Personal Information processed by Yule facilitates our RTB technology and the measurement of advertising delivery. The information we process is described further below.

We collect personal data from you and your End Users as required by law or as necessary to perform our contractual obligations. Failure to provide certain information may limit our ability to deliver the Services.

Data we collect from Customers and Visitors

• Account Information: Name, company, role, work email, phone number, password (hashed), and any other information you provide when registering, requesting a demo or otherwise communicating with us.
• Usage and Technical Information: IP address, browser type, operating system, referring URL, time-stamps, and information about your interaction with our Site collected automatically through server logs and analytics tools.
• Cookie & Similar Technologies: We use first-party cookies and similar technologies to operate the Site, remember preferences, monitor performance and improve user experience. See Section 3 for details.

Data we process about End Users

• Device Identifiers: Mobile advertising identifiers (e.g., GAID, IDFA), cookie IDs, device IDs and other identifiers assigned by Publishers, Advertisers or our Partners.
• Device Information: Device model, operating system, screen size, network connection type, system language, time zone and country/region.
• Network Information: IP address (in some jurisdictions truncated or masked), user-agent string and approximate ISP/carrier information.
• Location Information: Approximate location derived from IP address, and where permitted, more precise latitude/longitude passed in bid requests subject to End User consent.
• Bid Request Data: Information passed by publishers and supply partners in real-time bid requests, including page URL, app bundle ID, ad slot, content category and timestamp.
• Interaction Data: Ad impressions, viewability, clicks, post-click events and post-install conversion signals reported by our Customers or measurement partners.

We do not knowingly collect sensitive categories of personal data (such as racial origin, political opinions, religious beliefs, health, genetic or biometric data) and we instruct Customers and Partners not to send such data to our platform.

Cookies are small text files placed on your device when you visit a website. We respect your privacy when you visit our website and use cookies primarily to operate the Site and improve your experience. You can manage your cookie preferences at any time via your browser settings; please note that disabling certain cookies may impair Site functionality.

Categories of cookies we use on our Site

• Strictly necessary cookies: Required for core functionality such as language preference, session management and security.
• Performance / analytics cookies: Help us understand how visitors interact with the Site so we can improve content and performance. We use aggregated, non-identifying analytics by default.
• Functional cookies: Enable enhanced features and remember choices you make on the Site.

When we collect consent for non-essential cookies, we do so through an in-page consent banner. You may withdraw consent at any time by adjusting your preferences.

We process personal data for the following purposes:

• Service delivery: Operating the Yule platform, executing RTB transactions, delivering campaigns and serving advertising creatives.
• Measurement and analytics: Measuring ad performance (e.g., impressions, viewability, conversions) and providing reporting to our Customers.
• Personalisation: Selecting and personalising ads based on inferred or declared interests, subject to applicable consent requirements.
• Frequency capping: Limiting the number of times the same ad is shown to a user.
• Fraud prevention & security: Detecting invalid traffic, bots, and other malicious activity, and ensuring the security and integrity of our platform.
• Customer communications: Responding to enquiries, providing support and sending service updates.
• Legal & compliance: Complying with applicable laws, court orders and regulatory requirements; defending our legal rights and enforcing our agreements.

Where required by applicable law, we rely on one or more of the following legal bases to process personal data:

• Consent: For the use of cookies and the processing of personal data for personalised advertising and measurement, where consent is required.
• Performance of a contract: Where processing is necessary to provide the Services requested by our Customers.
• Legitimate interests: For purposes such as ad delivery, frequency capping, measurement, fraud prevention, security and business operations, balanced against your fundamental rights and freedoms.
• Legal obligation: Where processing is necessary to comply with our legal and regulatory obligations.

Where we rely on consent, you may withdraw it at any time using the mechanism described in Section 10.

We share personal data only as necessary to operate the Services. Specifically:

• Customers and their service providers: Advertisers, agencies and their authorised processors receive campaign performance data attributable to their campaigns.
• Supply-side and ad exchange partners: Such as Google Authorized Buyers, Yandex Ad Exchange and other RTB partners, to facilitate the buying of ad inventory.
• Measurement and verification providers: Third-party measurement, verification and brand-safety providers engaged by us or our Customers.
• Service providers: Cloud hosting, analytics, customer support, security and audit providers that act as our processors under written agreements.
• Affiliates: Members of our corporate group that assist with operating the Services under appropriate safeguards.
• Legal and regulatory authorities: Where we are required by law or to protect our rights, property, safety, or that of our users.
• Business transfers: In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of company assets or transition of service to another provider, subject to commitments to honour this Policy.

We do not sell personal data in exchange for monetary consideration. Certain data sharing for cross-context behavioural advertising may, in some jurisdictions, fall within the definition of a "sale" or "sharing"; see the supplemental notices in Sections 12-15 for jurisdiction-specific rights.

Yule is headquartered in Hong Kong and operates internationally. Personal data may be transferred to, stored in, and processed in jurisdictions outside the one in which you reside, including jurisdictions whose data-protection regimes may differ from yours.

Where we transfer personal data internationally, we put in place appropriate safeguards, which may include Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO, equivalent clauses required by other regulators, intra-group data-transfer agreements, or reliance on recognised adequacy decisions. You may contact us at the address in Section 17 to request further details about applicable safeguards.

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include encryption in transit, access controls, network segmentation, monitoring, and regular reviews of our security practices. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to comply with our legal, accounting or reporting obligations. End-User device identifiers and bid-request data are typically retained in identifiable form for no longer than 13 months, after which they are deleted or anonymised, except where a longer retention period is permitted or required by law.

Subject to applicable law, you and your End Users have certain rights regarding personal data, which may include:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request that we correct inaccurate or incomplete data.
• Erasure: Request the deletion of personal data in certain circumstances.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing carried out under our legitimate interests, including profiling and personalised advertising.
• Portability: Receive a copy of personal data in a structured, commonly used and machine-readable format.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.
• Complain: Lodge a complaint with the data-protection authority in your jurisdiction.

To exercise any of these rights, please contact us at privacy@yule.global. We may need to verify your identity before responding.

You can limit interest-based advertising delivered through our platform in several ways:

• iOS devices: Go to Settings → Privacy & Security → Tracking and disable "Allow Apps to Request to Track"; or Settings → Privacy & Security → Apple Advertising and turn off "Personalised Ads".
• Android devices: Go to Settings → Google → Ads and turn on "Opt out of Ads Personalisation" (older versions) or delete the advertising ID (newer versions).
• Browsers: Adjust your browser cookie settings, or use industry tools such as the NAI Opt-Out Page or the DAA Opt-Out Page (where available in your region).
• Email: Send an opt-out request to privacy@yule.global; please include the device identifier or browser cookie ID where possible to help us locate the relevant record.

Our Services are not directed to children under the age of 13 (or the equivalent minimum age in the relevant jurisdiction). We do not knowingly collect personal data from such children. If we become aware that we have collected personal data from a child without verified parental consent, we will promptly delete it. If you believe that a child has provided personal data to us, please contact us at privacy@yule.global.

This section applies to data subjects whose personal data is collected or processed in connection with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO").

Data User

YULE INTERNATIONAL CO., LIMITED acts as a "data user" under the PDPO with respect to personal data collected through our Site, our Customer relationships and our advertising platform.

Purpose of Collection

We collect and use personal data for the purposes described in this Policy, in particular Section 4 (How We Use Your Data) and Section 1 (Our Services).

Your PDPO Rights

Under the PDPO, you have the right to: (a) request access to your personal data held by us; (b) request correction of any personal data that is inaccurate; and (c) be informed of the kinds of personal data held and the main purposes for which it is or is to be used. You may exercise these rights by emailing privacy@yule.global. We may charge a reasonable fee to process data-access requests in accordance with the PDPO.

This section applies to data subjects located in the European Economic Area (EEA), the United Kingdom and Switzerland, and supplements our general Privacy Policy in accordance with the General Data Protection Regulation ("GDPR"), the UK GDPR and the Swiss Federal Act on Data Protection ("FADP").

Controller

YULE INTERNATIONAL CO., LIMITED, registered in Hong Kong, is the data controller in respect of the processing of personal data for selecting and delivering programmatic advertising. For advertising delivered on behalf of our Customers using Customer-provided data, we may act as a processor of our Customer (the controller).

Legal Basis for Processing

• Consent (Art. 6(1)(a)): For cookies, device identifiers and personalised advertising and measurement, where consent is required. We rely on consent signals collected and transmitted to us by publishers and consent-management platforms ("CMPs"), including those compatible with the IAB Europe Transparency & Consent Framework ("TCF"), where applicable.
• Legitimate interests (Art. 6(1)(f)): For fraud detection and prevention, security, debugging, ad-delivery infrastructure and reporting in aggregate.
• Contract / Legal obligation: Where processing is necessary to perform a contract or comply with a legal obligation.

International Transfers

Where personal data is transferred from the EEA, UK or Switzerland to Hong Kong or other third countries, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or other valid transfer mechanisms recognised by the relevant supervisory authority.

Retention

Pseudonymised data such as IP addresses, device identifiers, browsing behaviour and approximate location is generally retained for no longer than 13 months from the date of collection, after which it is deleted or anonymised, unless a longer retention period is required or permitted by law.

Your GDPR Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing carried out under our legitimate interests, including profiling. Where processing is based on consent, you may withdraw it at any time via the CMP shown on the publisher's website or app, or by contacting privacy@yule.global. You also have the right to lodge a complaint with your local supervisory authority.

TCF Participation

Yule's participation in the IAB Europe Transparency & Consent Framework (TCF) is currently under application. Our TCF Vendor ID will be published in this Policy once registration is finalised.

This section applies to data subjects located in the People's Republic of China (excluding the Hong Kong SAR, Macao SAR and Taiwan) and supplements our general Privacy Policy in accordance with the Personal Information Protection Law ("PIPL").

Personal Information Handler

YULE INTERNATIONAL CO., LIMITED acts as a "personal information handler" under the PIPL with respect to personal information processed via our advertising platform.

Categories of Information and Purposes

We process the categories of data described in Section 2 for the purposes described in Section 4. We do not process "sensitive personal information" as defined by the PIPL, and we instruct our Customers and Partners not to provide such information to our platform.

Cross-Border Transfer

When transferring personal information of individuals in mainland China outside of mainland China, we adopt one or more of the safeguards permitted by the PIPL, which may include execution of the Standard Contract issued by the Cyberspace Administration of China ("CAC"), a CAC-recognised security assessment, or another lawful basis available at the time of transfer. Before any cross-border transfer subject to consent, we will provide a separate notice and obtain separate consent where required.

Your PIPL Rights

You have the right to access, copy, correct, supplement, delete, restrict, transfer and obtain an explanation of how we process your personal information, and to withdraw your consent. You may also request that we cease automated decision-making and profiling that has a significant impact on you. To exercise these rights, please contact privacy@yule.global.

This section applies to California residents and supplements our general Privacy Policy in accordance with the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA").

Categories of Personal Information Collected and Disclosed

In the preceding 12 months, we have collected the categories of personal information described in Section 2 (e.g., identifiers, internet or network activity information, geolocation data and inferences drawn from any of these) and disclosed them for the business and commercial purposes described in Section 4 to the categories of recipients listed in Section 6.

Sale / Sharing of Personal Information

We do not sell personal information for monetary consideration. Certain disclosures of identifiers and internet activity for cross-context behavioural advertising may, however, fall within the definition of "sale" or "sharing" under the CCPA/CPRA. California residents have the right to opt out of such sharing.

Your California Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising.
• Right to Limit Use of Sensitive PI: Limit our use and disclosure of sensitive personal information to those purposes permitted by law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

To exercise your rights, please contact privacy@yule.global. We will honour valid Global Privacy Control (GPC) signals as opt-out requests for cross-context behavioural advertising where technically feasible.

We may update this Policy from time to time. When we make material changes, we will notify you by posting a prominent notice on our Site or by other appropriate means before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Services after the updated Policy takes effect constitutes your acceptance of the revised Policy, to the extent permitted by applicable law.

If you have any questions or concerns about this Policy, or if you wish to exercise any of your rights, please contact us:

• Email: privacy@yule.global
• Data Protection Officer: dpo@yule.global
• Postal: YULE INTERNATIONAL CO., LIMITED, Unit 1508, 15/F, Argyle Centre Tower 2, 625 Nathan Road, Mongkok, Hong Kong

If you believe that we have not adequately addressed your concern, you may have the right to lodge a complaint with the data-protection authority in your jurisdiction.