LEGAL & PRIVACY
Privacy Policy
Last updated: [CONFIRM DATE OF LAST SUBSTANTIVE UPDATE]
Draft for business verification. Replace bracketed prompts and confirm that each section reflects actual processing before publication.
1. Who we are
This website is operated by MATICONE LTD ("Vsmate", "we", "us" or "our"). Our business address is shown on the Contact page. For the activities where we determine the purposes and means of processing personal data, we act as a controller.
2. Scope
This policy covers personal data collected through vsmate.com and business communications. It also summarises data considerations for our programmatic display advertising activities. Roles and obligations for campaign data may vary by contract and processing activity.
3. Data we may process
Depending on interactions and actual services, data may include business contact details; messages, contracts, support and billing correspondence; website technical data such as IP address, browser/device details, access logs and security events; and advertising transaction information such as bid-request fields, online identifiers, IP address, device/browser signals, placement/context, timestamps, bid prices or campaign delivery information.
Confirm exactly which fields the production system receives, stores, logs, enriches, shares or reports; whether identifiers are personal data; and whether special-category or sensitive data could ever be received.
4. Purposes and lawful bases
Where UK GDPR applies, we identify a lawful basis for each processing purpose. Depending on the activity, this may include performing a contract or taking pre-contractual steps, complying with legal obligations, legitimate interests balanced against individuals' rights, or consent where required.
Map each actual purpose to its lawful basis, including campaign execution, security/fraud controls if used, measurement/reporting, support, billing, and website analytics or marketing. This list does not confirm that every listed tool or purpose is used.
5. Programmatic advertising and RTB
Vsmate operates a DSP/RTB platform for programmatic display advertising and connects with multiple third-party exchanges and SSPs. Depending on the integration, participants may process bid requests, campaign settings, online identifiers, device/browser information, ad opportunity details, bids and delivery records. Data may be shared with the relevant supply partner, advertiser or service provider to evaluate or execute a bid and support campaign reporting, where permitted by contract and law.
Document actual SSP/exchange data flows and recipients; identify Vsmate's controller/processor role for each flow; confirm consent/TCF or other signals and how they are respected; state whether bid data is used for any secondary purpose; and confirm whether partner names can be disclosed.
6. Cookies and similar technologies
Essential technical storage may be used where necessary to operate and protect the website. Non-essential analytics, advertising or tracking technologies should not be activated unless assessed and any required consent is obtained.
Inspect the deployed site, hosting and any third-party embeds for cookies, analytics, pixels and logs. If non-essential technologies are used, provide a vendor/purpose list and implement appropriate consent controls before activation.
7. Sharing and service providers
Depending on actual activity, data may be shared with relevant advertisers, exchanges/SSPs, hosting and IT providers, email providers, professional advisers, payment/accounting providers and public authorities where legally required. This is a conditional list, not confirmation that every category is used.
Confirm: actual vendors, their roles and locations, contracts, sub-processors and onward transfers.
8. International transfers
Personal data may be processed outside the UK depending on the locations of service providers and advertising partners. Where required, appropriate transfer safeguards will be implemented under applicable data protection law.
Confirm: where data is stored/accessed/transferred and whether adequacy regulations, the UK IDTA or UK Addendum and transfer risk assessments apply.
9. Retention
We retain personal data only as long as reasonably necessary for the relevant purpose and applicable legal, accounting, security and contractual requirements.
Confirm and specify actual periods: enquiry emails, contracts/invoices, security logs, bid requests/logs, identifiers, campaign reports and backups; also document deletion and backup expiry.
10. Security
We use technical and organisational measures proportionate to the nature of the data and the risks. Specific controls must be described accurately.
Confirm implemented controls: access restrictions, authentication, encryption, logging, incident handling, backups, vulnerability management and supplier reviews. Remove any control that is not in place.
11. Individual rights
Depending on applicable law and circumstances, individuals may have rights to access, rectify, erase or restrict personal data, object to certain processing, request portability, and withdraw consent where processing relies on consent. Individuals may complain to the UK Information Commissioner's Office (ICO). Rights are subject to conditions and exemptions.
Contact [email protected]. We may need to verify identity and clarify a request before responding.
12. Children
Our business services are intended for business and advertising use, not children.
Confirm: whether the platform can receive or target data associated with children and which inventory/campaign controls apply.
13. Changes
We may update this policy to reflect changes in services, data practices or law. The "Last updated" date should reflect the latest substantive update. A separate "Last reviewed" date may be shown only if it accurately records a review, even where no content changed.
14. Contact
Privacy requests: [email protected]. General enquiries: [email protected].
Confirm the date, data inventory, lawful bases, roles, SSP/exchange flows, consent, vendors, cookies, retention, transfers, security and request-handling process. This draft is not legal advice; obtain qualified review against the live business and current law.