GDPR & UK GDPR PRIVACY NOTICE

Last Updated: June 2026

This Notice supplements the UDM Privacy Policy and applies to individuals located in the European Economic Area (EEA), United Kingdom, and Switzerland.

Controller Status

For advertising, monetization, fraud prevention, reporting, analytics, and related business operations, UDM acts as an independent Controller with respect to the personal data it processes and determines the purposes and means of such processing.

Publishers, advertisers, and other partners may separately act as Controllers for their own independent processing activities.

Categories of Personal Data:

UDM may process:

IP addresses
Cookie identifiers
Device identifiers
Identity solution identifiers
Browser and device information
Advertising interaction data
Fraud detection and security signals
General location information derived from IP address

Data Sources:

UDM generally receives personal data from publishers, advertising technology partners, identity solution providers, and other authorized business partners rather than directly from end users.

Purposes of Processing:

UDM processes personal data to:

Deliver advertising
Measure advertising effectiveness
Detect fraud and invalid traffic
Ensure platform security
Generate reporting and analytics
Improve services
Comply with legal obligations

Legal Bases for Processing:

Consent

Where required by applicable law, UDM relies upon consent and transparency signals communicated through publisher Consent Management Platforms (CMPs) and other approved consent mechanisms for advertising and related activities.

Legitimate Interests:

UDM relies upon legitimate interests for:

Fraud prevention
Invalid traffic detection
Security monitoring
Network protection
Service performance monitoring
Operational reporting

Contractual Necessity:

Certain processing activities may be necessary to fulfill contractual obligations to publishers, advertisers, and business partners.

UDM participates in the IAB Europe Transparency & Consent Framework (TCF) and is registered as Vendor ID 159.

Where required by applicable law, UDM receives and honors consent and transparency signals communicated through TCF-compliant Consent Management Platforms.

UDM processes personal data only in accordance with the permissions and legal bases communicated through applicable consent strings and publisher configurations.

Recipients of Personal Data:

Personal data may be shared with:

Advertising exchanges
Supply-side platforms (SSPs)
Demand-side platforms (DSPs)
Identity solution providers
Fraud detection and verification providers
Measurement and analytics providers
Service providers supporting UDM operations

International Transfers:

Where personal data is transferred outside the EEA, United Kingdom, or Switzerland, UDM relies on legally recognized transfer mechanisms and appropriate safeguards, including the European Commission Standard Contractual Clauses (SCCs), the UK Addendum or UK International Data Transfer Agreement (IDTA), and other applicable transfer safeguards where required by law.

Retention:

Raw log and reporting data, including IP addresses and device identifiers used for fraud detection, security monitoring, operational reporting, and troubleshooting, is generally retained for up to fifteen (15) days unless a longer retention period is required for investigations, legal compliance, contractual obligations, or dispute resolution.

Your Rights:

Subject to applicable law, individuals may have the right to:

Access personal data
Correct inaccurate information
Request deletion
Restrict processing
Object to processing
Request data portability
Withdraw consent where processing is based on consent

Complaints:

Individuals may lodge a complaint with their local data protection authority or supervisory authority if they believe their personal data has been processed in violation of applicable law.

Contact:

Privacy inquiries or requests regarding this Notice may be directed to:

privacy@underdogmedia.com