Privacy Center

a) Who we are:

This Site Visitor Policy (“Site Visitor Policy”) applies to Teads Holding Co. (formerly Outbrain Inc.), a corporation registered in Delaware (USA) whose main office is in New York; and its affiliated subsidiaries (collectively, “Outbrain,” or “we”, “us“, “our”). We operate in various offices around the world and we partner with publishers and marketers across the globe. For the purposes of data protection laws  in the UK and  European Territories, the controller of your data is Outbrain UK Limited.

Data Subjects can exercise their rights with either Outbrain or its partners (advertisers and publishers). You can action your rights via our self-serve portal, the Interest Profile or you can reach out to us via the contact details in Section 11 of this User Privacy Policy. Outbrain handles these requests fairly, promptly, and in line with applicable timeframes. Outbrain maintains records of rights requests and related actions to ensure transparency and accountability in safeguarding Personal Data.

Individuals who interact with legacy Teads technology can exercise their rights via the Teads Privacy Policy.

b) What we do:

Outbrain operates a two-sided marketplace, forming an end-to-end advertising platform with direct media owner and advertiser relationships. Outbrain is an intermediary in the online advertising industry, connecting publishers all over the world. To achieve this, we enter into agreements with:

• media partners who want to recommend relevant content to their readers ;
  and
• advertising partners who want readers to view their content .

c) How to contact us:

We regularly review our compliance with this Site Visitor Policy. Questions, comments and requests regarding this Site Privacy Policy are welcomed and should be addressed in the first instance to ob-privacy@teads.com.

If Outbrain does not satisfactorily answer your questions or concerns, you may also contact our Data Protection officer at ob-dpo@teads.com or your supervisory authority or advice, support or complaints, including the Information Commissioner’s Office if you are in the UK.

• We adhere to the Self-Regulatory Principles set forth by the Digital Advertising Alliance (DAA) and the European Interactive Digital Advertising Alliance (EDAA);
• We are members in good standing of the Network Advertising Initiative (NAI), an association dedicated to responsible data collection and its use for digital advertising. We also adhere to the NAI Code of Conduct. Outbrain also adheres to the Interactive Advertising Bureau’s (IAB) Self-Regulatory Principles for Online Behavioral Advertising, and the IAB Europe TCF vendor ID; and
• We are also TAG Brand Safety Certified here.

a) We may process your personal information for the following purposes: 

• to understand what services on our Sites interest you;
• to improve the user experience and to ensure that content is presented in the most effective manner for you and for your device;
• to send you newsletters and marketing communications, and to measure their effectiveness (for example, tracking open and click-through rates) in order to improve the relevance of our communications — only where you have given your consent. This will be processed in accordance with our marketing notices which will be provided to you at the point of collection;
• for system administration purposes and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to notify you of any changes to our services; and
• to comply with applicable laws and regulations.

Please note: if you apply for a role at Outbrain via our website, your application and any personal data you submit (such as your CV, name, contact details and work history) will be processed in accordance with our separate Candidate Privacy Notice, which will be provided to you at the point of application. This Site Visitor Privacy Policy does not govern the processing of candidate data.     

b) In order to do this, we collect and process your personal data when you:

• visit our Sites (including when you sign up to receive information from us);
• when you sign up to receive more information about our services (including newsletters) and when you subsequently interact with those communications (for example, by opening an email or clicking a link within it);
• contact our customer service centres or request information from us in any other way; or
• communicate with us via social networking websites, third party apps or similar technologies.

c) We collect and process the following personal data: 

• contact details (such as your name and email address);
• your marketing preferences and newsletter subscription status;
• email engagement data, such as whether you opened our email communications or clicked on links within them, collected via tracking pixels in our emails (where you have consented to receive our newsletters);
• IP address; 
• user agent data: device type (e.g., iPhone), browser type (e.g., Chrome), operating system (e.g., iOS); 
• the pages visited on our Sites (e.g., the Outbrain “About” page); 
• the time of visit (and corresponding time zone); and 
• referring URLs and other information normally transmitted in HTTP requests (e.g. information telling us how you arrived on our Sites). 

d) Legal basis for processing

We will only process your personal information where we have a legal basis to do so. Under the GDPR, we are required to identify a specific legal basis for each processing purpose. The legal basis will depend on the purposes for which we have collected and used your personal information. In almost every case the legal basis will be one of the following:

• Consent: In the EEA and UK, where you have provided your consent to receive certain marketing or newsletters from us, or for the placement of non-essential cookies on your device. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link at the bottom of any marketing email we send you or opting out via the consent management platform accessible to EEA and UK site visitors on outbrain.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and operate effectively — for example, to provide and improve our website, ensure website security, and analyse how our Sites are used. We have assessed that our legitimate interests are not overridden by your rights and freedoms.
• Compliance with law: Where we are subject to a legal obligation and need to use your personal information in order to comply with that obligation.

We use the following categories of cookies on our Sites: (i) Strictly necessary — essential for the website to function and cannot be disabled; (ii) Analytics/performance — help us understand how visitors interact with our Sites (e.g. Google Analytics); (iii) Functionality — remember your preferences and settings; (iv) Marketing/targeting — used to deliver relevant content about our services to you. Please see our Cookie Table, which is updated from time to time, for a full list of first and third party cookies and their individual retention periods.

Our Terms of Use govern your use of our Sites and apply to you when you interact with our Sites. You can stop using our Sites at any time. If you do, you may also want to remove any cookies that we have placed on any device used to access our Sites and you can do this via your browser. If during your use of our Sites you provided your email address, any email you receive from Outbrain includes an “unsubscribe” option. 

For Site Visitors in the European Territory and/or the UK, Outbrain has implemented a consent management platform (powered by OneTrust) on our Sites that provides you with the opportunity to consent, or not consent, to cookies and similar tracking technologies. Upon accessing our Sites, you will see a banner in the centre of the page with information about the cookies we use. You may click the banner to reject any cookies (for example, performance cookies or targeting cookies) that are not strictly necessary cookies (as defined in the Cookie Table). By pressing “I Accept” on the banner you are indicating your acceptance to cookies and similar tracking technologies that require consent. If you have provided your consent for the use of cookies, you may withdraw your consent at any time by clicking the Cookie button on the left-hand side of your page.

In respect of all other Site Visitors not located in European Territories/the UK, we rely on our legitimate interest for processing any personal data however, this does not preclude non-European Territory Site Visitors from withdrawing consent at any time via the Cookie button referenced above.

If you are located in the European Territories/the UK, please see Section 8 below which outlines other rights that you may exercise.

a) Security

Outbrain has a dedicated security team. We maintain security controls over the personal data we collect. Please see our security standards for more information.

Please remember that, unfortunately, the transmission of information via the internet is never completely secure. A common Internet scam is known as “spoofing” or “phishing.” This occurs when you receive an email from what appears to be a legitimate source requesting personal data from you. Please be aware that we will not send you any emails requesting you to verify credit card, bank information, or any other personal data. If you ever receive an email that appears to be from us requesting such information from you, do not respond to it, and do not click on any links appearing in the email. Instead, please forward the email to us at legal@teads.com as we will investigate instances of possible Internet fraud.

Our Sites contain links to other websites that we do not own or operate. We do not control, recommend or endorse the content, products, services, privacy policies or practices of these third-party websites. For example, on our Sites you will notice clickable icons which take you to the Outbrain Facebook page or the Outbrain LinkedIn page. If you choose to click on these links, you should know that these sites are not owned or operated by Outbrain and therefore these third-party websites may send their own cookies to your device, and they may independently collect personal data. It is therefore important that you get familiar with the privacy policies of these third-party websites.

b) Sharing

i. Sharing information we learn about you when you visit our Sites

We do not sell and/or share personal data about you with third parties for third party marketing or advertising purposes. We may use various third parties (each listed on the Cookie Table) to help us market or advertise to you. We require that these third parties and companies agree to comply with all applicable data protection laws, keep all information shared with them confidential and to use the information only to perform their obligations to us. We do this by entering into agreements with all third parties who process personal data. If you post on our blog, your comment and information will be publicly available. Please contact support@teads.com to remove your comment.

ii. Other

In addition, we may also disclose personal data as follows:

• within the family of companies controlled by Outbrain for internal reasons, primarily for business and operational purposes;
• if we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personal data will likely be among the assets transferred;
• when legally required to do so (e.g., to cooperate with law enforcement investigations or other legal proceedings); and/or
• to respond to a genuine emergency.

We may also combine your personal data with that of other users in order to share trend information and aggregate user statistics with third parties, always in aggregated and anonymized form.

c) Data Retention

The retention period for each of the cookies Outbrain uses (whether our own or on our behalf by third parties) is stated in the Cookie Table. 

We retain personal data only for as long as necessary for the purpose for which it was collected: contact details and marketing/newsletter preferences are kept for up to 3 years from your last interaction with us (or until you withdraw consent); website analytics data and IP address logs are retained for a maximum of 13 months; records of data subject requests are kept for up to 3 years to demonstrate compliance. When we no longer need personal data we securely delete or destroy it, or anonymise it. Aggregated, non-identifying data used for reporting may be retained longer.

a) Children

None of our services are intentionally directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If we become aware that we have unknowingly collected personal data from a child under the age of 16, we will make reasonable efforts to delete such information from our records.

b) Sensitive data

We do not collect or receive any sensitive categories of personal data when you visit our Sites.

a) Your rights

In compliance with certain privacy laws, in particular the European General Data Protection Regulation (GDPR) and the UK GDPR, you have certain rights in relation to your personal information. More specifically and under certain circumstances:

• the right to request information about whether and which personal data is processed by us, and the right to request that such personal data is rectified or amended;
• the right to request that your personal data be deleted;
• the right to request that the processing of your personal data be restricted, or to object to the processing on grounds relating to your particular situation, or at any time for direct marketing purposes; you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you (though we do not currently engage in such processing in relation to site visitors);
• the right to withdraw your consent to the processing and use of your personal data completely or partially at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
• the right to receive your personal data in a commonly used, structured and machine-readable format, and to transmit it to another controller where technically feasible (right to data portability) — this right applies where processing is based on your consent or on a contract with you, and is carried out by automated means;
• contact our data protection officer if there are any questions, comments, complaints or requests in connection with our statement on data protection and the processing of your personal data; and
• the right to complain to the responsible supervisory authority if believed that the processing of your personal data is in violation of the legislation.

We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights or have any questions, please email ob-dpo@teads.com.

b) Data transfers outside the European Territories/UK to non-US territories 

Our data centres are located in the United States, the Netherlands and Singapore. We  transfer Personal Data from the European Economic Area (EEA) and/or UK to our data centres in the United States. When we transfer Personal Data, we will ensure such transfers are in compliance with relevant data protection laws, including, if applicable, EU/UK Standard Contractual Clauses, or a European Commission/UK Government positive adequacy decision.  

In other words, your rights and protections remain with your data and we use approved contractual clauses and other measures designed to ensure that the recipients of your Personal Data protect it. Outbrain has in place the Standard Contractual Clauses between Outbrain entities to govern the transfer of data outside of the EEA/UK. To obtain more information as to the safeguards that we implement in this respect or to obtain a copy of them, please email ob-dpo@teads.com.

For more detail on transfers to the United States, please see below.

c) Data transfers outside the European Territories/UK to US territories – EU-US Data Protection Framework (DPF) Participation

i. EU-US Data Protection Framework (DPF) Participation

Teads Holding Co. complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Teads Holding Co. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Teads Holding Co. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Site Privacy Policy and the EU-U.S. DPF Principles, the EU-U.S. DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit www.dataprivacyframework.gov.

ii. Complaint and Dispute Resolution Procedure under the DPF 

Our internal complaints mechanism

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, we commit to resolve EU-U.S. DPF Principles-related complaints about our collection and use of your Personal Data. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact us at: ob-dpo@teads.com

You may have the right to lodge a complaint with the data protection authority of your country of residence. If you live in the UK, you can make a complaint with the Information Commissioner’s Office (ICO) at this address. If you live in the EU, you can find the relevant data protection authority here. To submit a complaint to the FTC, click here.

Independent Recourse Mechanism

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, we  commit to refer unresolved complaints concerning our handling of Personal Data received in reliance on the EU-U.S. DPF and UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgement of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related compliant to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Arbitration

You may also be able to invoke binding arbitration for unresolved complaints but prior to initiating such arbitration, a resident of a European country (including Switzerland) participating in the DPF must first:

1. contact us and afford us the opportunity to resolve the issue;
2. seek assistance from JAMS (an independent recourse mechanism); and
3. contact the U.S. Department of Commerce (either directly or through a European Data Protection Authority) and afford the Department of Commerce time to attempt to resolve the issue.

If such a resident invokes binding arbitration, each party shall be responsible for its own attorney’s fees. Please be advised that, pursuant to the DPF, the arbitrator(s) may only impose individual- specific, non-monetary, equitable relief necessary to remedy any violation of the DPF Principles with respect to the resident. The arbitration option may not be invoked if the individual’s same claimed violation of the Principles has previously been subject to binding arbitration; was the subject of a final judgement entered in a court action to which the individual was a party; or was previously settled by the parties. For more details, please click here.

iii. OUTBRAIN’S LIABILITY IN CASES OF ONWARD TRANSFERS TO THIRD PARTIES

In the context of an onward transfer, Outbrain has responsibility for the processing of Personal Data it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Outbrain remains liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless Outbrain proves that it is not responsible for the event giving rise to the damage.

This United States Consumer Privacy Notice (“State Notice”) supplements the Outbrain Site Privacy Policy and provides additional information for residents of certain states with comprehensive privacy laws, such as California. This State Notice applies to Personal Data we collect, use and disclose from those applicable U.S. state residents. 

 a) Your State privacy rights

As a resident of certain U.S. states, you may have the right to submit certain requests relating to your Personal Data, as listed below, depending on your state of residency, such as California. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

• Right to Know. If you are a California resident, you  have the right to know what Personal Data we have collected about you, which includes:
  • The categories of Personal Data that we have collected about you.
  • The categories of sources from which the Personal Data was collected.
  • The business or commercial purpose for collecting, selling, sharing or disclosing the Personal Data.
  • The categories of Personal Data that we sold or shared, and for each category identified, the categories of third parties to which we sold or shared that Personal Data.
  • The categories of Personal Data that we disclosed for a business purpose, and the categories of recipients to which we disclosed that Personal Data.
  • The specific pieces of Personal Data we have collected about you.
• Right to Access, Confirm and Data Portability. You may have the right to confirm whether we are processing your Personal Data, to access your Personal Data, and to obtain a copy of Personal Data you provided to us in a portable format.
• Right to Delete. You may have the right to delete the Personal Data that we have collected from you, subject to certain exceptions.
• Right to Correct. You may have the right to request that we correct inaccuracies in your Personal Data, taking into account the nature of the Personal Data and our purposes for processing it.
• Right to Opt Out of Sales and Sharing of Personal Data for Targeted Advertising.  You may have the right to opt out of the sale of your Personal Data, and to request that we do not share your Personal Data for targeted or cross-context behavioral advertising.
• Right to Withdraw Consent or Limit Use and Disclosure of Sensitive Personal Data. If we process Sensitive Personal Data from you, you may have the right to withdraw a previously provided consent for processing your Sensitive Personal Data for a specific purpose. For California residents, we do not use or disclose Sensitive Personal Data for purposes to which the right to limit use and disclosure applies.
• Right to Know Third Party Disclosures. You may have the right to request a list of third parties to which we have disclosed Personal Data. 
• Rights Related to Automated Decision-Making or Profiling. We do not use your information for profiling in furtherance of decisions that produce legal or similarly significant effects or for the purposes of automated decision-making as defined under currently applicable law.
• Right to Appeal.  Sometimes we are unable to process requests relating to your Personal Data, in which case, your request will be denied. If you have previously submitted a privacy rights request to us that has been denied and you believe that we denied it in error, you may have the right to appeal for reconsideration of your request by emailing us at ob-dpo@teads.com or by calling us toll free on 1-866-I-OPT-OUT and entering service code 253# to leave us a message.
• Non discrimination. You are entitled to exercise the rights described above free from discrimination.

 b) How to exercise your rights

You may exercise your privacy rights described above as follows:

• By calling us toll free on 1-866-I-OPT-OUT and entering service code 253# to leave us a message.
• By emailing ob-dpo@teads.com

 c) Right to opt-out of the “sale” or “sharing” for targeted advertising of your Personal Data

We do not sell your Personal Data in the conventional sense (i.e., for money). However, like many companies, we use services that help deliver interest-based ads to you. To opt-out from this “sale” or “share” for targeted advertising, click on this link which will take you to our Interest Profile where you can opt out of personalised recommendations. If you choose to use the Global Privacy Control (GPC) browser signal, you will only be opted out of online sales or sharing of Personal Data, and will need to turn it on for each browser you use.

We will need to confirm your identity and state of residency to process your requests. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it. Depending on your state of residency, you may be able to designate an authorized agent to make a request on your behalf; however, you may still need to verify your identity with us before your request can be processed. An authorized agent may submit a request on your behalf using the methods listed above.

Please note that if you make a privacy rights request, we will retain the Personal

Some browsers transmit Do Not Track (DNT) signals to websites. Because there is no common understanding of how to interpret the DNT signal, Outbrain does not currently alter, change, or respond to DNT requests or signals from these browsers. We will continue to monitor industry activity in this area and reassess our DNT practices as necessary. In the meantime, you can use the range of other tools we provide to control data collection and use, including the ability to opt out of receiving personalized recommendations (please see Outbrain’s Privacy Policy).

a) Data Protection Officer (DPO)

To communicate with our Data Protection Officer, please email at ob-dpo@teads.com or use the contact details below. You may also contact your local data protection authority. A list of local data protection authorities is available here.

 b) General questions

If you have any questions or concerns about your privacy you may contact us at:

Teads Holding Co.
111 West 19th Street 3rd Floor
New York, NY 10011, USA
Attn: Privacy questions

Email: ob-dpo@teads.com