Privacy

As a client of Aqua Platform, we hope you can benefit from the information we’ve put together on the page below, so that you can better fulfil your own obligations with regard to privacy, the processing of personal data, and data protection in general. And of course: thanks for being our client, we very much value your business!

As part of your research before signing up as our newest client, it could be beneficial to study the information below describing how Aqua Platform treats personal data, and how we’ve implemented our commitment to privacy and data protection. And of course, if you like what you see, then please feel free to sign up and join a long list of loyal clients.

Companies and organisations that operate in the area governed by GDPR will have to be compliant with the regulations, even when they are based outside of the EU, if the Data subject involved is an individual who resides in the EU.

Every business, anywhere in the world, that has activities involving citizens of or individuals residing in the EU, must comply with the requirements of GDPR.

Not complying with the regulation can result in administrative fines of 4% of Gross Global Revenue of the organisation found to be in violation, or 20 Million Euro, whichever of the two is greater.

GDPR is an extremely complicated set of rules, and it is actually much more a legal matter than a technical matter. Aqua Platform is not qualified to provide legal advice, so this page should be considered to be simply informative. We recommend that you consult with a lawyer or a qualified expert in order to be fully compliant with GDPR.

GDPR introduces three important roles, which affect the rights and responsibilities an entity has. The three roles are:

• Data Subject: a natural person from whom data is available and who should be able to determine how their data will be collected, stored, and/or moved;
• Data Controller: a legal or natural person controlling the processing of personal data belonging to a Data Subject;
• Data Processor: a legal or natural person performing the processing of personal data belonging to a Data Subject;

Instead of trying to go into the details of what a Data Controller and a Data Processor is and how it is determined whether you are the former, the latter, or both, we recommend having a look at the article by Sagara Gunathunga on All you need to know about GDPR Controllers and Processors.

Here are a few resources to learn more about GDPR:

• The full text of the GDPR has been made available in a search-enabled format with annotations by Algolia;
• There is a page about GDPR on Wikipedia.

For the most part, we are not a Data Controller. Our clients, the publishers and other businesses for whom we provide our services, should be considered the Data Controller. In accordance with GDPR, these Data Controllers give us their instructions on Data Processing, while first ensuring that they have obtained the consent of any Data Subjects they engage with. It is the responsibility of these Data Controllers to be compliant with GDPR or other regulations. In some cases, our clients are not in direct contact with Data Subjects, instead they perform an intermediate role for their own clients, who are in direct contact with them. There is one exception: when it comes to our own website and other ways of interacting with clients, potential clients, and others who are interested in our services and our business, we process a certain amount of personal data. For example, to be able to send an invoice to a client, we need to first store and later use their name, e-mail address, business name, address and so on. In that kind of capacity, Aqua Platform is both a Data Controller and a Data Processor (more on that role below).

Aqua Platform can be considered a Data Processor, and for the most part that’s our only role. Our clients, or their clients, perform the role of Data Controller. Since they engage with Data Subjects, in this case people visiting their websites or using their apps for example, it is their role and responsibility to provide information about the intended use of Personal data, and to get consent from such Data subjects for doing so. Since GDPR applies to any business, by default, it is the position of Aqua Platform, that our clients and their clients must be in compliance, and therefor, we do not have to perform any of the Controller roles in such cases.

The Revive Adserver project website has a page dedicated entirely to privacy, an explanation to how it relates to GDPR, and a detailed description of how the Revive Adserver handles personal data. Our clients are recommended to study this information carefully, to incorporate the relevant parts in disclosures about the use of personal data, so that a user of the internet who interacts with an ad server system hosted by Aqua Platform can make an informed decision about giving consent if necessary.

At Aqua Platform, we use the Revive Adserver software without any modifications. As such, the treatment of personal data by the software is exactly as described on the Revive Adserver website. We have added a few plugins to improve and scale up the functionality for the collection of delivery statistics, but these have been designed and developed to function identically to the built-in functionality.

Yes, we do. As a business, we need to be able to communicate with our clients. They need ways to contact us, and we need to be able to respond to them, and to initiate our own communications towards them. And in order to do that, we need to collect and store a limited set of personal data about the individuals representing our clients.

But, as noted before, the concept of Privacy by Default was essential here as well.

As an example: to be able to send our customers their monthly invoices, we need to collect and store their names and e-mail addresses. Fiscal legislation also dictates that we store and use their business names, postal addresses and in some cases tax registration numbers. As a matter of fact, tax authorities dictate that we keep a record of every financial transaction and the associated personal data (if any), for at least 7 years. We’re not even allowed to delete any of those.

However, dictated by Privacy by Default, we never collect any personal data that we do not absolutely need.

Yes, we do, but we make a point of not processing any personal data in cookies.

We use Google Analytics to count how many visits and pageviews we get on our website, and which pages are being viewed. To comply with GDPR, we’ve enabled the anonymizeIP setting in Google Analytics, so no personal data is ever collected, let alone shared with Google.