Privacy Policy

1. Introduction

Adspin Technology Solutions Limited ("Adspin.io", "we", "us", or "our"), incorporated in Hong Kong and registered at 77 Connaught Rd Central, 26th Floor, Beautiful Group Tower, Central Hong Kong, operates a programmatic advertising exchange platform.

This Privacy Policy explains how we collect, use, share, and protect information in connection with our Ad Exchange services. It applies to all businesses and partners that interact with our platform.

We are a registered vendor under the IAB Europe Transparency & Consent Framework (TCF) 2.2, and we are committed to full compliance with the General Data Protection Regulation (GDPR) and applicable Hong Kong data protection laws.

2. Data We Collect

In the course of operating our advertising exchange, we may process the following categories of technical data:

• IP Address — used for geographic targeting, SIVT detection, and fraud prevention.
• Device Identifier (Device ID) — used for frequency capping, ad delivery, and impression verification.
• User Agent — used to identify device type and browser for correct ad format serving.
• Cookies and similar tracking technologies — used for impression serving, SIVT/fraud verification, and platform integrity.

We do not collect names, email addresses, or any directly identifying personal data from end users. Our services are directed exclusively at businesses (B2B) and are not intended for or directed at minors.

3. How We Use Data

The data we process is used exclusively for the following purposes:

• Serving and verifying ad impressions across our exchange.
• Detecting and preventing invalid traffic (IVT), sophisticated invalid traffic (SIVT), and ad fraud.
• Ensuring platform integrity and brand safety.
• Fulfilling our obligations as a TCF 2.2 registered vendor.

We do not build user profiles, and we do not use data collected through our platform for any purpose beyond those listed above.

4. Cookies & Tracking Technologies

We use cookies and similar technologies strictly for operational purposes: ad impression serving and SIVT/fraud verification. These are not used for behavioural profiling or long-term tracking of individuals.

Where required by applicable law — including the GDPR and the ePrivacy Directive — consent will be obtained through a compliant Consent Management Platform (CMP) before cookies are placed on a user's device.

5. Data Sharing

We may share limited technical data with trusted analytics providers for the sole purpose of fraud detection and platform performance monitoring. We do not sell personal data, and we do not share data with third parties for profiling, marketing, or any purpose beyond what is described in this policy.

All third-party providers we work with are contractually bound to process data only on our instructions and in accordance with applicable data protection laws.

6. GDPR & TCF 2.2 Compliance

Adspin.io processes data of individuals located in the European Economic Area (EEA). As a TCF 2.2 Approved Vendor, we operate within the IAB Europe consent framework and rely on lawful bases including legitimate interest and consent, as applicable.

EEA data subjects have the right to:

• Access personal data we hold about them.
• Request correction or deletion of their data.
• Object to or restrict processing.
• Data portability, where applicable.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, please contact us at legal@adspin.io.

7. Data Retention

We retain technical data (such as IP addresses, device identifiers, and user agents) only for as long as is necessary to fulfil the purposes described in this policy — typically for a period not exceeding 90 days from the date of collection, unless a longer retention period is required by applicable law or for the purposes of fraud investigation and legal compliance.

Once data is no longer required, it is securely deleted or anonymised.

8. Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing our data protection practices. You may contact our DPO at:

legal@adspin.io

9. Data Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, or disclosure. This includes encryption in transit, access controls, and regular security assessments.

10. Age Restrictions

Our services are intended solely for businesses and are not directed at, or designed to be used by, individuals under the age of 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be communicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact

For any privacy-related queries or requests, please contact: