This Ad Serving Privacy Notice supplements the Rembrand Corporate Privacy Policy and applies specifically to data processed in connection with Rembrand's third-party ad serving activities through its SCA Advertising platform on rembrandmedia.com and its subdomains.
1. Scope
This notice applies to data collected, processed, and stored in connection with Rembrand's delivery of HTML5 display creatives via Rembrand's ad-serving infrastructure to consumer-facing websites and applications participating in the Google Display Network and other supported inventory.
It covers all activity on the following Rembrand-operated ad-serving domains:
- rembrandmedia.com
- evs.rembrandmedia.com
- serve.rembrandmedia.com
2. Information We Collect During Ad Serving
When a Rembrand-served ad is delivered to a user's device, Rembrand processes the following limited information:
- Impression and click logs — timestamps, creative ID, campaign ID, advertiser ID
- Technical signals — IP address (used solely for coarse geo-location and fraud detection; not retained beyond what is necessary), HTTP user-agent string, referrer URL
- Cachebuster identifiers — anonymous request-uniqueness tokens used to prevent over-counting of impressions
- Frequency capping cookies — small first-party HTTP cookies set by rembrandmedia.com to limit the number of times a user sees a specific ad within a defined time period
3. What Rembrand Does NOT Do
In our ad-serving operations Rembrand does not:
- Collect, create, or use any personally identifiable information (PII) or sensitive data categories
- Target ads to users under 13 years of age, or to segments defined by that characteristic
- Collect impression-level data through ads for subsequent ad targeting
- Use hyperlocal geotargeting (e.g., GPS-based mobile targeting)
- Perform browser packet-sniffing
- Perform browser or device fingerprinting
- Assist any third party in setting, altering, or deleting a cookie on Google-owned and -operated domains
- Use Flash cookies, Local Shared Objects (LSOs), or other non-HTTP cookie persistence
- Perform impression-level page scraping
- Use IP addresses for any purpose other than coarse geo-targeting and fraud detection
- Share cross-client data — each advertiser owns the data collected from their campaigns
- Sell user data to any third party
- Perform cookie matching across different third parties through ads served on Google's GDN, owned-and-operated inventory, or other Google ad surfaces
4. Cookie Information
Rembrand uses only first-party HTTP cookies set on rembrandmedia.com for frequency-capping purposes. Cookie lifetimes do not exceed two (2) years, except for opt-out cookies which may be longer-lived to honor user preferences.
We do not use Flash cookies, Local Shared Objects, ETags, or any other persistent identifier mechanism beyond standard HTTP cookies.
5. Compliance and Industry Standards
Rembrand's ad-serving practices comply with Google's policies for third-party ad serving on the Google Display Network and follow guidance from:
- Network Advertising Initiative (NAI) Self-Regulatory Code
- Digital Advertising Alliance (DAA) Self-Regulatory Principles
- IAB UK Good Practice Principles for Online Behavioral Advertising
For users in the European Economic Area and the United Kingdom, Rembrand intends to participate in the IAB Transparency and Consent Framework (TCF) v2.2. Until registration is complete, EEA/UK exposure is limited.
6. Our Legitimate Interest Basis
Under the GDPR (Article 6(1)(f)) and the IAB Europe Transparency and Consent Framework (TCF) v2.2, Rembrand relies on legitimate interest as the legal basis for certain ad-serving data-processing activities. This section documents our legitimate interest assessment for each applicable Purpose, the balancing test we have performed against data-subject rights, and the rights you retain to object.
Purpose 2 — Use limited data to select advertising
- Data processed: page URL, ad-slot identifier, coarse (non-precise) location derived from IP, HTTP user-agent string, and a randomly-generated frequency-cap cookie value stored on rembrandmedia.com.
- Our legitimate interest: selecting a relevant ad from the advertiser's campaign inventory based on contextual signals at the moment of impression, and applying frequency caps so a user is not shown the same creative excessively.
- Balancing test: the data used is limited, non-identifying, and is not combined with profile data. No cross-site tracking, no fingerprinting, no profile creation. The processing is necessary to deliver the contracted advertising service and does not override the fundamental rights and freedoms of the data subject.
- Conclusion: legitimate interest is established.
Purpose 7 — Measure advertising performance
- Data processed: impression timestamps, click timestamps, campaign and creative identifiers, IP (used only for coarse geo-bucketing and fraud filtering), HTTP user-agent, cachebuster IDs.
- Our legitimate interest: producing aggregate delivery, click-through, and viewability reporting for advertisers, as required by our service contracts and standard ad-industry practice.
- Balancing test: measurement is aggregated at campaign and creative level and is not used to identify or profile individual users. Retention is limited to thirteen (13) months. Data subjects may opt out at any time via our opt-out page, in which case their data is excluded from further measurement. The processing does not override fundamental rights.
- Conclusion: legitimate interest is established.
Purpose 10 — Develop and improve services
- Data processed: aggregated platform metrics (request latency, error rates, traffic patterns); no personally identifying data and no individual-level user data.
- Our legitimate interest: improving the technical performance, reliability, and security of the Rembrand SCA Advertising platform.
- Balancing test: product-improvement processing uses only aggregate, non-identifying signals. No individual-level profiling and no commercial sharing of derived insights. The intrusion on individual privacy is minimal and proportionate to the operational need.
- Conclusion: legitimate interest is established.
Special Purposes — security, ad delivery, and privacy preferences
Under the IAB TCF, Special Purpose 1 (security, fraud detection, error fixing), Special Purpose 2 (real-time delivery and presentation of advertising), and Special Purpose 3 (storing and communicating privacy choices) operate on a legitimate-interest basis at all times — these activities are necessary for the basic operation of any compliant ad-serving service and for honoring user privacy preferences. Rembrand has assessed each and confirms that data-subject rights and freedoms are not overridden.
Your right to object (GDPR Article 21)
You have the right to object to any processing performed by Rembrand on the basis of legitimate interest. To exercise this right with respect to Rembrand's ad-serving activities, please use our opt-out page at https://rembrandmedia.com/opt-out, or contact [email protected]. Upon receiving an opt-out signal, Rembrand will cease the use of frequency-capping cookies and related signals on your browser, and will exclude your impressions from aggregate measurement reporting.
7. Your Choices and Opt-Out
You can opt out of Rembrand's ad-serving and ad-targeting cookies on our dedicated opt-out page:
You can also use industry-wide opt-out tools:
- United States: NAI opt-out and DAA opt-out
- Europe: Your Online Choices
- Google Ads personalization: Google's My Ad Center
You can also manage cookies directly in your browser settings, or use mobile device controls (Limit Ad Tracking on iOS / Reset Advertising ID on Android).
8. Contact
For questions or requests related to this Ad Serving Privacy Notice, contact: [email protected]
This notice is incorporated by reference into and supplements the Rembrand Corporate Privacy Policy. The corporate policy will be updated to include a link to this notice. In the event of any conflict between this notice and the corporate Privacy Policy with respect to ad-serving activities, this notice controls.