GDPR & Data Protection

1. GDPR application and responsible entity

The General Data Protection Regulation (EU) 2016/679 may apply to organisations outside the EEA where the legal criteria for offering services to, or monitoring the behaviour of, individuals in the EEA are met. A Bangladesh-based company is not automatically exempt or automatically covered for every processing activity.

AdExchange BD operates under Indigo Brokers Ltd., Bangladesh. The contact channel for data-rights and privacy enquiries is hello@adexchange.bd (subject: Privacy Request), or https://adexchange.bd/contact/. Whether a specific EU or UK representative or statutory Data Protection Officer must be appointed requires a separate applicability assessment; this notice does not invent an appointment.

2. Controller, processor and publisher roles

A controller decides the purposes and essential means of a processing activity; a processor processes personal data on the controller's documented instructions. Depending on the account, campaign and technical implementation, AdExchange BD may have different roles for business-account information, website analytics and authorised ad-technology operations.

Publishers, advertisers, Google services and other partners may independently determine purposes or act under contractual instructions. The proper roles and responsibilities must be specified for each data flow, not inferred from the presence of an SDK or GAM line item.

Where Article 28 applies, the parties must put in place appropriate processor terms addressing instructions, confidentiality, security, subcontractors, assistance, data return or deletion and audit information.

3. Data categories and processing purposes

Depending on enabled services, relevant categories may include business contacts, account and billing records, website event logs, approximate location inferred from network information, IP address, browser and device data, advertising placement identifiers, consent signals, creative and campaign identifiers, and impression or click measurements.

Typical purposes include delivering contracted services, security, fraud prevention, support, measurement, reporting, reconciliation and authorised advertising. Some identifiers can be personal data even if they do not directly state a name. We do not claim all categories are collected for every visitor or every publisher.

4. GDPR principles and lawful bases

The GDPR requires lawful, fair and transparent processing; specified and limited purposes; data minimisation; accuracy; retention limitation; security; and accountability. Each applicable controller must identify a lawful basis for each relevant purpose.

Possible legal bases include necessity for a contract, a legal obligation, valid consent or a properly balanced legitimate interest, depending on the processing. No party should treat legitimate interest as an automatic replacement for consent where consent is legally required.

Where consent is the basis, it must be capable of being withdrawn in an effective way. The legal basis and information notices must reflect actual data handling, not hypothetical product features.

5. Cookies, device storage and consent

EEA cookie and device-access rules may require consent before non-essential cookies or comparable tracking are stored or read. GDPR requirements also apply where information is personal data. Publishers should display meaningful choices and vendor disclosures where required before activating regulated processing.

AdExchange BD integrations may receive consent, opt-out or regulatory signals where implemented. A signal alone does not certify that a banner, CMP, vendor registration, purpose list or consent history satisfies GDPR or the applicable electronic-communications rules. Consent needs to be passed and honoured by all relevant participants in the applicable data flow.

Google Ad Manager's own EU Consent requirements and recognised partner policies are distinct from AdExchange BD's general privacy notice. Publishers using their own GAM account must configure the relevant permissions and vendor/partner disclosures for their actual setup.

6. Advertising requests and privacy by design

Ad requests should carry only data needed for a permitted campaign and delivery method. Where necessary, advertising should be constrained, disabled or adapted if required consent or another valid lawful basis is absent. IP-derived location, persistent identifiers, cross-site profiling and precise targeting can carry different risks.

Appropriate controls can include access restriction, data minimisation, secure transmission, defined retention, audit logs and documented review of high-risk use cases. Privacy by design and by default require more than a visible legal notice.

7. Data subject rights

Depending on the conditions and exemptions under GDPR, individuals can request information and access, correction, erasure, restriction, portability and objection to processing. They can withdraw consent where consent is relied on and may have rights concerning solely automated decisions with significant effects.

To exercise rights, email hello@adexchange.bd with subject Privacy Request and describe the relevant site, account, advertisement or approximate interaction date. Do not include passwords or excessive sensitive personal information. We may request limited verification before disclosing account or advertising data.

Where another publisher or advertiser determines the relevant processing, we may direct the person to the appropriate controller or assist that controller as required by law or contract.

8. Requests, timing and complaints

Applicable GDPR requests are ordinarily addressed without undue delay and generally within one month, subject to statutory exceptions and permitted extensions. We will assess each request for scope, identity, exemptions and the correct responsible organisation, rather than promise an outcome before reviewing the evidence.

Individuals who believe their GDPR rights have been breached may lodge a complaint with a competent EEA supervisory authority. The relevant authority depends on the circumstances; making a request to AdExchange BD does not remove that right.

9. International transfers

AdExchange BD is based in Bangladesh; hosting, service suppliers and authorised advertising counterparties can be in other countries. When a GDPR-regulated transfer of personal data to a country outside the EEA occurs, an applicable transfer mechanism and any additional necessary safeguards must be established.

Such mechanisms can include adequacy decisions where they apply, approved standard contractual clauses plus appropriate assessment and measures, or narrowly applicable statutory derogations. This page does not claim a transfer is automatically lawful merely because a business agreement exists.

10. Data retention and security

Different categories of records require different purposes and retention rules. No single retention period is stated here because the exact schedules for business-account data, campaign logs, security records and Google or publisher-controlled records require verification. Applicable agreements and records of processing should document those periods or criteria.

Technical and organisational measures should match risk, including access controls, confidentiality, secure transport and incident response. GDPR compliance may require specific breach notifications to a regulator or individuals within statutory timeframes depending on the facts; neither a privacy notice nor a technical feature guarantees a system is invulnerable.

11. Automated processing and advertising

Programmatic advertising can involve automated decision-making for ad delivery, bidding, eligibility or measurement. Such automation does not necessarily constitute a decision producing legal or similarly significant effects about an individual under GDPR Article 22.

Where such effects, profiling or other high-risk activities are relevant, the controller must assess legal requirements and provide any required meaningful information, safeguards and choices. AdExchange BD does not claim that every technology or auction creates an individual profile.

12. Information for partners and compliance verification

Advertisers and publishers should verify their lawful data sources, visitor-facing privacy notices, consent mechanisms, technical signals, vendor lists, data processing agreements and relevant partner contracts before using personal data in an advertising integration.

AdExchange BD's public descriptions and code-generation tools are not a substitute for an independent GDPR assessment, records of processing, DPIA where required, contractual audit or recognised CMP configuration. Partner integrations should be evaluated against the actual deployed architecture.

13. Contact and document links

For a privacy-rights request, contact hello@adexchange.bd (subject Privacy Request) or https://adexchange.bd/contact/. Include enough information to identify the service while minimising unnecessary personal data.

See AdExchange BD Privacy Policy at https://adexchange.bd/privacy/, Cookie Policy at https://adexchange.bd/cookie-policy/ and DSP Legal Terms at https://adexchange.bd/dsp-legal-terms/. The source legal texts include GDPR Regulation (EU) 2016/679 and guidance from the European Commission and European Data Protection Board.