Privacy Policy
AdExchange BD privacy policy for website visitors, publishers, advertisers and ad viewers, including advertising signals, cookies, Google services and privacy rights.
AdExchange BD privacy policy for website visitors, publishers, advertisers and ad viewers, including advertising signals, cookies, Google services and privacy rights.
1. Who we are and how to contact us
AdExchange BD is an advertising technology and programmatic advertising service operated under Indigo Brokers Ltd. References to “AdExchange BD”, “we”, “us” or “our” in this notice refer to the operator of the AdExchange BD services. Our website is https://adexchange.bd/.
For questions about this notice, information held about you or a privacy-rights request, email hello@adexchange.bd with the subject “Privacy Request”. You may also use our Contact page at https://adexchange.bd/contact/. Please do not email passwords, payment card details, government identification numbers or other unnecessary sensitive material.
2. Scope and our different roles
This policy covers our corporate website, enquiries, advertiser and publisher accounts, operational tools, advertising integrations, ad-delivery technology and related measurement when these services are used. It is also intended to inform people who encounter an advertisement delivered through a publisher using AdExchange BD technology.
A publisher controls its own website or app, its content, visitor-facing disclosures and the selection and configuration of advertising partners. Advertisers control their campaigns and the information they choose to provide. Depending on the service and applicable law, AdExchange BD and other participants may act as independent controllers, joint controllers or processors under contractual instructions. We do not claim that one role applies to every transaction.
Third-party websites, Google Ad Manager accounts, connected advertiser tools and payment providers may have their own privacy notices and responsibilities. This policy does not replace those notices or a relevant publisher, advertiser or data-processing agreement.
3. Information received from advertisers, publishers and business contacts
When you contact us or use an account, the information involved may include your name, work email, phone number, organisation, country or business address, site or app details, account credentials or authentication records, service settings, support messages and records of communications.
Where relevant to campaigns or publisher operations, we may handle campaign objectives, budgets, creative files, destination URLs, inventory details, reporting preferences, agreements, invoices, settlement records and payment or tax-related details supplied through authorised business processes. The exact fields depend on the features you actually use.
Please provide only information necessary for the relevant service. Do not upload personal or sensitive information about others unless you have an appropriate legal basis and authority to do so.
4. Information generated when an advertisement is requested, displayed or clicked
Where our ad-serving, SDK, tracking or programmatic integrations are used, ad transactions may involve technical information such as IP address or derived approximate location, browser and operating-system details, user-agent, device category, timestamp, publisher site or app identifier, page or placement context, ad-unit size, campaign and creative identifiers, referral information, request identifiers and signals associated with impression, click or conversion events.
Some integrations can handle advertising identifiers, cookie or local-storage values, consent or privacy signals, auction or bid-request information and fraud-prevention indicators where permitted and available. Not every integration collects every category. The data available to a particular buyer or technology partner is determined by the enabled workflow, configuration, applicable law and permissions.
Data about an advertisement being served, viewed or clicked is not the same as identifying a named individual. However, some technical identifiers and combinations of signals may qualify as personal information under applicable privacy laws.
5. Website analytics, logs and similar information
Our public website currently has Google Analytics configured for measurement. Site visits can generate page views, events, traffic-source information, browser/device characteristics and other analytics information under Google's applicable settings and policies.
Our websites, APIs, content delivery and infrastructure may also generate access, performance, error and security logs, which can include request time, source address, requested resource and technical diagnostics. Logs support reliability, troubleshooting, abuse prevention and service protection.
We do not assume that every proposed or described advertising feature is active for every user. Collection depends on the live service actually used.
6. Why we use this information
We use relevant information to provide websites and accounts, authenticate users, respond to enquiries, operate publisher inventory and advertiser campaigns, route and deliver eligible advertisements, measure performance, attribute events where configured, prepare reports and settlement records, and maintain customer support.
We may also use information to detect invalid traffic and other abuse, secure services, diagnose errors, protect advertising quality, administer contracts, comply with legal requirements, resolve disputes and improve products based on operational or aggregated insights. Personal information is not required for every one of these activities.
Where personalised advertising, profiling, cross-site measurement or another consent-dependent purpose is enabled, the necessary notices, choices and lawful permissions must be respected. We do not describe unverified machine-learning uses or third-party data enrichment as universally active.
7. Legal grounds for processing where applicable
Where the GDPR, UK GDPR or a similar law requires a legal ground, the ground depends on the activity. It may include fulfilling a contract with a customer, complying with a legal obligation, a legitimate interest that has been assessed and is not overridden by individuals' rights, or valid consent where required.
For cookies, device storage/access, personalised advertising or other uses that require consent under applicable law, we or the relevant publisher/partner must obtain and honour the appropriate choice before engaging in the regulated activity. We do not assume that a particular legal basis or legitimate-interest claim is valid in every country or circumstance.
You may withdraw consent for future consent-based processing through the relevant available mechanism. Withdrawal does not necessarily affect processing already lawfully completed.
8. Cookies, device access and your consent choices
Cookies and similar technologies can support login, security, preferences, analytics and advertising functions. Our separate Cookie Policy at https://adexchange.bd/cookie-policy/ primarily explains technologies on the public corporate website.
An independent publisher may use its own consent-management platform (CMP), cookie banner or privacy controls for ads appearing on that publisher's site or app. Where required, the publisher and the configured advertising participants must disclose relevant vendors and purposes and honour users' choices, including opt-outs and consent withdrawal.
Certain programmatic integrations may carry consent or regulatory signals, such as IAB TCF signals, where supported. A technical signal interface does not by itself establish that AdExchange BD or a publisher is certified, registered with IAB Europe or compliant with all laws. You can also use browser privacy settings to block or clear some cookies, although this may affect functionality.
9. Advertising ecosystem and third-party partners
To carry out an enabled ad campaign or programmatic transaction, relevant data or permitted technical signals may be processed by publishers, advertisers, agencies, ad servers, analytics providers, demand-side or supply-side partners, verification and fraud-prevention services, hosting providers and other authorised service providers.
An ad request may pass through more than one participant depending on the publisher's selected integration. We do not claim that every provider listed in public AdTech industry directories is a partner of AdExchange BD. Specific recipients and disclosures depend on actual active integrations and agreements.
We ask relevant business partners to meet applicable privacy, security and contractual requirements, while recognising that some parties determine their own purposes and publish separate privacy policies.
10. Google Analytics and Google Ad Manager
Google Analytics is configured for measurement on the public AdExchange BD website. For information about how Google uses information from sites or apps that use its services, see https://policies.google.com/technologies/partner-sites.
Some publishers may choose to integrate their own Google Ad Manager account with AdExchange BD through available ad-unit, line-item or third-party creative workflows. Google Ad Manager account ownership, publisher inventory settings, consent controls and Google processing practices remain subject to the relevant Google terms, publisher configuration and Google privacy notices.
A publisher's decision to use Google Ad Manager does not mean Google processes every AdExchange BD transaction or that AdExchange BD has unrestricted access to that publisher's Google account.
11. Information sharing and disclosures
Information may be shared with service providers assisting with secure hosting, business communications, website measurement, authorised advertising operations, support or payment administration, to the extent needed for the services involved.
Information may also be disclosed when a lawful request, enforceable legal obligation, fraud investigation, contractual requirement or protection of rights makes disclosure appropriate, subject to applicable law. A business restructuring may involve the transfer of relevant records with appropriate safeguards.
Certain disclosures for cross-context advertising can be treated as a 'sale', 'sharing' or targeted advertising under some US state laws even where no money is exchanged for the data itself. We do not assume those statutory definitions never apply; relevant requests will be assessed against our actual practices and the law.
12. International data processing and transfers
AdExchange BD operates from Bangladesh and may serve business customers or publisher traffic in other markets. Technical infrastructure, service providers and enabled advertising partners may operate in different countries. As a result, relevant information may be transmitted or processed outside the country where it was collected.
Where a law requires a specific transfer mechanism, contractual protection, risk assessment or other safeguard, the applicable parties must implement it for the relevant transfer. This statement does not claim that every prospective transfer has already been approved under a particular regulatory framework.
13. How long information is kept
We retain information for periods appropriate to the service and purpose, taking into account operational needs, contract terms, audit and security requirements, applicable tax or accounting duties, dispute handling and lawful deletion requests. Different categories, such as support requests, account records and technical event logs, can have different retention periods.
We do not publish a single retention number that has not been verified for every data system. Where a specific deletion or retention period is established for a service, applicable service documents or notices may provide additional detail. Records may be aggregated, de-identified, deleted or retained where a valid legal exception applies.
14. Security and access controls
We use and develop technical and organisational measures intended to protect information, such as access restrictions, authentication, security monitoring, transport protections and operational controls appropriate to the system and risk. No online or advertising technology system can be guaranteed absolutely secure.
If you believe that your account, an advertising integration or personal information has been compromised, please contact us promptly through the Privacy Request channel.
15. Your rights under applicable privacy laws
Depending on your location and the relationship involved, you may have rights to ask whether we process personal information about you; request access, correction, deletion or a portable copy; restrict certain processing; object to processing based on legitimate interests; or withdraw consent. You may also be entitled to complain to a competent data-protection authority.
To make a request, email hello@adexchange.bd with the subject 'Privacy Request' and explain the relevant website, advertisement, account or interaction. We may request proportionate verification to protect against disclosure to the wrong person. We will assess and respond in accordance with applicable law, including permitted exceptions.
When the publisher, advertiser or another independent party controls the relevant data, we may direct you to that party or coordinate a request as appropriate. We cannot necessarily identify an individual from an anonymous technical event or an advertising identifier alone.
16. Advertising choices and applicable US state rights
Depending on applicable US state law, a resident may have rights to opt out of certain targeted advertising, sale or sharing of personal information, or qualifying profiling, in addition to rights to know, correct or delete information. You may submit a relevant request using the Privacy Request contact channel.
Where supported and legally required for a particular service, we assess recognised opt-out preference signals and choices supplied through publisher or other consent systems. We do not promise that every browser's 'Do Not Track' setting is a verified operational opt-out for every integration.
You may also review privacy controls offered by the publisher where an advertisement appears, by your browser/device, and by third-party advertising services. These mechanisms are not necessarily interchangeable.
17. Publisher and advertiser responsibilities
Publishers are responsible for the privacy disclosures, permissions and consent processes applicable to the websites and apps they operate, for selecting relevant advertising vendors, and for passing accurate privacy choices to participating technology where the integration supports that functionality.
Advertisers are responsible for providing lawful campaign materials, destination URLs, any conversion or audience data they instruct us to handle, and appropriate notices and authorisations for that data. Both groups should avoid sending sensitive categories or children's data through ad requests unless a lawful, supported and explicitly authorised arrangement exists.
Where we act as a processor, our processing obligations may be further defined by a written data-processing agreement. Nothing in this policy overrides mandatory legal duties.
18. Children and sensitive information
Our corporate site and business-facing advertiser/publisher services are not directed to children. We do not intentionally ask children to register for business accounts. Publishers using advertising technology on child-directed properties must apply appropriate restrictions and obtain any required permissions.
Do not include health, financial, biometric, precise location, identity documents or other sensitive information in ad requests, URLs, creative tags or general enquiry forms unless it is strictly necessary, lawful and covered by an appropriately authorised process.
19. Changes to this policy
We may revise this policy as services, integrations, legal requirements and verified data practices change. The current version and update date will be made available at https://adexchange.bd/privacy/. Where applicable law requires further notice or renewed consent for a material change, that additional step must be addressed.
This publication improves transparency about the platform; it does not itself activate consent tools, change data-processing configurations or establish a regulatory certification.
Contact AdExchange.bd
Use the contact page for policy, privacy, cookie or terms-related questions and identify the relevant policy in your message.
Contact AdExchange.bd