Privacy Policy

1. Controller

Shigo Ad Server Solutions LTD.
156 Begin Road, 6492108 Tel Aviv, Israel
Represented by: Shilo Asi, Chief Executive Officer
Israel Registrar of Companies · Company No. 517212650
Email: info@trusted-media-alliance.com

This policy covers the website trusted-media-alliance.com only. The member companies of the alliance (TRUSTX, madSense, Shigotech) operate their own websites under their own privacy policies.

2. Representative in the Union and the United Kingdom (Art. 27 GDPR)

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)
• United Kingdom (UK)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/15137890493

3. What we collect, and why

3.1 Contact form

When you submit the contact form we process what you type into it: your name, work email, company, the audience category you select, and your message. The form also records which call-to-action you clicked — a hidden source field holding one of six values (general, trustx, madsense, shigotech, dmexco-meeting, dmexco-rsvp) — so that the inquiry reaches the right alliance member without you having to explain where on the site you came from. We use all of this to answer your inquiry and route it. Where you used the RSVP button for our DMEXCO booth party, we also use your name, email and company to manage the guest list for that event and to contact you about it. Legal basis for that use: Art. 6(1)(b) GDPR — the invitation you asked for is the service being provided.

We do not store your IP address or your browser's user-agent. Neither is written to the submission record and neither is included in the notification email we receive. The anti-abuse check (Cloudflare Turnstile) sees your IP address and basic browser signals when the page carrying the contact form loads and again when you press submit, uses them to judge whether the submission is automated, and discards them; it is not passed on to us and not retained.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request) and Art. 6(1)(f) GDPR (our legitimate interest in preventing automated abuse of the form).

Is it obligatory? No. Providing your name, work email, company and audience category is neither a statutory nor a contractual requirement. It is simply what we need in order to answer you and send the inquiry to the right member — without it we cannot respond. The message field is optional.

Retention: inquiries are kept for as long as it takes to handle them, and in no case longer than 24 months in the website database. That cap is enforced, not merely intended: a scheduled job runs every day and deletes leads older than 24 months. Separately, the notification email carrying your inquiry is delivered to the alliance mailbox; that copy sits in ordinary business email and is retained by the receiving member under its own mail-retention rules rather than by the daily job. If an inquiry becomes an actual business relationship, the details you gave us pass into the records of the member company you work with, where they are held by that company as its own controller, under its own privacy policy and its own retention rules including statutory commercial and tax retention periods. From that point they are no longer held under this policy — and the copy stored here is still deleted at 24 months.

3.2 Server logs and security

Our hosting provider processes technical connection data (IP address, requested URL, timestamp, user-agent) to deliver the website and defend it against attacks. Legal basis: Art. 6(1)(f) GDPR.

3.3 Cookies and analytics (opt-in only)

This website sets no advertising cookies and runs no cross-site tracking. Two things measure it. Our hosting platform counts page views without cookies (Cloudflare Web Analytics — see §4; nothing is stored on your device, so it needs no consent). Separately, and only with your explicit consent given via the cookie banner, we use Google Analytics 4 to understand how the site is used. Google Analytics sets cookies (_ga and similar) only after you choose “Allow analytics”. Legal basis: Art. 6(1)(a) GDPR (consent).

Google's Enhanced Measurement is switched on, so if you consent GA4 records more than pageviews. It also measures how far down a page you scroll and clicks on links that lead off this site, together with the category of device, browser and operating system you are using. Google's data-retention setting for this property is 14 months; event-level data expires after that.

The banner and the record of what you chose are operated for us by Cookiebot (Usercentrics A/S) — see §4. Your choice is stored in your browser and, so that we can demonstrate it if we are ever asked to, also logged on Cookiebot's servers together with the time you made it, the version of the banner text you were shown and an anonymised key. That log contains no directly identifying information about you. We ask again after 12 months, and sooner if the terms change.

If you decline, no analytics run and no analytics cookies are set — the site works exactly the same. You can withdraw or change your choice at any time via the “Cookie settings” link in the footer; on withdrawal we stop measurement and delete the analytics cookies we can reach from your browser. Withdrawal works forwards only: data already collected before you withdraw remains with Google under its own retention settings, and we cannot recall it.

Beyond that, the only technical mechanism in use is Cloudflare Turnstile (see below), which is strictly necessary to protect the contact form from bots and requires no consent.

4. Processors and third parties

• Cloudflare, Inc. (USA) — hosting/CDN for this website, storage of contact-form submissions, the Turnstile anti-bot check, and Cloudflare Web Analytics, a cookieless page-view measurement injected by our hosting platform. Cloudflare Web Analytics sets no cookies, stores nothing on your device and does not track you across sites; it counts page views and performance timings only. Legal basis: Art. 6(1)(f) GDPR (understanding whether the site works). Data may be processed on servers outside the EU/EEA; the transfer is made under the EU–US Data Privacy Framework, to which Cloudflare is certified. See Cloudflare's privacy policy.
• Twilio Inc. (USA, SendGrid) — delivery of the notification email that forwards your inquiry to our team. The transfer is made under the EU–US Data Privacy Framework, to which Twilio is certified. See Twilio's privacy policy.
• Google LLC (USA) — Google Analytics 4, only if you consent via the cookie banner (see 3.3). Google Analytics 4 does not log or store full IP addresses; your address is used in transit only to derive an approximate region, and is not retained. The transfer is made under the EU–US Data Privacy Framework, to which Google is certified. See Google's privacy policy.
• Prighter Group (with its local partners) — our appointed representative in the EU and the UK under Art. 27 GDPR (see §2). If you contact us through the representative, Prighter processes the details of your request on our behalf in order to pass it to us and help us answer it. See prighter.com.
• Usercentrics A/S (Denmark, “Cookiebot”) — the consent management platform that presents the cookie banner and keeps the record of your choice, so that consent can be demonstrated as Art. 7(1) GDPR requires. Processing takes place inside the EU. Cookiebot stores a CookieConsent cookie in your browser holding your own choice; this is strictly necessary to remember that choice and to stop the banner reappearing on every page. See Cookiebot's privacy policy.
• Web fonts — no third party is involved. All fonts used on this site are hosted on our own servers and delivered from the same domain as the page you are reading. Your browser makes no request to any external font provider, and no font provider receives your IP address.
• The alliance member companies — where your inquiry concerns one of them, we forward it to them and they become the recipient, handling your inquiry as their own controller under their own privacy policy.
  • madSense GmbH (Zurich, Switzerland) — Switzerland is covered by a European Commission adequacy decision, so no additional safeguard is needed for that transfer.
  • Shigotech (Shigo Ad Server Solutions LTD., Israel) — Israel is likewise covered by an adequacy decision.
  • TRUSTX (TrustX Digital Advertising Services, Inc. PBC, 530 Seventh Avenue, New York, NY 10018, USA) — there is no adequacy decision covering this recipient, and no appropriate safeguard under Art. 46 GDPR is in place for this transfer today. So we do not make it: inquiries that concern TRUSTX are answered by us, here, and nothing about you is passed to New York. If answering you properly needs TRUSTX itself, we will come back to you first, explain that the United States has no adequacy decision and that no safeguard is in place, and ask whether you want us to pass your details on anyway — Art. 49(1)(a) GDPR. You are free to say no; we will answer you as best we can either way. We will update this entry the moment a safeguard is in place, and you can ask us for a copy of it then.

Where a transfer relies on a safeguard, a copy can be requested at info@trusted-media-alliance.com.

We do not sell personal data, and we do not share it with third parties beyond the processors and recipients listed above.

5. Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you, and give you a copy (Art. 15);
• correct anything about it that is wrong or incomplete (Art. 16);
• delete it (Art. 17);
• stop using it, while a dispute about it is being resolved (Art. 18);
• hand it over — to you or to another provider — in a machine-readable form (Art. 20);
• stop processing that rests on our legitimate interest (Art. 21).

Where processing rests on your consent — which here means analytics, and nothing else — you may withdraw that consent at any time with effect for the future.

To exercise any of these rights, email info@trusted-media-alliance.com. We answer within one month of receiving the request. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your habitual residence or place of work.

6. Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR on this website. Nothing you send us is scored to reach a decision about you.

Submissions are screened automatically for signs of automated abuse — a hidden field that only a bot would fill in, how long the form took to complete, and the result of the Cloudflare Turnstile check. That screening decides only whether a submission reaches us, and produces no legal or similarly significant effect for you.

7. Changes to this policy

We will update this policy as the website or the legal situation changes. The current version is always available at trusted-media-alliance.com/privacy.