Privacy Policy

1. Introduction

AUSHRA Labs s.r.o., operating under the brand name RTBLink (“RTBLink”, “we”, “us”, “our”), is a technology company providing real-time bidding (“RTB”), programmatic advertising, and digital advertising infrastructure services for advertisers, publishers, agencies, and advertising partners.

This Privacy Policy explains how RTBLink collects, processes, stores, shares, and protects information relating to advertisers, publishers, business partners, website visitors, and end users who interact with advertisements delivered through our technology.

RTBLink processes personal data in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Applicable Czech data protection laws
• Applicable electronic communications and cookie legislation

2. Who We Are

AUSHRA Labs s.r.o. Křemenáčová 90/6, Pitkovice, 104 00 Praha 10, Czech Republic. Company Registration Number: 247 75 967. Brand: RTBLink. Privacy Contact: privacy@rtblink.com

3. Definitions

Personal Data — any information relating to an identified or identifiable natural person (name, email, IP address, cookie identifiers, etc.)

Non-Personal Data — aggregated or anonymized information that does not identify an individual.

End User — individual visiting websites or apps where RTBLink-delivered ads may appear.

Publisher — entity providing advertising inventory through the RTBLink platform.

Advertiser — entity purchasing advertising opportunities through RTBLink.

RTB — Real-Time Bidding, automated auction process for buying and selling advertising inventory.

4. Our Data Protection Principles

RTBLink ensures Personal Data is:

• Lawfully, fairly and transparently processed
• Collected for specific, legitimate purposes
• Limited to what is necessary
• Accurate and maintained
• Stored only as long as necessary
• Securely processed
• Processed with accountability

5. Our Role Under GDPR

Data Controller — when determining purposes and means of processing (account management, payments, business communications).

Data Processor — when processing data on behalf of customers according to their instructions. Governed by a Data Processing Agreement (DPA) where required. The standard RTBLink DPA is available at rtblink.com/dpa.

6–7. Information We Collect

From Advertisers and Publishers:

• Identity: name, username, account identifiers
• Contact: email, phone, address
• Business: company name, website, advertising preferences
• Financial: payment details, billing information, transaction history
• Technical: IP address, browser type, device information, platform usage

8–9. Processing of End User Data

RTBLink does not intentionally collect directly identifying information (name, postal address, email, passwords, payment cards).

Technical information processed may include:

• IP address, browser type, OS, device type
• Cookie identifiers, advertising IDs, mobile advertising IDs
• Ad impressions, clicks, conversions, timestamps
• Webpage URL, content category, referral URL
• Approximate geographic location (derived from IP)

10. Real-Time Bidding (RTB) Processing

During an RTB transaction, advertising requests are processed within milliseconds. Information involved may include technical device data, advertising identifiers, contextual information, publisher data, consent signals, and fraud prevention indicators.

RTBLink processes RTB-related information only for legitimate advertising purposes and applies safeguards required by applicable data protection laws.

11. Purpose of Processing End User Data

• Delivery of Advertising — displaying ads, managing frequency, ensuring technical delivery
• Advertising Measurement — measuring impressions, clicks, campaign performance
• Advertising Optimization — improving campaign performance and platform functionality
• Fraud Prevention — detecting invalid traffic, bot activity, suspicious behavior
• Platform Security — maintaining infrastructure, preventing abuse
• Legal Compliance — responding to lawful requests, regulatory compliance

12. Legal Bases for Processing

Consent. For personalized advertising and interest-based targeting, RTBLink relies on consent collected by Publishers from End Users through compliant Consent Management Platforms (CMPs). Consent signals are transmitted via bid requests. RTBLink does not serve personalized advertising where a valid consent signal is absent.

Legitimate Interest. Used only for operational and security purposes:

• Fraud detection and invalid traffic prevention
• Platform security and abuse prevention
• Technical monitoring and infrastructure operation
• Internal analytics and service improvement

Legitimate interest is not used as a legal basis for personalized advertising or behavioral targeting.

Contractual Necessity. Processing necessary to provide services to Advertisers, Publishers, and business partners.

Legal Obligations. Processing required by applicable legislation, regulatory authorities, or court orders.

13–16. Cookies and Similar Technologies

RTBLink uses cookies for platform functionality, security, analytics, and advertising.

Cookie Name	Purpose	Duration
RTBLINK_ID	Anonymous advertising identifier	Up to 30 days
RTBLINK_OPT_OUT	Stores advertising preferences	Up to 12 months
RTBLINK_SYNC	Partner synchronization identifier	Up to 14 days
RTBLINK_SESSION	Technical session management	Session duration
rtb_token	Anonymous token for client identification	Up to 3 days

Where required by law, consent is requested before placing non-essential cookies.

17–18. Interest-Based Advertising & Consent Framework

Where consent has been obtained, RTBLink and partners may use cookie identifiers, advertising identifiers, and contextual signals for interest-based advertising.

RTBLink supports IAB Europe Transparency & Consent Framework (TCF) consent signals. Publishers are responsible for implementing appropriate consent mechanisms where legally required.

19. Publisher Responsibilities Regarding End User Data

Publishers must provide privacy notices, obtain required consents, disclose cookie usage, and comply with applicable laws.

Publishers must not transmit: names, email addresses, passwords, payment information, health information, or GDPR Article 9 sensitive data categories.

20. Fraud Prevention and Invalid Traffic Detection

Fraud prevention technologies may analyze IP addresses, device characteristics, traffic patterns, timestamps, and interaction behavior. Legal basis: legitimate interest in maintaining a secure advertising ecosystem.

21–24. Sharing of Information

RTBLink does not sell Personal Data.

Information may be shared with:

• Advertisers and advertising partners (pseudonymized/technical data)
• Publishers (reporting: impressions, clicks, conversions, revenue)
• Technology partners and service providers (cloud, security, payments, analytics)
• Fraud prevention and security providers
• Professional advisors (legal, accounting, audit)
• Government authorities and law enforcement (only where legally required)

All subprocessors are required to maintain confidentiality, implement security measures, and process data only for agreed purposes.

25. International Transfers

Where Personal Data is transferred outside the EEA, RTBLink ensures appropriate safeguards including adequacy decisions, Standard Contractual Clauses (SCCs), and additional technical measures.

26. Data Security

Security measures include: access controls, authentication, encryption, monitoring, restricted employee access. No internet transmission method is guaranteed completely secure.

27. Data Breach Notification

In the event of a breach, RTBLink notifies ÚOOÚ within 72 hours, affected individuals where high risk exists, and affected business partners without undue delay.

RTBLink maintains internal breach detection and response procedures in accordance with GDPR requirements.

28. Account Security Responsibilities

Users are responsible for maintaining confidentiality of usernames, passwords, API credentials, and access tokens. Suspected unauthorized access must be reported to RTBLink immediately.

29. Data Retention

Category	Retention Period	Basis
Account information	Duration of relationship + 3 years	Contractual and legal obligations
Transaction and payment records	7 years	Czech accounting legislation
Advertising and campaign performance data	13 months	Industry standard, ePrivacy
Fraud prevention and security logs	12 months	Legitimate interest
End user technical identifiers (cookies, IDs)	Up to 30 days	ePrivacy, consent scope
API access logs	12 months	Security and audit purposes
Support and communication records	3 years	Contractual and dispute resolution
Legal claims and dispute records	Duration of proceedings + 1 year	Legal obligation

When no longer required, data is securely deleted or irreversibly anonymized.

30–33. Partner Responsibilities & Compliance

Advertisers must ensure lawful campaigns, accurate materials, appropriate privacy notices, and required permissions. Must not use RTBLink for illegal products, deceptive advertising, or unlawful data collection.

Publishers must comply with privacy laws, ensure transparency on cookies, collect required consents, and not transmit sensitive data or bypass consent mechanisms.

DPA — where RTBLink processes data on behalf of partners, a Data Processing Agreement may be entered defining categories, purposes, security requirements, subprocessors, and deletion procedures. See the RTBLink DPA.

34. No Sale of Personal Data

RTBLink does not sell Personal Data for monetary compensation. Data sharing within the advertising ecosystem occurs only for legitimate advertising purposes, service delivery, measurement, and fraud prevention.

35. Your Data Protection Rights (GDPR)

To exercise any right, contact privacy@rtblink.com. RTBLink will respond within one month of receipt. Where requests are complex or numerous, this period may be extended by a further two months — in such cases RTBLink will notify you within the first month and explain the reason. Identity verification may be required before fulfilling certain requests.

• Right to Be Informed — clear information about processing
• Right of Access — copy of Personal Data and processing details
• Right to Rectification — correction of inaccurate data
• Right to Erasure — deletion where data is no longer necessary or consent withdrawn
• Right to Restriction — limit processing in certain circumstances
• Right to Data Portability — receive data in machine-readable format
• Right to Object — object to processing based on legitimate interest or direct marketing
• Right to Withdraw Consent — withdraw at any time without affecting prior processing
• Right to Lodge a Complaint — contact ÚOOÚ at uoou.gov.cz

36. California Privacy Rights (CCPA / CPRA)

California residents may have rights to know, delete, correct, and opt out of sale or sharing of Personal Information. RTBLink does not sell Personal Information for monetary compensation.

Contact: privacy@rtblink.com

37. Children’s Privacy

RTBLink services are for business customers only. RTBLink does not knowingly collect Personal Data from children. Publishers and Advertisers must comply with applicable children’s privacy requirements.

38. Automated Processing and AI

RTBLink may use automated technologies for advertising optimization, fraud detection, and reporting. RTBLink does not use automated decision-making that produces legal effects or similarly significant effects concerning individuals.

39–40. Third-Party Services & Opt-Out

RTBLink is not responsible for third-party privacy practices.

Users may manage personalized advertising preferences through browser settings, device advertising settings, or consent management platforms. Opting out does not prevent all advertising — contextual ads may still be served.

41–43. Changes, Severability & Governing Law

This Privacy Policy may be updated. Material changes will be communicated. Continued use implies acceptance of updated terms.

Governed by the laws of the Czech Republic and applicable EU data protection legislation.

44. Contact Us

AUSHRA Labs s.r.o. | RTBLink
Křemenáčová 90/6, Pitkovice, 104 00 Praha 10, Czech Republic
Company Registration Number: 247 75 967
Privacy Contact: privacy@rtblink.com

---

End of Privacy Policy | Version 1.3 | August 2026