gdpr & kwanko

Here's what we are doing to comply with and to help our partners comply with the new regulations.

gdpr roadmap

gdpr documentation

help for advertisers

help for publishers

The EU General Data Protection Regulation entered in force on 25 May 2018. For a matter of transparency, you will find bellow the roadmap Kwanko followed to comply.

Record of processing operations

Kwanko gathered a group of stakeholders to audit all personal data processed for its activity.

The result of the work is a personal data mapping, with for each personal data, the following information :

• Who? Who is the Data Controller and Data Processor?
• Where? Where is stored the data?
• Why? What is the purpose of the process?
• What Legal basis? What is the legal basis for the processing?
• When? Until when is stored the data?

Kwanko gathered a group of stakeholders to audit all personal data processed for its activity.

The result of the work is a personal data mapping, with for each personal data, the following information :

Awareness and training

Kwanko built some training courses via its internal dedicated tool to grow the awareness of its team on the topic. The training courses will be extended in time.

In addition, we reviewed some internal procedures to make sure all personal data is processed with the required confidentiality.

Finally, we reviewed our internal regulation.

Relations with partners

Kwanko has updated its Publishers and Advertisers Terms & Conditions on the light of GDPR.

Kwanko designed a Data Protection Addendum (DPA) for our advertisers, in particular, to bring their attention on their Data Controller role.

Kwanko also has made publically available for its partners the following documents: Record of processing operations, Cookie Inventory, Security Policy, Privacy Policy, Email Marketing Terms & Conditions etc.

Kwanko nominated a DPO, you can reach him on: gdpr@kwanko.com

Implications within our business community

Kwanko has been active in its french professional syndicate (CPA) where we have been working closely with our peers. We have published the result of our work that you find here.

E-Privacy Regulation

Kwanko will be waiting for the final version of the ePrivacy regulation (especially for all which concerns web navigation data).

• Security Policy: - Download it here
• Kwanko cookie inventory: - Download it here
• Email Marketing CPA Policy (in French): - Download it here
• Email Marketing Terms & Conditions: - Download it here

Summary

For CPM and CPC campaigns, GDPR doesn’t have any impact worth to notice as no Personally Identifiable Information (PII) is at stake. The e-Privacy directive and consent rules on cookies usage will have a much bigger impact on these type of campaigns.

For CPL campaigns, Kwanko’s role, as a Data Processor and in regard of the processing means and purpose set by the client, is to collect, store, transfer and/or track a lead for the client.

For emailing campaigns

In co-registration and emulation compaigns

For click-lead campaigns

For CPA campaigns, Kwanko’s role is to track events in order bring back together a sale and an ad displayed on Kwanko’s network. These tracking means can use PII as an email address or an IP address. In addition, Kwanko must store a unique sale id. This unique sale id can be a PII, for which Kwanko does not proceed to any other operation than the collect and the storage to respect its contractual, legal and fiscal obligations.

For retargeting campaigns, Kwanko uses its PartnerTag which allow its publisher network to access to the content of pages the user is visiting. Kwanko never has access to this data, so, a fortiori, neither collects or stores this data (data goes straight from the user browser to the publisher).

To assess the impact GDPR will have on the PartnerTag, we are waiting for the final version of the future ePrivacy directive (which may change from an EU country to the other), which will regulate cookie-based retargeting technologies by making the consent to such retargeting compulsory.

As part of our publisher’s network, we consider you first and foremost as a partner. This is why we think that together, GDPR can become more an opportunity rather than an obstacle.

First, lets not forget that GDPR’s goal is to offer a better experience and build more trust to our users, who, at the end of the day, allow you like us to grow our business. We believe that if users have more trust in publishers and advertisers, the regulation will have an overall positive impact.

By being relevant and transparent, we will be, together, on our way to compliance.

3 concrete examples:

1. The GDPR requires lawful basis for processing. In other words, you need a legal reason to use a user’s data, like consent or legitimate interest. Making sure to have this lawful basis will allow to have more engaged users/visitors. All transparency efforts, in terms of easily accessible information, that you will bring to your users will lead to more trust, and we hope, more performance.
2. The GDPR has specific rules about enabling your contacts to specify exactly what they want to receive from you. This makes total sense from a business perspective. Don’t send to users that don’t want to hear from you, and make sure the ones that do get to choose what they want. This will lead to fewer unsubscribes and better deliverability.
3. The GDPR requires increased transparency around data collection and processing. In legal language, that’s the “right to access”, “portability”, and the “right to be forgotten” which mean your contacts can demand a copy of their data in a common format and/or ask for the deletion of all their personal data. Again, the link between transparency, trust, engagement of your users/visitors and performance is clear.