Privacy Policy

1. Who we are

TEKMA (“TEKMA”, “we”, “us” or “our”) is a Data Management Platform (DMP) based in Dubai, UAE. We help brands, agencies, game studios and publishers understand and reach their audiences by combining mobile, online and location signals into privacy-safe audience segments, and by activating those segments through leading programmatic platforms.

We take the protection of personal data seriously. This Privacy Policy describes what data we handle, why we handle it, who we share it with, and the choices and rights available to you.

2. Scope of this policy

This policy applies to personal data processed in connection with:

• our website, including the contact form;
• the TEKMA Data Marketing (DM) platform and our device graph;
• the creation, enrichment and activation of audience segments;
• our research and insight services, including customer research, app and user analysis, point-of-interest and footfall analysis, tourist traffic research and mobile advertising trends; and
• our business relationships with clients, data partners, DSPs, SSPs and other technology partners.

Exactly which data we process depends on the service involved, the source of the data, applicable law and the privacy choices made by the individual.

3. Our role

Depending on the activity, TEKMA may act as a controller, joint controller or processor.

TEKMA as a controller

When we build and maintain our own audience segments and device graph from data received from our data partners, we decide how and why that data is processed and act as a controller. We also act as a controller for data you send us directly, for example through our contact form.

TEKMA as a processor

When a client uploads its own first-party data to the platform so we can segment, enrich, analyse or activate it on the client’s behalf, we generally act as a processor. In that case we follow the client’s documented instructions, and the client is responsible for having a valid legal basis and for informing its users.

4. Data we collect and receive

A. Information you give us

When you contact us or work with us, we may collect:

• first and last name;
• email address and phone number;
• company name, job title and business details;
• the content of your message and any follow-up correspondence; and
• any other information you choose to share with us.

B. Device and technical data from partners

We receive data from data partners, publishers, SSPs, ad exchanges, measurement providers and other authorised technology partners. This may include:

• mobile advertising identifiers (such as IDFA on iOS and the Android advertising ID), where available and permitted;
• IP address;
• device type, model, operating system and version;
• browser type, language and time-zone settings;
• network and connection type;
• timestamps; and
• consent, objection and other privacy signals, including signals passed through Consent Management Platforms (CMPs).

C. Location data

• Approximate location, such as country or city, inferred from an IP address.
• Precise geolocation, received from partners only where the individual has given the consent required by applicable law, as confirmed by the partner supplying the data.

We use location data to understand visitation patterns, catchment areas and tourist flows, and to build location-based audiences. Footfall and tourism insights are delivered to clients in aggregated form.

D. Derived and inferred data

From the data above, our platform may generate:

• audience segment membership (for example, an interest, lifestyle or behavioural category);
• estimated demographic attributes such as an age range or gender;
• links between devices believed to belong to the same user or household (cross-device recognition); and
• recency and frequency indicators at segment level.

E. Client first-party data

Clients may upload their own data, such as hashed email addresses, advertising identifiers or customer lists, so that we can match, enrich and activate it. We process this data as described in section 3.

F. Website data and cookies

When you visit our website, we may collect technical information such as your IP address, browser type and the pages you view. Where we use cookies or similar technologies that are not strictly necessary, we do so only with your consent where the law requires it.

5. How we use data

Building and maintaining audiences

• creating, enriching and updating audience segments;
• maintaining our device graph and cross-device recognition; and
• matching client first-party data with our segments.

Research, insights and analytics

• producing audience, app-usage, footfall, tourism and advertising-trend reports;
• forecasting behaviour and building predictive models with our AI engine; and
• delivering insights to clients, generally in aggregated or de-identified form.

Audience activation

Where the required legal basis and user choices allow, we make segments available to clients through integrations with DSPs and other programmatic platforms, so that advertising can be delivered across mobile, social, CTV and programmatic channels.

Measurement

We help clients understand whether campaigns reached the intended audiences and how they performed, typically through aggregated reporting.

Security, quality and fraud prevention

• detecting invalid, bot or fraudulent traffic;
• checking the quality and consistency of partner data;
• protecting our systems, clients and partners; and
• diagnosing and fixing technical issues.

Respecting privacy choices

We receive, store and pass on consent and objection signals so that the choices individuals make are respected throughout the data supply chain.

Running our business

We use contact and business information to respond to enquiries, manage client and partner relationships, send service communications and meet our legal obligations.

6. Sensitive data

We do not intentionally create audience segments based on special categories of personal data, such as health, religious beliefs, ethnic origin, political opinions, sexual orientation or trade-union membership. We take steps to exclude sensitive locations, such as medical facilities and places of worship, from location-based audiences.

7. Consent signals from partners

Much of the data we receive comes from partners who collect it directly from users, for example through websites and apps that use a Consent Management Platform (CMP). These partners are responsible for informing users and obtaining any consent that is required.

TEKMA is not currently registered as a vendor in the IAB Europe Transparency & Consent Framework (TCF). However, we:

• require our data partners, by contract, to collect data lawfully and to have a valid legal basis, including consent where needed, before sharing data with us;
• read and respect consent and objection signals passed to us with the data, including TCF strings where a partner provides them;
• do not use data for purposes that the user has not agreed to, where consent is required; and
• pass applicable privacy signals on to the platforms through which audiences are activated.

8. Legal bases for processing

Where the GDPR or a similar law applies, we process personal data only where we have a valid legal basis:

Consent (Article 6(1)(a) GDPR)

We rely on consent where the law requires it, including for building advertising profiles, personalised advertising, use of precise geolocation, and storing or accessing information on a device. You can withdraw consent at any time through the CMP or privacy settings of the website or app where it was given. Withdrawal does not affect processing that took place before it.

Contract (Article 6(1)(b) GDPR)

We process business contact data where needed to deliver services to our clients or to take steps at your request before entering into a contract.

Legal obligation (Article 6(1)(c) GDPR)

We process data where needed to comply with legal or regulatory requirements.

Legitimate interests (Article 6(1)(f) GDPR)

We may process limited data where it is necessary for our legitimate interests, or those of our clients and partners, and those interests are not overridden by your rights. These include:

• security of our network and systems;
• fraud prevention and invalid traffic detection;
• data-quality checks;
• technical troubleshooting;
• responding to business enquiries; and
• establishing, exercising or defending legal claims.

Legitimate interest never replaces consent where consent is required. Further details are set out in our Legitimate Interest Disclosure.

9. Sharing and disclosure

We do not sell personal data in the sense of handing over identifiable customer records in exchange for money. As part of our services, data may be shared with the following parties where a valid legal basis exists:

• clients (brands, agencies, game studios and publishers), usually as segments or aggregated insights;
• DSPs and other programmatic platforms used to activate audiences;
• SSPs, ad exchanges and publishers;
• data partners;
• measurement, analytics and attribution providers;
• fraud-prevention and security providers;
• cloud hosting and infrastructure providers;
• professional advisers such as lawyers and auditors; and
• public authorities, where we are legally required to disclose.

Where privacy signals are attached to the data, we respect them when sharing and pass them on to the receiving party.

10. Profiling and automated processing

Our platform relies on automated processing. Algorithms may, for example, assign a device to an audience segment, estimate a demographic attribute, link devices across screens, predict likely behaviour, or flag traffic as invalid.

Profiling for personalised advertising is carried out only where the required consent has been obtained. We do not make decisions that produce legal or similarly significant effects on individuals solely through automated means.

11. Data retention

We keep personal data only as long as needed for the purpose it was collected for. When setting retention periods, we take into account:

• the purpose of the processing;
• our contractual commitments to clients and partners;
• security and fraud-prevention needs;
• legal and regulatory requirements; and
• applicable limitation periods.

Audience data is refreshed regularly, and data that is no longer needed is deleted or anonymised. Aggregated or anonymised data that no longer identifies anyone may be kept for longer.

12. Security

We use technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. These include access controls, encryption where appropriate, pseudonymisation of identifiers, security monitoring and internal data-protection procedures. No system can be guaranteed to be completely secure.

13. International transfers

TEKMA is based in the UAE, and our partners and service providers may process data in other countries. When personal data subject to the GDPR is transferred outside the European Economic Area (EEA), we rely on an appropriate safeguard, such as:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses approved by the European Commission; or
• another transfer mechanism or exception recognised by law.

14. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• ask us to delete your data;
• restrict certain processing;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time; and
• lodge a complaint with a data protection authority.

If you object to processing based on Article 6(1)(f) GDPR, we will stop that processing unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims.

Opting out of interest-based advertising

• On your phone: you can reset your advertising identifier or limit ad tracking in your device’s privacy settings. On iOS, apps must ask your permission before tracking you.
• Location: you can switch off location sharing for any app in your device settings.
• Consent tools: where a website or app uses a CMP, you can change or withdraw your choices through it at any time.

To exercise your rights, email us at contact@tekma-dmp.ai. Because we generally hold pseudonymous data, we may ask for your advertising identifier or other information needed to locate your data and verify your request.

15. Children

Our services are designed for businesses and are not directed at children. We do not knowingly create audience segments targeting children or use children’s data for personalised advertising. If you believe we hold data about a child, please contact us and we will delete it.

16. Third-party services

Our website may link to, or integrate with, third-party services. Those parties process information under their own privacy policies, and we encourage you to review them.

17. Cookies and device storage

Where our website uses cookies or similar technologies, we use them in line with applicable law and ask for your consent where it is required.

Device-level data that reaches our platform is collected by our partners through their own websites, apps and technologies. Those partners are responsible for any cookies, SDKs or identifiers they use, and for obtaining the consent required to store or access information on a device.

18. Legitimate interest

More detail on the interests we pursue, why the processing is necessary, how we balance it against individuals’ rights, and how to object is available in our Legitimate Interest Disclosure.

19. Changes to this policy

We may update this policy to reflect changes to our services, our data sources or partners, applicable law, or industry standards. Where required, we will give appropriate notice of significant changes. The date at the top of this page shows when the policy was last updated.

20. Contact us

If you have any questions about this policy or how we handle personal data, or if you wish to exercise your rights, please contact us: