TABOOLA PRIVACY POLICY

1. Customers

1.1 Information We Collect from Customers (“Customer Information”)

1.2 Why We Use Customer Information

We use Customer Information for the following purposes:

• Providing our Services. We use Customer Information to provide our Sites and Services and for other customer service purposes in relation to Customer accounts.
• Communicating with you about your Taboola Partnership. We use Customer Information to communicate, via email or otherwise, about Customers’ accounts; to contact Customers about Taboola’s products or services that we think may interest you; to respond to Customer inquiries, requests, or complaints; and to provide Customers with product updates, news, best practices, and other helpful or interesting information that can enhance your use of Taboola’s Services, in accordance with their communications preferences. When we communicate in this way, our emails may deploy a cookie that tracks when the emails are opened to measure Customer engagement. For more information about cookies, please see our Cookie Policy.
• Marketing and advertising. We use Customer Information to provide Customers with newsletters, special offers, and promotions, including via email; and for other marketing, advertising, and promotional purposes, including general updates about Taboola. These communications will be sent in accordance with our Customers’ communications preferences.
• Fraud detection.  We may use your personal data for fraud detection purposes.
• Analytics/measurement. We may process your data for analytics and measurement purposes.

1.3 To Whom We Disclose Customer Information

We may disclose Customer Information as follows:

• Taboola Affiliates. We may disclose Customer Information to any of Taboola’s current or future affiliates (affiliates are companies controlling, controlled by, or under common control with us, including, for example, Taboola.com Ltd., Taboola Europe Limited, Taboola (Thailand) Limited, and Taboola Brasil Internet Ltda., referred to herein as “Affiliates”), parent companies, or subsidiaries to process for the purposes described in this Privacy Policy.
• Taboola service providers. We may disclose Customer Information to vendors, service providers, agents, contractors, or others who perform functions (e.g., maintenance, data analysis, customer relationship management, email marketing, surveys, credit card processing, data hosting, fraud detection) on our behalf.
• Customers. We may disclose Customer Information to other Customers where relevant to the Service we provide. For example, we may provide publishers with information about what advertisers may appear on their network or advertisers with information about which publisher websites their campaigns have appeared on.

1.4 Customer Choices

Customers may access, correct, delete, or update the Information that they have provided to us by either updating the Information in their account, by emailing their dedicated account manager, or by emailing us at support@taboola.com.

We may send periodic promotional or informational emails to Customers in accordance with their communications preferences. At any time, Customers may opt out of such communications by following the opt-out instructions contained in the email. Please note that it may take up to ten (10) business days for us to process opt-out requests. If you opt out of receiving marketing and advertising emails from Taboola, we will still send you emails about your account and any Services that you have requested or received from us.

2. Users

2.1 Information We Collect from Users (“User Information”)

We automatically collect User Information when Users interact with our Services that appear on our Customers’ websites and digital properties. Like most other web-based services, we collect this User Information through cookies and other technologies. Taboola collects only pseudonymized data, which means we do not know who you are because we do not know or process your name, email address, or other identifiable data. Instead, we only process digital identifiers such as cookie IDs, IP addresses, mobile advertising IDs on your device, Taboola network browsing history and associated preferences, and in some limited circumstances, your hashed email address.

User Information that we collect includes, but is not limited to the following:

• Content Discovery Platform: We collect Information about a User’s device and operating system, IP address, the web pages accessed by Users within our Customers’ websites, the link that led a User to a Customer’s website, the dates and times a User accesses a Customers’ website, event information (e.g., system crashes), Information about the interactions with advertisements and Customers’ Services (e.g., availability, visibility, and clicks), general location information (e.g., city and state), hashed email addresses (when made available by the User), and gender (when made available by the User). We ask our Customers to obtain consent on our behalf, where required by applicable data protection laws, for us to collect this User Information. We may also obtain Information about you from our data partners.
• Taboola News: We collect in-app User behaviors (e.g. online status, browsing activity, and clicks) and implicit non-precise device location inferred from search queries (when enabled by the User) and SIM cards or IP addresses. For more information about how we use cookies and other technologies, please refer to our Cookie Policy.
• Taboola Push Notification: We collect Information about Users’ time zone, location (country, region, city), language, mobile operating system (e.g. iOS or Android), browser, connection and internet service provider.

2.2 Why We Use User Information

We use User Information for the following purposes:

• Providing and Improving our Service. We may use User Information to provide and improve our Services to Users and our Customers.
• Tailoring content. We may use User Information to tailor the content and information that we may send or display to Users; to retarget content to Users through our Services and elsewhere; and to otherwise personalize your experiences while using our Services. For more information about how we tailor our content see information below about our Interest Based Advertising.
• Tailoring content across multiple devices. We may use User Information to improve a unique User’s experience across multiple browsers and devices (such as smartphones, tablets, or other viewing devices) by providing better targeted ad campaigns to that User. For instance, should we recognize a User on a web browser, we may want to provide that User similar or personalized content on mobile apps, as well. To do this, we identify unique Users across devices, or we may sync cookies and identifiers with our service providers or Customers that do this, to help our Customers enhance their own data and data segments, or to help them target the right audience.
• Offering our Customers data segments that help target content and advertisements for topics, products, and services that may interest you. A data segment is a grouping of users who share one or more attributes (e.g., travel enthusiasts). We offer a number of data segments, both proprietary and from our data partners, to our Customers so that they may better target Users who are more likely to be interested in their content and advertisements. Taboola does not knowingly create segments that are based upon what we consider to be sensitive information (for example, Personal Data revealing your racial or ethnic origin or your religious affiliations, or Personal Data concerning your sensitive health information, sex life or sexual orientation, or genetic or biometric data).

2.3 To Whom We Disclose User Information

We may disclose User Information as follows:

• Taboola Affiliates. We may disclose User Information to any current or future Affiliates, parent companies, or subsidiaries to process for the purposes described in this Privacy Policy.
• Taboola service providers. We may disclose User Information to vendors, service providers, agents, contractors, or others who perform functions (e.g., maintenance, data analysis, customer relationship management, email marketing, surveys, credit card processing, data hosting, or fraud detection) on our behalf.
• Unaffiliated third parties. We may disclose User Information to other unaffiliated third parties, specifically with (i) our data partners, so that we can connect you with relevant content by allowing our advertisers to target specific audience segments, and (ii) our programmatic demand and supply partners, so that we can serve you with tailored advertisements.
• Customers. We may disclose User Information to Customers where relevant to the Service we provide those Customers. For example, we may provide publishers with information about the viewing and click-through patterns of the content they publish and may provide advertisers with information about conversion rates for analytics purposes.

2.4 User Choices

You have the right to request that Taboola provide you with access to the Personal Data we hold about you, correct your Personal Data, delete your Personal Data, and cease or restrict processing of your Personal Data, and opt-out of the sale or sharing of your Personal Data. Please visit our Global Taboola Data Subject Access Request Portal available here. To opt out of the sale or sharing of your Personal Data, please click the U.S. State Consumer Rights Portal available here.

2.5 Interest-Based Advertising

Through our Services, including our Services on Customer websites, we may provide advertisements to you based on your recent browsing behavior across different Customer websites, browsers, or devices. For example, if on a first online visit, you browse on website A, then on a subsequent visit to website B, you may see content personalized based on your browsing history on website A. For example, if a user visits a clothing retail site, she might see clothing-related ads on another site she visits.

In order to target advertisements to you for products and services that may interest you, we may use cookies, JavaScript, web beacons (including clear GIFs), HTML5 local storage, and other technologies. For more information about how we use these technologies, please refer to our Cookie Policy.

We may also work with third parties such as ad networks, which are third parties that display advertisements based on your visits to websites that you have visited in the past. These advertisers will deliver you targeted advertisements for products and services that may interest you. Third-party ad networks, our advertiser Customers (and their content providers and agents), and/or traffic measurement services may also use cookies, JavaScript, web beacons (including clear GIFs), Flash LSOs, and other technologies to measure the effectiveness of their ads and to personalize advertising content to you. These third-party cookies and other technologies are governed by each third party’s specific privacy policy, not this one.

If you have questions about our collection and use of data for interest-based advertising purposes, please contact us at: support@taboola.com.

2.6 Opt Out

Taboola supports initiatives to offer our Users greater transparency and control over the uses of their Information. Therefore, we offer the following options for controlling the interest-based content and ads you receive.

• If you do not want to receive interest-based ads from Taboola, you can disable the display of such ads by clicking on the opt-out link below. Please note that an opt out will not prevent you from seeing Taboola’s content recommendations. Rather, the opt out will prevent Taboola from using your Information to tailor these recommendations to your interests. You will continue to receive recommendations that are selected based on the particular website that you are viewing (i.e., contextually based ads).
  You are currently: Opted Out Opt In Not Opted Out Opt Out
  • Not Opted Out: Taboola will serve you personalized recommendations based on your history.
  • Opted Out: You have opted out of tracking, Taboola will no longer serve you with personalized content recommendations based on your Internet use history.
• Because our tracking mechanisms operate at the device and browser level, to fully opt-out across devices, you will need to do so on each device and browser individually. If your browsers are configured to reject cookies, your opt-out may not be effective, since we identify your choice to opt-out based on an opt-out cookie we deliver to you. In this case, you will need to confirm that your browser is configured properly in order for the opt-out to be effective. If you are using a Safari browser on iOS11 or macOS High Sierra, you must first adjust your Privacy and Security Settings to turn off both “Prevent Cross-Site Tracking” and “Block All Cookies”, and then return to this privacy policy or your preferred opt out platform to reset your opt out preferences.
• Taboola may use non-cookie technologies in limited cases. Like cookies, these technologies allow Taboola to recommend ads that are tailored to your interests and to remember whether you have chosen to opt-out from our Services. Please note that some web browsers may not permit you to block the use of non-cookie technologies, but you can do so by simply clicking on the Opt Out feature above in this Section 2.6.
• You can also opt-out of receiving targeted ads served by Taboola and other advertising companies.
  • You may use the NAI opt out tool, which will allow you to opt out of receiving targeted ads from Taboola and from other NAI-approved member companies. The NAI also provides instructions to engage system-level mobile device opt outs in Android, iOS, and Windows Phone environments.
  • You may also visit one of the Digital Advertising Alliance affiliate websites to learn more about User choices and opting out of interest-based advertising displayed by the many member companies.
    • Users in the United States may visit the DAA consumer choice page at www.aboutads.info/choices
    • Users in Canada may visit the DAAC consumer choice page at www.youradchoices.ca/choices
    • Users in Europe (including the United Kingdom) may visit the EDAA consumer choice page at www.youronlinechoices.eu
  • You can also opt out of the use of your email address for targeted ads through Audience Matched Advertising or AMA by Taboola and other advertising companies through the NAI Audience Matched Advertising Opt Out (Beta).

  Please note that an opt out from one or more companies listed on the DAA, DAAC, or EDAA consumer choice pages will not prevent you from seeing those companies’ advertisements. Rather, the opt out will prevent these companies from using your Information to display targeted content or ads to you. You may continue to receive advertisements that are selected based on the particular website that you are viewing (i.e., contextually based ads).

  Also, if your browsers are configured to reject cookies when you visit the DAA, DAAC or EDAA consumer choice pages, your opt out may not be effective because your browser will refuse opt-out cookies (that alert companies that you have exercised your opt-out preference).

2.7 Data Retention

We retain User Information, which is directly collected for purposes of serving ads, for at most thirteen (13) months from the User’s last interaction with our Services (often for a shorter period of time), after which time we de-identify the data by removing unique identifiers or aggregating the data.

We retain deidentified or aggregated data, which cannot identify an individual or device and is used for purposes of reporting and analysis, for as long as commercially necessary. We keep opt-out information for longer than this period so that we can continue to honor your opt-out requests.

2.8 Children

We do not knowingly collect any data or target any advertisements on websites directed to children under the age of eighteen (18). If you are the parent or guardian of a child under the age of eighteen (18) and have a concern regarding the Information we collect, please contact us at dpo@taboola.com.

3. Site Visitors

3.1 Information We Collect from Site Visitors

Taboola collects Site Visitor Information either directly from you or from third parties that collect this Information during your use of our Sites. We may combine all the Information that we collect from various sources.

• Information we collect directly from you. We may collect Site Visitor Information directly from you. For example, when you send us an email asking a question, or submit a form on our Sites to receive marketing materials or email newsletters, we will collect the Information that you submit to us. We may also collect any other Information that you choose to provide to us, such as the contents of a message that you submit through our Sites.
• Information we collect from third parties. We may collect Site Visitor Information about you from third parties that collect information on our behalf through your use of the Site, such as web analytics companies. Such information may include, without limitation, information about your operating system, IP address, settings and system configurations, device model, device ID and other unique device identifiers, mobile related information, the web pages you access within our Sites, the website that led you to our Sites, the website to which you go after leaving our Sites, the dates and times that you access our Sites, event information (e.g., system crashes) and web log data.

For more information about how we use cookies and other technologies, please refer to our Cookie Policy.

3.2 Why We Use Site Visitor Information

We use your Site Visitor Information for the following purposes:

• Providing our Service. We use Site Visitor Information to provide and manage our Sites and Services.
• Tailoring content. We use Site Visitor Information to tailor the content and information that we send or display to you on our Sites, and to otherwise personalize your experiences while using our Sites.
• Communicating with you. We use Site Visitor Information to communicate with you, including via email, about our Services; to respond to your inquiries via our website request forms; and to answer any questions or complaints you submit; to provide you with news, best practices or other information that we think may interest you.
• Marketing and advertising. We use Site Visitor Information to provide you with newsletters, special offers, and promotions, including via email; to contact you about products or services we think may interest you; and for other marketing, advertising, and promotional purposes. These communications will be sent in accordance with your communications preferences.
• Analyzing use of our Sites. We use Site Visitor Information to better understand how individuals access and use our Sites, both on an aggregated and individualized basis; to honor their requests and preferences; and for other research, analytical or statistical purposes.

3.3 To Whom We Disclose Site Visitor Information

We may disclose Site Visitor Information as follows:

• Taboola Affiliates. We may disclose Site Visitor Information to any current or future Affiliates, parent companies, or subsidiaries to process for the purposes described in this Privacy Policy.
• Taboola service providers. We may disclose Site Visitor Information to vendors, service providers, agents, contractors, or others who perform functions (e.g., maintenance, data analysis, customer relationship management, email marketing, surveys, credit card processing, data hosting, fraud detection) on our behalf.

3.4 Third-Party Online Advertising

To understand your interests and deliver advertisements that are tailored to your interests, we may work with service providers or third parties that use their own cookies, web beacons, and other technologies to collect Information about Site Visitors’ online activities, either on our Sites and/or other websites across the Internet  (“Taboola Ad Partners”). These Taboola Ad Partners include advertisers and ad networks that may collect Information about when you view or interact with one of their advertisements and may collect information regarding your activities on our Sites and your online activities over time and across different websites. Like most advertisers, Taboola works to place our advertisements where we think they will be most interesting and relevant to the recipient. One way we do this is by allowing ad networks to place their own cookies when an individual visits our Sites. This enables the ad network to recognize individuals who have previously visited the Taboola Sites. Then, if the ad network has purchased ad space on a third-party website, and recognizes that same individual visiting that third-party website, the ad network can deliver a Taboola advertisement, knowing that this individual has already expressed interest in Taboola by visiting the Taboola Sites. To learn more about third parties who collect Site Visitor Information, please review our Cookie Policy.

3.5 Site Visitor Choices

Site Visitors may opt out of the Taboola Ad Partners that collect information on the Sites to serve ads about Taboola. (Some U.S. Site Visitors may exercise their options directly with Taboola, as outlined below in Section 5.2.1 and Section 5.3.1). By visiting one of the Digital Advertising Alliance affiliate websites, you can learn more about User choices and opting out of interest-based advertising displayed by the many member companies.

• Users in the United States may visit the DAA consumer choice page at www.aboutads.info/choices
• Users in Canada may visit the DAAC consumer choice page at www.youradchoices.ca/choices
• Users in Europe (including the United Kingdom) may visit the EDAA consumer choice page at www.youronlinechoices.eu

Please note that an opt out from one or more companies listed on the DAA, DAAC, or EDAA consumer choice pages will not prevent you from seeing those companies’ advertisements. Rather, the opt out will prevent these companies from using your Information to display targeted content or ads to you. You may continue to receive advertisements that are selected based on the particular website that you are viewing (i.e., contextually based ads).

Also, if your browsers are configured to reject cookies when you visit the DAA, DAAC or EDAA consumer choice pages, your opt out may not be effective because your browser will refuse opt-out cookies (that alert companies that you have exercised your opt-out preference).

For Site Visitors who have subscribed to receive emails from us, you can manage your subscription by clicking your unique link that appears at the bottom of each of these emails.

4. General Provisions Applicable to Customers, Users, and Site Visitors

4.1 Why We Use Your Information

We use the Information that we collect from Customers, Users, and Site Visitors for the purposes respectively set forth in Sections 1-3 above, as well as for the following purposes:

• Analyzing use of our Services. We use the Information that we collect to better understand how Customers, Users, and Site Visitors access and use our Site and Services, both on an aggregated and individualized basis; to respond to Customers’, Users’, and Site Visitors’ requests and preferences; and for other research, analytical, and statistical purposes.
• Legal compliance. We use the Information that we collect to comply with applicable legal obligations, including requests from law enforcement or other governmental entities.
• Protecting our rights and interests. We use the Information that we collect to protect our rights and interests and the rights and interests of our Customers, Users, Site Visitors, and the general public, as well as to enforce this Privacy Policy and our Terms of Use.

4.2 Disclosing Your Information

When we share your Information with third parties as specified above, we require such recipients to agree to only use the Information we share with them in accordance with this Privacy Policy and our contractual specifications and for no other purpose than those determined by us in line with this Privacy Policy.

In addition to the disclosures detailed above, we may also disclose Information for the following purposes:

• Business transfers. We reserve the right to disclose and/or transfer Information to another entity if we are acquired by or merged with another company, if we sell or transfer a business unit or assets to another company, if we undergo a bankruptcy proceeding, or if we engage in any other similar business transfer.
• Legal compliance. We may disclose Information in order to comply with the law, regulation, a judicial proceeding, subpoena, court order, or other legal process.
• Protecting rights and interests. We may disclose Information where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Use or this Privacy Policy, or as evidence in litigation in which we are involved.
• Aggregate and de-identified Information. We may disclose to our Customers and other third parties aggregated or de-identified information about users for marketing, advertising, research, or other purposes.

4.3 Cookies and Other Tracking Mechanisms

For more information about how we use cookies and other tracking mechanisms on the Sites and when providing our Services, please refer to our Cookie Policy. You may disable certain tracking as discussed in our Cookie Policy (e.g., by disabling cookies).

4.4 Third-Party Links

Our Sites and Services may contain links to our third-party partners’ websites. Any access to and use of such linked websites is not governed by this Privacy Policy but instead is governed by the privacy policies of those third-party websites. We are not responsible for the information security nor privacy practices of such third-party websites.

For example, our Sites include features from third-party social networking platforms, such as the Facebook “Like” button. These features may collect certain information, such as your IP address or the page you are visiting on our Sites, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or directly on our Sites. Your interactions with these features are governed by the privacy policy of the company providing such features. As another example, our Services link to Customer websites, which are also not governed by this Privacy Policy but by the applicable Customers’ privacy policy.

4.5 Security

We value the security of your Information, including, but not limited to, the Information collected via the Sites or Services. Taboola is ISO 27001 and ISO 27701 certified and we have taken appropriate technical and organisational measures to protect the Information we collect about you from loss, misuse, unauthorized access, disclosure, alteration, destruction, and any other form of unauthorized processing. Please be aware, however, that no data security measures can guarantee 100% security.

4.6 International Data Transfers

We may transfer your Information outside the country in which it is collected, including to a country that may not offer the same level of protection for Information as the country in which you reside. Rest assured, however, that Taboola has arranged all contractual safeguards to ensure your Information is processed in a way that offers an adequate level of protection when it is shared between or among Taboola Affiliates, subsidiaries, and/or parent companies.

If you would like to learn more about EEA/UK Data Transfers, specifically, see Section 5.1.4 below. If you would like to learn more about Thailand Data Transfers, specifically, see Section 5.3.4 below.

5. Regional Privacy Rights

5.1 Notice to Individuals within the European Economic Area (“EEA”) or United Kingdom ("UK")

5.1.1 Data Controller and Representative

If you reside in the EEA or UK, Taboola.com Ltd. will be the controller of your Personal Data provided to, collected by or for, or processed by Taboola in connection with our Services. Taboola.com Ltd. can be contacted at support@taboola.com.

Our representative in the European Union is Lionheart Squared (Europe) Ltd., 2 Pembroke House, Upper Pembroke Street 28-32, Dublin, D02 EK84 Ireland.

Our representative in the UK is Taboola Europe Limited, Aldgate House, 2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom.

5.1.2 Legal Basis for Processing Personal Data

If you are a Customer, Site Visitor, or User from the EEA or UK, our legal basis for collecting and using the Personal Data described above (also referred to in this Section 5.1 as “EEA/UK Data”) will depend on the Personal Data concerned and the specific context in which we collect it.

However, we will normally collect Personal Data from you only (i) where we have your consent to do so, (ii) where we need the Personal Data to perform a contract with you, or (iii) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you or may otherwise need the Personal Data to protect your vital interests or those of another person.

If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as of the possible consequences if you do not provide your Personal Data).

Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, including if you would like to better understand how our legitimate interests to process your data are balanced against your data protection rights and freedoms, please contact us as specified in Section 6 below.

5.1.3 Your Rights to Your Information

You have the right to request that Taboola (i) provide you with access to the Personal Data we hold about you, (ii) correct your Personal Data, (iii) export your Personal Data, (iv) delete your Personal Data, and (v) cease or restrict processing of your Personal Data. Where we have obtained your consent, or our Customers have obtained it on our behalf, you have the right to withdraw it at any time. If you are a User and would like to understand what Personal Data and behavioral information Taboola holds about you, specifically, and how you can exercise any of your rights with respect to your Personal Data, please visit Taboola’s Data Subject Access Request Portal. Customers may also submit a data subject access request by emailing us at privacy@taboola.com so that Taboola may either respond with the relevant information or, if applicable, direct this request to, and cooperate with, your employer to respond.

You have the right to lodge a complaint to a data protection authority about our collection and use of your Personal Data. To learn more, please contact your local data protection authority, via the contact methods available here. However, if you have any questions about our collection and use of your Personal Data, please first contact us at privacy@taboola.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@taboola.com.

5.1.4 EEA/UK Data Transfers

As part of Taboola’s global operations, our data flows among the EEA, the UK, Israel, the United States, Singapore and Hong Kong, and Taboola stores Customer, User, and Visitor information in our data centers located in Israel and the United States.

When Taboola transfers EEA/UK Data to Taboola.com Ltd. in Israel, it relies (as applicable) on (i) the European Commission’s decision, and (ii) UK adequacy regulations that Israel provides a level of data protection that is adequate for EEA/UK Data. These allow the free transfer of EEA/UK Data to Israel without the need for additional data transfer mechanisms.

Beyond that, when Taboola transfers EEA/UK Data to other countries then, if those countries do not have a European Commission adequacy finding and are not the subject of UK adequacy regulations (as applicable), Taboola implements Standard Contractual Clauses approved by the European Commission and/or competent UK authorities (as applicable) to protect the transferred data. The Standard Contractual Clauses are contractual privacy and security commitments that are entered between companies that transfer personal data outside of the EEA.

5.2 Notice to Individuals in the State of California

5.2.1 Your Rights to Your Personal Information

California residents have the right to request that Taboola (i) provide you with what Personal Information Taboola has collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom Taboola discloses Personal Information, and the specific pieces of Personal Information Taboola has collected about you, (ii) correct your Personal Information, (iii) delete your Personal Information, and (iv) opt you out of the sale or sharing of your Personal Information. You also have a right against discrimination for exercising any of these rights, which Taboola is committed to upholding and honoring at all times.

If you would like to opt out of Taboola’s disclosures, sharing, and sales of your Personal Information and cross-context behavioral advertising, you may do so as outlined in Taboola’s U.S. State Consumer Rights Portal. Please note that this feature is currently only available for U.S. state residents with active U.S. state comprehensive privacy laws in effect. If you would like to effectuate additional consumer rights, please visit Taboola’s Data Subject Access Request Portal.

5.2.2 Summary of Consumer Requests

This is a summary of the requests that Taboola received and honored from California residents in the last calendar year.

5.2.3 Categories of Data that Taboola May Hold about You

During the 12-month period prior to the effective date of this notice, Taboola may have used or obtained your Personal Information with respect to our Services and Sites in accordance with the chart below.

Consumer/Data Subject Type	Statutory Category of Personal Information (PI)	Sources of PI	Purpose of Collection	Disclosure of PI
Customers	Identifiers (e.g., unique personal identifier, Internet Protocol address) Additional data subject to Cal. Civ. Code section 1798.80 (e.g., name, address, work phone, employment information through one of Taboola’s general inquiry forms) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (e.g., non-precise geolocation derived from IP address) Professional information (e.g., employment information through one of Taboola’s general inquiry forms)	Please visit section 1.1 this Privacy Notice	Please visit section 1.2 and 4.1 of this Privacy Notice	Please visit section 1.3 and 4.2 of this Privacy Notice
Users	Identifiers (e.g., unique personal identifier, Internet Protocol address) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (e.g., non-precise geolocation derived from IP address) Inferences (e.g., profile created reflecting consumer’s preferences, characteristics, predispositions, behavior)	Please visit section 2.1 this Privacy Notice	Please visit section 2.2 and 4.1 of this Privacy Notice	Please visit section 2.3 and 4.2 of this Privacy Notice
Site Visitors	Identifiers (e.g., unique personal identifier, Internet Protocol address) Additional data subject to Cal. Civ. Code section 1798.80 (e.g., name, address, work phone, employment information through one of Taboola’s general inquiry forms) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (e.g., non-precise geolocation derived from IP address) Professional information (e.g., employment information through one of Taboola’s general inquiry forms) Inferences (e.g., profile created reflecting consumer’s preferences, characteristics, predispositions, behavior)	Please visit section 3.1 this Privacy Notice	Please visit section 3.2 and 4.1 of this Privacy Notice	Please visit section 3.3 and 4.2 of this Privacy Notice

5.2.4 How Taboola Shares Your Personal Information

We may disclose your Personal Information by allowing certain third parties (such as online advertising services, advertising networks, and social networks) to collect Personal Information via automated technologies on our websites for cross-context behavioral advertising purposes. Under California law, such disclosures may be considered a “sale” when the personal information is exchanged for non-monetary consideration, or “sharing” when the personal information is disclosed for cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your Personal Information in accordance with the opt out methods we have provided throughout this notice.

We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the Effective Date of this Statement) the following categories of personal information about you to online advertising services, advertising networks and social networks:

• Commercial Information
• Geolocation Data
• Identifiers
• Internet/Online Activity
• Inferences

We do not have actual knowledge that we sell or share Personal Information of minors under 18 years old.

5.3 Notice to Individuals in Applicable U.S. States

5.3.1 Your Rights to Your Personal Information

Residents of U.S. states with active U.S. state comprehensive privacy laws in effect have the right to request that Taboola (i) provide you with information on/access to the Personal Information that we may hold about you, (ii) correct your Personal Information, (iii) delete your Personal Information, (iv) provide you a copy of your Personal Information, and (v) opt-out of targeted advertising or the sale of your Personal Information. Taboola does not profile in furtherance of decisions that produce legal or similarly significant effects. You also have a right against discrimination for exercising any of these rights, which Taboola is committed to upholding and honoring at all times.

If you would like to opt out of Taboola’s disclosures, sharing, and sales of your Personal Information and targeted advertising, you may do so as outlined in Taboola’s U.S. State Consumer Rights Portal. Please note that this feature is currently only available for U.S. state residents with active U.S. state comprehensive privacy laws in effect. If you would like to effectuate additional consumer rights requests, please visit Taboola’s Data Subject Access Request Portal.

5.3.2 Categories of Data that Taboola May Hold about You

Taboola may have used or obtained your Personal Information with respect to our Services and Sites in accordance with the chart below.

Consumer/Data Subject Type	Category of Personal Information (PI)	Sources of PI	Purpose of Collection	Sources
Customers	Identifiers (e.g., unique personal identifier, Internet Protocol address) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (e.g., non-precise geolocation derived from IP address) Professional information (e.g., employment information through one of Taboola’s general inquiry forms)	Please visit section 1.1 this Privacy Notice	Please visit section 1.2 and 4.1 of this Privacy Notice	Please visit section 1.3 and 4.2 of this Privacy Notice
Users	Identifiers (e.g., unique personal identifier, Internet Protocol address) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (non-precise geolocation derived from IP address) Inferences (e.g., profile created reflecting consumer’s preferences, characteristics, predispositions, behavior)	Please visit section 2.1 this Privacy Notice	Please visit section 2.2 and 4.1 of this Privacy Notice	Please visit section 2.3 and 4.2 of this Privacy Notice
Site Visitors	Identifiers (e.g., unique personal identifier, Internet Protocol address) Commercial Information (e.g., records of products or services purchased, obtained, considered) Internet/online activity (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement) Geolocation Data (e.g., non-precise geolocation derived from IP address) Professional information (e.g., employment information through one of Taboola’s general inquiry forms) Inferences (e.g., profile created reflecting consumer’s preferences, characteristics, predispositions, behavior)	Please visit section 3.1 this Privacy Notice	Please visit section 3.2 and 4.1 of this Privacy Notice	Please visit section 3.3 and 4.2 of this Privacy Notice

We may disclose your Personal Information by allowing certain third parties (such as online advertising services, advertising networks, and social networks) to collect Personal Information via automated technologies on our websites for targeted advertising purposes. You have the right to opt out of these types of disclosures of your Personal Information.

We may sell or share for targeted advertising purposes, the following categories of personal information about you to online advertising services, advertising networks and social networks:

• Commercial Information
• Geolocation Data
• Identifiers
• Internet/Online Activity
• Inferences

5.4 Notice to Individuals in Thailand

5.6.1 Data Controller

If you reside in Thailand, Taboola (Thailand) Limited will be the controller of your Personal Data provided to, collected by or for, or processed by Taboola in connection with our Services.

5.6.2 Legal Basis for Processing Personal Data

If you are a Customer, Site Visitor, or User from Thailand, our legal basis for collecting and using the Personal Data described above (also referred to in this Section 5.3 as “Thailand Data”) will depend on the Personal Data concerned and the specific context in which we collect it.

However, we will normally collect Personal Data from you only (i) where we have your consent to do so, (ii) where we need the Personal Data to perform a contract with you, or (iii) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you or may otherwise need the Personal Data to protect your vital interests or those of another person.

If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as of the possible consequences if you do not provide your Personal Data).

Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

5.6.3 Your Rights to Your Information

You have the right to request that Taboola (i) provide you with access to the Personal Data we hold about you, (ii) export your Personal Data, (iii) delete your Personal Data, and (iv) cease or restrict processing of your Personal Data. If you are a User and would like to understand what Personal Data and behavioural information Taboola holds about you, specifically, and how you can exercise any of your rights with respect to your Personal Data, please visit Taboola’s Data Subject Access Request Portal. Customers may also submit a data subject access request by emailing us at dpo@taboola.com so that Taboola may either respond with the relevant information or, if applicable, direct this request to, and cooperate with, your employer to respond.

If you have any questions about our collection and use of your Personal Data, please first contact us at support@taboola.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@taboola.com.

5.6.4 Thailand Data Transfers

Taboola transfers data outside of Thailand. Taboola has in place an Inter Group Data Transfer Agreement across its international entities, which is based on the EEA’s standard model clauses.

As part of Taboola’s global operations, our data flows among Thailand, the EEA, the United States, Israel, and Hong Kong. To ensure that Thailand Data is adequately protected when transferred outside of Thailand, the Personal Data Protection Act, B.E. 2562 mandates that such transfers take place using certain legal mechanisms.

When transferring Thailand data elsewhere, Taboola relies on Standard Contractual Clauses, set forth by the European Commission, that outline contractual privacy and security commitments between companies that transfer personal data (for example, from Taboola (Thailand) Limited to Taboola, Inc.). Taboola, Inc. and its Affiliates have accordingly adopted Standard Contractual Clauses to ensure the legality, privacy, and security of the data flows necessary to provide, maintain, and develop our services.

Note: Taboola currently stores Customer, User, and Visitor Information in our data centers located in the United States and Israel.

5.5 Notice to Individuals in Brazil

5.7.1 Data Controller

If you reside in the Federative Republic of Brazil (“Brazil”), Taboola Brasil Internet Ltda. will be the controller of your Personal Data provided to, collected by or for, or processed by Taboola in connection with our Services. 

5.7.2 Legal Basis for Processing Personal Data

If you are a Customer, Site Visitor, or User from Brazil, under the Lei Geral de Proteção de Dados federal law 13,709/2018 (the “LGPD”), our legal basis for collecting and using the Personal Data described above (also referred to in this Section 5.4 as “Brazil Data”) will depend on the Personal Data concerned and the specific context in which we collect it.

However, we will normally collect Personal Data from you only (i) where we have your consent to do so, (ii) where we need the Personal Data to perform a contract with you, or (iii) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you or may otherwise need the Personal Data to protect your vital interests or those of another person.

If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as of the possible consequences if you do not provide your Personal Data).

Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), a notice will be provided to you in our disclosure statement.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, including if you would like to better understand how our legitimate interests to process your data are balanced against your data protection rights and freedoms, please contact us as specified in Section 6 below.

5.7.3 Your Rights to Your Personal Data

You have the right to request that Taboola (i) confirm whether we are processing your Personal Data, (ii) provide you with access to the Personal Data we hold about you, (iii) disclose the public and private entities with which we have shared use of your Personal Data, (iv) correct your Personal Data, (v) export your Personal Data, for your own use or use by another controller (vi) anonymize, block, or delete any unnecessary or excessive data, (vii) delete all your Personal Data, and (vii) cease or restrict processing of your Personal Data. If you are a User and would like to understand what Personal Data and behavioral information Taboola holds about you, specifically, and how you can exercise any of your rights with respect to your Personal Data, please visit Taboola’s Data Subject Access Request Portal. Customers may also submit a data subject access request by emailing us at dpo@taboola.com so that Taboola may either respond with the relevant information or, if applicable, direct this request to, and cooperate with, your employer to respond.

Brazilian data subjects can file a complaint in relation to the LGPD with Brazil’s National Data Protection Authority (the “ANPD”). In the meantime, if you have any questions about our collection and use of your Personal Data, please first contact us at support@taboola.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer, Leonie Power, FieldFisher, at dpo@taboola.com.

5.7.4. Brazil Data Transfers

Taboola transfers data outside Brazil. As part of Taboola’s global operations, our data flows among Brazil, the EEA, the United States, Israel, and Hong Kong. To ensure that Brazil Data is adequately protected when transferred outside Brazil, the LGPD mandates that such transfers take place using certain legal mechanisms. Taboola has in place an Inter Group Data Transfer Agreement across its international entities, which is based on the EEA’s standard model clauses, and which may be updated upon further guidance from the future ANPD.

Note: Taboola currently stores Customer, User, and Visitor Information in our data centers located in the United States and Israel.

5.6 Notice to Individuals within the People’s Republic of China (“PRC”)

5.8.1 Processing Entity and Designated Office

If you reside in the PRC, Taboola Information Technology Shanghai Co. Ltd. will be the processing entity of your Personal Information provided to, collected by or for, or processed by Taboola in connection with our Services. Our designated office is located at Room 501i, Unit 501, 5F, No. 61 on East 3rd Middle Road, Chaoyang District, Beijing, China, and Taboola Information Technology Shanghai Co. Ltd. can be contacted at support@taboola.com.

5.8.2 Legal Basis for Processing Personal Information

If you are a Customer, Site Visitor, or User from the PRC, our legal basis for collecting and using the Personal Information described above (also referred to in this Section 5.5 as “PRC Data”) will depend on the Personal Information concerned and the specific context in which we collect it.

However, we will normally collect Personal Information from you only (i) where we have your consent to do so, (ii) where we need the Personal Information to perform a contract with you, or (iii) where the processing is reasonable to support news reporting or the public interest. In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person. If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not (as well as of the possible consequences if you do not provide your Personal Information).

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us as specified in Section 6 below.

5.8.3 Your Rights to Your Information

You have the right to know about and make decisions about the processing of your Personal Information — this includes the right to restrict or refuse the processing of your Personal Information. You also have the right to request that Taboola (i) provide you with access to consult or copy the Personal Information we hold about you, (ii) correct or supplement your Personal Information, (iii) transfer or export your Personal Information, (iv) delete your Personal Information, and (v) cease or restrict processing of your Personal Information. If you are a User and would like to understand what Personal Information and behavioural information Taboola holds about you, specifically, and how you can exercise any of your rights with respect to your Personal Information, please visit Taboola’s Data Subject Access Request Portal. Customers may also submit a data subject access request by emailing us at dpo@taboola.com so that Taboola may either respond with the relevant information or, if applicable, direct this request to, and cooperate with, your employer to respond.

You have the right to complain to the relevant department performing duties of Personal Information protection. However, if you have any questions about our collection and use of your Personal Information, please first contact us at support@taboola.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@taboola.com.

5.8.4 PRC Data Transfers

To provide Taboola’s Services, Personal Information about individuals in the PRC is collected by a server in Hong Kong, and our data then flows between Hong Kong, Israel, the EEA, the UK, the United States, and Singapore. Taboola does not store any Personal Information in the PRC, and instead stores Customer, User, and Visitor information in our data centers located in Israel and the United States.

When Taboola transfers Personal Information about individuals in the PRC to Taboola.com Ltd. in Israel, it relies (as applicable) on standard contractual clauses as set forth by the European Commission. In particular, non-PRC Taboola Affiliates, like Taboola, Inc. in the United States, have accordingly adopted Standard Contractual Clauses to ensure the legality, privacy, and security of the data flows necessary to provide, maintain, and develop our services.

6. Data Broker Requirements

THE ENTITY MAINTAINING THIS WEBSITE IS A DATA BROKER UNDER TEXAS LAW. TO CONDUCT BUSINESS IN TEXAS, A DATA BROKER MUST REGISTER WITH THE TEXAS SECRETARY OF STATE (TEXAS SOS). INFORMATION ABOUT DATA BROKER REGISTRANTS IS AVAILABLE ON THE TEXAS SOS WEBSITE.
The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website.

7. Contact Us

If you have questions about the privacy aspects of our Sites or Services, please contact us at support@taboola.com. If you wish to receive this policy in an alternative format, please contact privacy@taboola.com.

The names and contact details of our Affiliates which may process your Personal Information in their capacity as data controllers, can be found here: www.taboola.com/contact.

Residents in Brazil, China, the European Economic Area (including the United Kingdom) and Thailand, if you wish to escalate your inquiry after contacting the support team, you are welcome to contact our Data Protection Officer, Leonie Power, FieldFisher at dpo@taboola.com.

8. Changes to This Privacy Policy

This Privacy Policy is current as of the Effective Date set forth above.

We may change this Privacy Policy from time to time, so please be sure to check back periodically. We will post any changes to this Privacy Policy on our Sites.

If we make any changes to this Privacy Policy that materially affect our practices with regard to the Information we have previously collected from you, we will endeavor to provide you with notice in advance of such change by highlighting the change on our Sites. We will seek your prior consent to any material changes, if and where this is required by applicable data protection laws.