> For the complete documentation index, see [llms.txt](https://docs.exads.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exads.com/general/gdpr-compliance.md).

# GDPR Compliance

Key GDPR concepts that apply to advertising, and how they relate to the Ad Server.

## What is the GDPR?

The [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy and to reshape the way organizations across the region approach data privacy.

## What Does Privacy-by-Design Mean? <a href="#what-does-privacy-by-design-mean" id="what-does-privacy-by-design-mean"></a>

Privacy-by-design is a concept which consists of taking into account data privacy throughout the whole engineering process.

## What is the Difference Between the GDPR and ePrivacy? <a href="#whats-the-difference-between-the-gdpr-and-eprivacy" id="whats-the-difference-between-the-gdpr-and-eprivacy"></a>

An easy and simple way to remember the difference is to think of the GDPR in the context of data protection and ePrivacy in the context of user privacy.

## Is the System a Data Processor or Data Controller? <a href="#is-the-system-a-data-processor-or-data-controller" id="is-the-system-a-data-processor-or-data-controller"></a>

As an ad network and ad exchange, the system acts as a co-data controller, in conjunction with our publishers.

## What is the Difference Between a Data Processor and a Data Controller? <a href="#what-is-the-difference-between-a-data-processor-and-a-data-controller" id="what-is-the-difference-between-a-data-processor-and-a-data-controller"></a>

This distinction is important for compliance and here are the exact definitions of each role:

**Data Controller:**

* A company/organization that collects people’s personal data and makes decisions about what to do with it. So if you’re collecting personal data and are determining how it will be processed, you’re the Controller of that data and must comply with applicable data privacy legislation accordingly.

**Data Processor:**

* A company/organization that helps a controller by “processing” data based on its instructions, but doesn’t decide what to do with data. A controller is the entity that determines the purposes, conditions and means of the processing of personal data, while the processor is an entity which processes personal data on behalf of the controller.

## What Constitutes Personal Data? <a href="#what-constitutes-personal-data" id="what-constitutes-personal-data"></a>

Any information related to a natural person or "Data Subject", that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

There are two sub-categories in personal data:

1. Personally identifiable information (PII) such as a person’s name, surname, phone number, etc.
2. Pseudonymous data or non-directly identifying information, which does not allow the direct identification of users but allows the singling out of individual behaviors (for instance to serve the right ad to the right user at the right moment). Examples: cookie ID, hashed email, device ID ...

***

{% hint style="info" %}
Directly identifying information can be pseudonymized. Pseudonymization is the separation of data from direct identifiers so that linkage to an identity is not possible without additional information that is held separately.
{% endhint %}

***

GDPR establishes a clear distinction between directly identifying information and pseudonymous data. It encourages the use of pseudonymous information and expressly provides that "the application of pseudonymization to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet their data-protection obligations".

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.exads.com/general/gdpr-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.