adPluga

LGPD and GDPR — Your rights

Documented commitment to Brazil's General Data Protection Law (LGPD) and the EU General Data Protection Regulation (GDPR).

Last updated: June 27, 2026 · Version 1.0

The adPluga platform is operated by VALTEVO, Unipessoal Lda (VAT 518368521), based in Portugal. We process personal data in line with LGPD, GDPR and applicable national legislation. This page summarizes data-subject rights and contact points.

Data subject rights

  • Access and portability

    Confirm whether processing exists, access the data, and obtain a copy in a structured, commonly used format (JSON).

  • Rectification

    Correct incomplete, inaccurate or outdated data.

  • Erasure

    Request data erasure, except where retention is mandatory (billing, anti-fraud, tax obligations).

  • Objection and restriction

    Object to legitimate-interest processing and request restriction while we verify a request.

  • Withdraw consent

    Where processing relies on consent (e.g. measurement cookies), you can withdraw it at any time.

  • Lodge a complaint

    You may complain to CNPD (Portugal), ANPD (Brazil) or your country's supervisory authority.

  • Automated decisions

    Request human intervention and contest decisions made solely by automated means that significantly affect you.

  • Information and transparency

    Be clearly informed about what data we process, for what purpose, and with whom we share it.

Scope and roles (controller and processor)

This page applies to data processing on the adPluga platform. We act as controller for data processed for our own purposes (accounts, billing, security) and as processor when we process data on customers' behalf (e.g., audiences and events from the customer's inventory), in which case a Data Processing Agreement (DPA) applies.

Legal bases

We process data based on performance of the contract, legitimate interests (security, fraud prevention and measurement, duly balanced), consent (non-essential cookies/tracking) and compliance with legal obligations — under GDPR art. 6 and LGPD arts. 7 and 11.

Data processed and purposes

We process account, billing, usage/technical and ad-delivery data (pseudonymized identifiers, hashed IP, user-agent, approximate location) to provide, measure and protect the Service. Full detail is in the Privacy Policy.

Retention

We keep data for as long as the purposes and legal obligations require: the IP and user-agent hashes of delivery events and audience members are deleted after 365 days, and technical logs after 7 days. After these periods, we delete or anonymise.

International transfers

When we use processors outside the EEA or Brazil (e.g. cloud, payments), we ensure transfers under EU Commission Standard Contractual Clauses (SCC) and/or guarantees under LGPD Art. 33.

Subprocessors

The list of active subprocessors is in the Data Processing Agreement (adpluga.com/en/legal/dpa, §7). We give at least 30 days' notice before adding or replacing a subprocessor.

Automated decisions and profiling

We use automated processing for invalid-traffic (IVT) detection and to rank ads (relevance/eCPM ranking). These processes do not produce significant legal effects on individual data subjects; you may request clarification and human intervention.

Incident notification

In case of a personal data breach posing risk to data subjects, we notify the competent authority and affected subjects within applicable deadlines (72h under GDPR, reasonable time under LGPD).

Data Protection Officer (DPO)

To exercise any right or clarify questions about the processing of your data, contact: privacidade@adpluga.com. We respond within the applicable legal deadline (up to 15 business days under LGPD, up to 1 month under GDPR).

Review and version

We review this page periodically and whenever there are material changes to our practices or the legal framework. The last-updated date reflects the version in force.