Privacy Policy

1. Controller and Data Protection Officer (DPO)

The controller is VALTEVO, Unipessoal Lda, tax ID 518368521, Portugal, which operates adPluga. You can contact the Data Protection Officer at privacidade@adpluga.com.

2. Our dual role: controller and processor

We are the controller of data we process for our own purposes (e.g., accounts, billing, security). We are a processor when we process data on customers' behalf (e.g., first-party audiences the customer provides, or events from its inventory) — in that case the customer is the controller and a Data Processing Agreement (DPA) applies.

3. Categories of data we process

We process the following categories of data (we do not sell personal data):

• Account and contact — name, email, company, role.
• Billing — plan data, transactions and payment identifiers (processed by payment providers).
• Usage and technical — access logs, device, browser, language.
• Ad delivery — pseudonymized identifiers, hashed IP, user-agent, approximate location, slot/context, to serve, measure and detect fraud.
• Communications — support messages and preferences.

4. Purposes and legal bases

We process data on the following bases (GDPR art. 6; LGPD art. 7 and 11):

• Performance of the contract — to provide and manage the Service, billing and support.
• Legitimate interests — security, fraud prevention (IVT), measurement and product improvement, balanced against your rights.
• Consent — non-essential cookies/tracking and marketing communications, where applicable (revocable at any time).
• Legal obligation — tax, accounting and legitimate requests from authorities.

5. Cookies, SDK and tracking technologies

We use essential cookies and, with consent, measurement cookies. We favor contextual targeting (no third-party cookies). The delivery tag/SDK uses pseudonymized identifiers; test mode generates no production data. Preferences are manageable via our consent banner (CMP).

6. Sharing and subprocessors

We share data only with necessary subprocessors under contract (DPA): hosting/cloud, payment providers, transactional email and observability. We may disclose data where required by law. There is no sale of personal data.

7. International transfers

We operate in the EU and Brazil and may use providers in other countries. Where an international transfer occurs, we apply adequate safeguards (adequacy decisions or standard contractual clauses) under the GDPR and the LGPD.

8. Retention

We retain data for as long as necessary for the purposes: account data while the relationship lasts; event and billing data for legal and anti-fraud periods; test data for a short period. After these periods, we delete or anonymize.

9. Security

We apply technical and organizational measures: encryption in transit (TLS), pseudonymization, isolation of creatives in a sandboxed iframe (anti-XSS), access control (RBAC) and audit logs. In the event of a data breach, we comply with applicable notification deadlines (authority and, where required, data subjects).

10. Automated decisions and profiling

We use automated processing for invalid-traffic detection and to rank ads (relevance/eCPM ranking). These processes do not produce significant legal effects on individual data subjects; you may contact us for clarification.

11. Your rights

You have the right of access, rectification, erasure, portability, objection, restriction, and to withdraw consent, under the GDPR and the LGPD. To exercise them, contact privacidade@adpluga.com. We will respond within legal deadlines.

12. Minors

The Service is intended for professional use and is not directed at minors. We do not knowingly collect data from minors.

13. Supervisory authorities

Without prejudice to other avenues, you may lodge a complaint with the competent authority: CNPD (Portugal/EU) or ANPD (Brazil).

14. Changes to this Policy

We may update this Policy. Material changes will be communicated; the "last updated" date reflects the version in force.

15. Contact

VALTEVO, Unipessoal Lda · Data Protection Officer: privacidade@adpluga.com.