Kinesso Products and Services Privacy Notice

Effective Date: October 6, 2021

KINESSO, LLC and Matterkind, an operating division of KINESSO, (collectively, “KINESSO”) respect the privacy of every individual we process or maintain information about in our products and services. KINESSO provides digital marketing and advertising solutions and technology services that help our clients connect and engage with people in more respectful and beneficial ways. We believe that marketing and advertising done consciously, ethically, and fairly connects people to brand value, creates community, democratizes knowledge and access, and is a vital economic engine. This requires that marketing and advertising across connected digital channels is transparent, accountable, and trustworthy. We call this Digital Responsibility.

This privacy notice describes our product and service offerings, the personal information we collect, how we process and use personal information, the partners we work with, and how individuals can contact us about our privacy practices and exercise their rights in connection with KINESSO’s products and services. Our People Care Center links to resources to express your preferences and exercise control over the use of your personal information in the advertising ecosystem. Please also see our Privacy Center for privacy notices that cover other aspects of Kinesso’s business and operations.

For California consumers, please click here for a description of your state-specific disclosures.

ABOUT KINESSO

Kinesso’s products and services include three areas of capability: connection solutions to match data together and connect across digital channels; a suite of audience solutions which help our clients define audience groups; and a suite of addressable activation capabilities that help our clients prepare, deploy, and measure advertising campaigns. Data enables these capabilities.

Our connection solutions help us reconcile disparate sets of data and connect our clients to their customers and prospective customers in connected channels, such as websites, mobile apps, and connected TV. Our audience solutions enable the development of audience groups who are our clients’ customers or who may be interested in our clients’ products and services. Our addressable activation services help our clients with advertising campaign preparation, deployment, monitoring, measurement, and performance analytics and reporting.

Personal Information Collection and Use

Kinesso Products and Services

To enable our connection and audience solutions, we use personal information about individuals. These two solutions help our clients find their customers and other people that might be interested in their messages, products, or services, and then connect with them using our activation services across connected digital channels such as websites, apps, and connected TV.

Connection Solutions

Foundational to Kinesso’s digital advertising solutions is the ability to accurately, permissibly, and securely connect disparate data sets together. Whenever possible, we store and process information pseudonymously, which means the information can no longer be attributed to an individual without additional information which is kept separately. We receive, maintain, and process permissible personal information to do two things: create our own Kinesso pseudonymous match keys and to perform connections of disparate data sets both internally and with external partners.

Pseudonymization:

Kinesso maintains a restricted system containing directly identifiable personal information sourced from our affiliates and other third-party partners on behalf of Kinesso. We use this system to match information from our clients and partners in a one-way operation that replaces all directly-identifying information they provide with a pseudonymous Kinesso Intelligent Identifier (“Kii”). We maintain the Kiis in a separate data processing environment and use them to perform matching, and to connect to partners’ pseudonymous match keys. Directly identifying personal information is kept separate and apart from non-directly identifying personal information for secure processing.

Connecting disparate data sets:

We use Kiis in order to store, process, and connect information pseudonymously in different data processing environments. For example, we use our Kiis to match across connected channels where we have established relationships with digital platforms. This connection capability enables our clients to reach people in connected channels in more responsible, accountable, and efficient ways.

We perform three types of connections: 1) connecting directly-identifiable data sets to other directly-identifiable data sets; 2) converting directly-identifiable data sets into pseudonymously-keyed data so that it can then be matched to other pseudonymously keyed data sets; and 3) connecting pseudonymous data sets to other pseudonymous data sets.

Connecting directly-identifiable data sets to other directly-identifiable data sets: For directly-identifying matching, we process limited and specific data elements (such as name, address, and email) in a secure, segregated environment. We also perform secure matches of directly identifying information with a small number of external partners.

Converting directly-identifiable data sets into pseudonymously-keyed data so that it can then be matched to other pseudonymously keyed data sets: When we receive directly identifying personal information from clients or other third parties, whenever possible we match this information against our database in a one-way process that removes directly identifiable personal information and re-keys the remaining information with our pseudonymous Kii. The Kiis are then used for internal processing and external connections to the pseudonymous keys used by our partners as described below. Once we complete the conversion of directly identifying personal information to Kii, we delete the directly identifying personal information within a reasonable time.

Connecting pseudonymous data sets to pseudonymous data sets: Each partner has its own pseudonymous partner-specific match key. We match partner-specific match keys to our Kiis and maintain partner-specific connectors (i.e., mappings between a partner’s match keys and our Kiis) for each of the partners in our partner ecosystem.

Audience Solutions

How audience solutions work: our audience solutions include two aspects – (1) data enabled software tools, and (2) Matterkind’s addressable advertising services, including activation, measurement, reporting, and analysis.

DATA-ENABLED SOFTWARE

Data-enabled audience software combines pseudonymized attribute data about people and data processing capabilities. The software contains pseudonymized attribute data about people’s possible interests, demographics, and other characteristics that enables a brand to group their own customers or prospective customers into interested audience groups and help find new audience groups that might be interested in their products or services. To develop an audience for a client, we use permissible demographic and interest attribute data related to individuals and households from our affiliate and third party data partners that meet our quality and responsibility standards. We process this data in pseudonymized form using our Kiis.

Some of our attribute data is collected using survey partners we hire to periodically conduct a marketing survey that collects information from survey respondents, including demographic data and information about their personal interests. In select markets and only where the survey respondent expressly consents, we also collect directly identifiable personal information about the respondents such as their name, address, and email address. We pseudonymize the marketing survey response data using our Kiis or, when necessary, via third party match partners. We then match the pseudonymized marketing survey response data with other pseudonymized demographic, interest and attribute data we control as described above. We use this marketing survey data for the purposes of powering our data enabled software and media planning tools; performing audience research, analysis, and modeling; and other marketing activities or analysis for our clients, partners, and Kinesso affiliates.

MATTERKIND’S ADDRESSIBLE ADVERTISING SERVICES

Matterkind takes a purposeful, people-first approach to help our clients engage audiences and drive brand growth across connected channels. To that end, Matterkind only works with pseudonymous information and does not work with directly identifying personal information such as names, email addresses or phone numbers through our services.

Matterkind client services include addressable media buys, and blending technology, data, inventory, and strategy to provide addressable advertising services to our clients. Using pseudonymized characteristics and interest information about audience groups, Matterkind helps our clients develop audiences most likely to be interested in their products or services. Matterkind then activates, monitors, measures, analyzes, and reports on the delivery of relevant, addressable advertising.

In providing our services to clients, Matterkind relies on Kinesso’s connections solutions and data-enabled software, as well as capabilities provided by external advertising technology (“adTech”) partners to organize personal information into groups or audience segments and activate addressable advertising to these audience groups. In some circumstances, our adTech partners are responsible for determining the legal basis for their processing of information as required under applicable law.

Matterkind’s advertising services include processing pseudonymized personal information to analyze trends, understand audience composition, and predict the audience most likely to have a positive experience with a client’s advertisement. This analysis helps our clients plan and place digital adverting campaigns onto the most appropriate, respectful, and cost-effective sites and apps across connected channels and perform measurement, reporting, and analysis during and after the campaigns.

As instructed by our clients, we place tracking technologies, such as tags, cookies, pixels, beacons, locally stored objects, and other bits of code, on our clients’ websites, apps, and ads that allow our adTech partners to serve ads, collect information to measure ads, and help clients reconnect with people in the future. These technologies collect IP address, mobile advertising ID, browser type, operating system, referral URLs, date/time stamps, pages viewed, and simple keyword tags.

On behalf of clients, we also receive and analyze data from social media platforms and similar partners about user sentiment, engagement and other interactions and references about our clients and their brands to help our clients understand the health of their brand and inform how they communicate with people.

From other adTech partners, such as ad servers, demand-side platforms and sell-side platforms, we receive engagement data related to how people engage with our clients’ advertising. This information helps our clients understand engagement with an online advertisement (if an ad was viewed or clicked) or other relevant interactions (e.g., products purchased). We analyze this information on behalf of clients to designate different audiences for different client brand messages, products and services, measure and report on advertising campaigns, and optimize for efficiency and effectiveness.

Children’s Personal Information

Kinesso’s services are designed for a general audience and not directed to individuals under the age of 18. We do not knowingly collect or solicit personal information from individuals under 18 years old in connection with our services. We do hold and process attribute information related to an adult or household with the presence of individuals under 18 years old, but not the directly identifiable personal information of that individual under 18 years old. This information is processed only for the purpose of creating insights into possible advertising interests of the adults in the household (e.g., a new parent’s interest in diapers). If you have any questions about our practices related to individuals under the age of 18, please contact us as specified in the How to Contact Us section of this Privacy Notice.

Purposes for Processing Personal Information

We use the personal information we obtain for legitimate business purposes, including to:

  • Pseudonymize personal information, which minimizes both the risk of misuse and the onward transfer of directly identifying personal information.
  • Enable our clients to accurately apply people’s expressions of preference and control to their digital advertising campaigns.
  • Provide our services to clients; process, evaluate, and respond to requests and inquiries; and send administrative information, such as changes to our terms, conditions, and policies. We will engage in these activities to manage our contractual relationships and/or to comply with a legal obligation.
  • Enable our clients to market their products and services across connected channels. We will engage in this activity with there is appropriate expressions of consent or where we have a legitimate interest.
  • Operate, evaluate, and improve our business (including developing new services; enhancing and improving our services; analyzing our services; managing our communications; performing data analytics and market research; and performing accounting, auditing, and other internal functions). We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.
  • Protect against, identify, and prevent fraud, security breaches, and other criminal activity and risks. We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.
  • Comply with and enforce applicable legal requirements, relevant industry standards, and our policies, including this Privacy Notice and/or Agency’s Terms and Conditions or Terms of Use. We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.
  • Aggregate and/or anonymize Personal Information so that it will no longer be considered personal information. We do so to generate other data for our use, which we may use and disclose for any purpose.

If you are based in the European Economic Area (“EEA”) or the United Kingdom (“UK”), Kinesso, LLC is responsible for processing your personal information on the basis of our legitimate interests to do so and, in some cases, express consent. Kinesso is a data controller under the relevant data protection laws when we collect personal information to:

  • Maintain a restricted system containing directly identifiable personal information sourced from our affiliates and other third-party partners for purposes of matching information we receive from our clients, affiliates, partners, and other third parties
  • Maintain a separate restricted system containing pseudonymous demographic, attribute, and interest data sourced from our affiliates and other third-party partners for purposes of powering our data-enabled software
  • Source data from third-party marketing survey providers who collect information from survey respondents, including demographic data and information about their personal interests, which helps power our data-enabled software
  • In some markets, we also collect directly identifiable personal information from survey respondents under express consent for purposes of matching marketing survey response data to other demographic, attribute, and interest data within our data-enabled software
  • Maintain mappings between our pseudonymous Kiis and the pseudonymous match keys used by our adTech partners

Sharing Information

We share personal information processed through the services offered by Kinesso and Matterkind with our clients for reporting or measurement purposes, to provide insights and analysis, to help clients understand how their brand is perceived by people and to provide recommendations to clients on media planning. We also share personal information with our affiliates and other service providers to perform analytics or other services on our or our clients’ behalf, to power tools used by our affiliates, to enable the delivery of advertisements tailored to individuals’ predicted interests, to improve placement of advertisements and to improve our services.

In addition to disclosures of information in the ordinary course of business, we also disclose personal information (1) if we are required to do so by law or legal process (such as a court order or subpoena), including laws outside a country of residence; (2) in response to requests by, or cooperate with, government agencies, such as law enforcement authorities, including outside of a country of residence; (3) to establish, exercise, or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to protect our rights, privacy, safety, or property and/or that of our affiliates, individuals, or others; (5) in connection with an investigation of suspected or actual illegal activity; (6) in connection with the sale or transfer of all or a portion of our business, assets, or stock (including in the event of a reorganization, dissolution, or liquidation); or (7) otherwise with individual consent.

Data Transfer

Personal information may be processed and stored in any country where we have facilities or in which we engage service providers.

Personal information may be transferred to countries outside of a country of residence, including the United States (“US”), which may have data protection rules that are different from those of a country of origin. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access personal information.

Additional Information Regarding the European Economic Area (“EEA”)

Some non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect your personal information. You may obtain a copy of the EU’s Standard Contractual Clauses here.

Your Rights and Choices

Where Kinesso acts as controller or covered business under the relevant data protection laws, we offer you certain choices in connection with the personal information we collect about you. If you would like to understand your rights related to the personal information we collect and process or would like to exercise your rights, including the right to review, correct, object to processing, opt-out of use, or delete your personal information, please complete the Web form on our People Care portal, or contact us as specified in the How to Contact Us section of this Privacy Notice. We will respond to your request as quickly as possible and consistent with applicable law.

To protect your privacy and maintain security, we take steps to verify your identity before granting you access to your information. To the extent permitted by applicable law, a charge may apply before we provide you with a copy of your personal information that we maintain.

We believe that data and technology should serve people and are available to discuss concerns and answer questions related to our digitally responsible, data-driven and technology-enabled advertising products and services. To further explore our People Care program and learn how to exercise your choices, please visit our People Care Center.

Retention of Personal Information

We retain personal information for as long as needed or permitted in light of the purposes for which we obtained it and consistent with applicable law. The criteria used to determine our retention periods include:

  • The length of time it is needed for the purposes for which we obtained the personal information;
  • Whether there is a legal obligation to which we are subject; and
  • Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitation, litigation, or regulatory investigations).

How We Protect Personal Information

We use reasonable administrative, technical and physical safeguards designed to protect personal information within our organization. We hold our employees accountable for complying with policies, procedures, and regulations regarding the protection and confidentiality of personal information. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the How to Contact Us section of this Privacy Notice.

Updates to Our Privacy Notice

From time to time, Kinesso may update and revise this privacy notice based on changes in our business environment and changes to applicable law. We urge consumers and clients to periodically visit our website to understand any changes that may have occurred.

How to Contact Us

Kinesso, LLC, located at 100 W 33rd Street, 3rd Floor, New York, NY 10001, is the company responsible for collection, use, and disclosure of your personal information under this Privacy Notice. In addition, Kinesso’s affiliates include localized operating companies in countries around the world where Kinesso does business.

If you wish to exercise any of your privacy rights in connection with personal information processing as a data controller or covered business, or if you wish to contact us in relation to this Privacy Notice or any privacy matter, including our use of your personal information, please complete this form on our online People Care portal. You may also contact us using the following contact details:

ATTN: Digital Responsibility

Kinesso: peoplecare@kinesso.com
Matterkind: peoplecare@matterkind.com

Or for any query or issue, our Data Protection Officer for the UK and the EU can be contacted via email using the following details:

UK or EU DPO
Interpublic Group Limited

For the UK: UK.DPO@interpublic.com
For the EU: GDPR.DPO@interpublic.com

You have the right to lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection law occurs. A list of data protection authorities is available here.