Privacy Policy – Visitors to partner websites
Version 4.1 – June 15th, 2026
Overview
Nexx360 SAS places great importance on the protection of personal data.
This privacy policy describes the data processing carried out by Nexx360 in connection with its Programmatic Cloud service, when you browse the websites or applications of our publisher clients and partners.
Nexx360’s Programmatic Cloud is a technology solution enabling publishers and sales houses to optimise the monetisation of their advertising inventory through programmatic exchanges.
In this context, Nexx360 acts on behalf of the publishers and sales houses that use the Programmatic Cloud. They remain your primary points of contact for the collection of your consent and the management of your data.
Nexx360 SAS – 144 avenue Charles de Gaulle – 92200 Neuilly-sur-Seine – RCS Nanterre 891 857 674. Contact: dpo@nexx360.io
1. Who are we and what is our role?
Nexx360 acts as a technical service provider — a data processor within the meaning of Article 28 GDPR — on behalf of the publishers and sales houses that use the Programmatic Cloud. User consent choices are collected by consent management platforms (“cookie banners” or CMPs) implemented by partner publishers, and transmitted to Nexx360 via the IAB Europe Transparency and Consent Framework (TCF v2.2). Nexx360 is registered under Vendor ID 965.
In addition to forwarding bids to its Clients’ programmatic partners, Nexx360 may, depending on the configuration chosen by the publisher, select the best bid before returning it to the website you are visiting. This selection is carried out solely on the basis of the publisher’s instructions and the limited data described in section 3.
Technology partners: the Programmatic Cloud may be used by technology partners as part of their own advertising offerings, in particular to monetise third-party publisher inventories. In this case, Nexx360 acts on behalf of these partners, who remain responsible for their contractual relationship with the publishers concerned.
Programmatic partners: SSPs, DSPs, ad exchanges and other players involved in the delivery chain process data under their own responsibility, within the framework of their contractual relationship with the publisher. Nexx360 has no direct contractual relationship with these parties and they have their own privacy policies.
2. How is your data collected?
Nexx360 uses a technical cookie stored on your browser, subject to your consent expressed via the cookie banner of the visited website. This cookie enables the synchronisation of technical identifiers with publishers’ programmatic partners.
Cookie | Domain | Duration | Purpose |
Nexx360 synchronisation cookie | nexx360.com | 3 months | Synchronisation of technical identifiers with programmatic partners (SSPs and other players). |
The cookie allows Nexx360 to transmit a technical identifier only to partners selected by the publisher, within the framework of their contractual relationship, and only where your consent has been collected via the cookie banner of the visited website.
3. What data is processed?
In the context of the Programmatic Cloud, the following data may be processed:
Category | Examples |
Technical identifier | Synchronisation identifier – pseudonymous, with no link to your civil identity. |
Browsing data | IP address (truncated – only the approximate geographic area is retained), device type, browser, URL and category of the page visited. |
Ad request | Technical parameters transmitted by the publisher to enable delivery optimisation (available formats, contextual data). |
Consent choices | Recording of your advertising preferences expressed via the cookie banner. |
What Nexx360 Programmatic Cloud does not do:
Nexx360 Programmatic Cloud does not collect data enabling direct identification (name, first name, email address).
Nexx360 Programmatic Cloud does not process sensitive data (health, political opinions, religious beliefs, etc.).
Nexx360 Programmatic Cloud does not build audience profiles and does not carry out advertising targeting on its own account.
The IP address is systematically truncated : only the approximate geographic area is retained.
4. Why is your data processed?
The processing carried out via the Programmatic Cloud is based exclusively on your consent, collected by the publisher of the visited website. You may withdraw this consent at any time via the cookie banner of the visited website or via the cookie management link available in the footer of the website.
TCF Purpose | Title | Legal basis | Duration |
Purpose 1 | Store and/or access information on your device | Your consent | 3 months |
Purpose 2 | Use limited data to select advertising | Your consent | Duration of the transaction |
Purpose 4 | Use profiles to select personalised advertising | Your consent | Duration of the transaction |
Purpose 10 | Develop and improve our services for the benefit of all our clients. This data is not resold and is not used to create proprietary commercial offerings from Nexx360. | Your consent | Anonymised aggregated data only |
5. Who receives your data
Within the strict framework of the purposes described above, your data may be transmitted to the following recipients:
Publisher and sales house clients using the Programmatic Cloud, in the context of the campaigns they monetise.
Publishers’ programmatic partners (SSPs, DSPs, ad exchanges and other players in the advertising chain), who process data under their own responsibility and according to their own terms.
Nexx360’s technical subcontractors, for hosting and operating the platform:
OVH SAS (Europe) – server hosting
Cloudflare, Inc. (United States) – network protection and routing
Nexx360 does not sell your personal data to third parties and does not use it to create proprietary commercial offerings.
6. Is your data transferred outside Europe?
Nexx360’s servers are hosted in the European Union. One of our technical service providers (Cloudflare) is a US company. Data transfers to this provider are governed by appropriate safeguards, including the standard contractual clauses approved by the European Commission and adherence to the EU-U.S. Data Privacy Framework.
Some programmatic partners selected by publishers may be located outside Europe. These transfers are carried out under the responsibility of the publisher, within the framework of their contractual relationship with those partners.
For more information: dpo@nexx360.io.
7. How long is your data retained?
Data | Maximum duration |
Cookie synchronisation | 3 months |
Display data | 30 days |
Aggregated and anonymised data (performance statistics accessible via the publisher dashboard) | Unlimited retention (anonymised data) |
8. Your rights
In accordance with Articles 15 to 21 of the General Data Protection Regulation (GDPR), you have rights regarding your personal data.
Right | How to exercise it |
Erasure, objection, access (Articles 17, 21, and 15 GDPR) | Visit our dedicated page [link – to be filled in] for instructions on how to submit your request. Please note: since the Nexx360 cookie is used across our entire partner network, a request to erase it will remove the associated data from all partner sites. |
Withdrawal of consent | Directly via the cookie banner of the visited website. Withdrawal takes effect immediately and applies to all purposes. |
Rectification (Art. 16 GDPR) | Not applicable: Nexx360 does not know your civil identity and holds no inaccurate data about you. |
Portability (Art. 20 GDPR) | Very limited applicability: the only available data are technical data with no link to your identity. Requests should be addressed to dpo@nexx360.io. |
For any request: dpo@nexx360.io or via the publisher of the website where you saw a Nexx360 advertisement. Response time: maximum one month.
If your complaint remains unresolved: CNIL – www.cnil.fr
9. Withdrawal of consent and cookie management
The simplest and most immediate way to withdraw your consent is to use the cookie banner of the visited website. Upon receipt of a withdrawal signal, Nexx360 immediately ceases to read and update your cookie. No new data is collected without consent.
Withdrawal of consent and deletion of the synchronisation cookie are two separate matters. Withdrawal of consent stops future processing. To request deletion of your synchronisation cookie, please contact dpo@nexx360.io.
You can also opt out of targeted advertising via the Digital Advertising Alliance portal: optout.aboutads.info.
10. Security of your data
Nexx360 implements appropriate technical and organisational measures to protect your data against any unauthorised access, loss or alteration, in accordance with Article 32 of the GDPR. These measures include, in particular, data flow encryption, strict access controls, activity logging and incident management procedures.
Nexx360 is committed to SOC 2 (Service Organization Control) certification, an international security framework that attests to the robustness of the controls put in place to protect data entrusted by its clients.
11. Amendments to this policy
Nexx360 may amend this policy to reflect regulatory or operational changes. The date of the last update is shown at the top of this document.
