Our GDPR Commitment

At WeForAds, we take data protection seriously. We are committed to handling all personal data in accordance with GDPR principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

As a programmatic advertising platform, we act as both a Data Controller (for data about our publishers, website visitors, and employees) and as a Data Processor (when processing end-user data on behalf of our publisher clients in the context of ad delivery).

Who This Applies To

This GDPR notice applies to:

• Publisher partners — individuals and organisations who use the WeForAds platform to monetize their digital properties
• Website visitors — anyone who visits weforads.com or interacts with our web properties
• Contact form submitters — individuals who submit enquiries or demo requests via our website
• End users (via publishers) — visitors to publisher sites where WeForAds technology is deployed, to the extent we process their data as a processor on behalf of publishers

If you are located outside the EEA, some GDPR provisions may not apply to you, though we extend similar protections globally as a matter of policy.

Data We Process

We apply the principle of data minimisation — we only collect and process data that is genuinely necessary for the specified purpose.

Lawful Bases for Processing

GDPR requires that every processing activity has a documented lawful basis. Here is how we apply each basis:

Your Eight GDPR Rights

Under GDPR, EEA residents have the following rights. We are committed to honouring each one:

Exercising Your Rights

To submit a data rights request, contact us at [email protected] with the subject line "GDPR Data Request" and describe the right you wish to exercise. We may need to verify your identity before processing the request.

Response Timelines

All requests are handled free of charge. If a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or decline the request, explaining our reasoning.

Right to Complain

If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority. For UK residents: Information Commissioner's Office (ICO). For EU residents, find your authority at edpb.europa.eu.

International Data Transfers

WeForAds is a global platform. Where personal data is transferred from the EEA or UK to countries not deemed adequate by the European Commission, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs) — EC-approved model clauses in our contracts with data processors and partners in third countries
• Adequacy Decisions — for transfers to countries formally recognised as providing adequate protection (e.g. Canada, Japan, New Zealand)
• Binding Corporate Rules — for intra-group international transfers where applicable

You may request a copy of the specific safeguards in place for any international transfer by contacting [email protected].

Data Processors & Sub-Processors

We engage the following categories of third-party processors who may process personal data on our behalf. All are bound by Data Processing Agreements (DPAs) meeting GDPR Article 28 requirements:

Publishers using our platform may request our full sub-processor list at any time by contacting [email protected].

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Our retention schedule:

Upon expiry of the retention period, data is securely deleted or anonymised using industry-standard methods.

Technical & Organisational Security

In accordance with GDPR Article 32, we implement appropriate technical and organisational measures proportionate to the risk:

• End-to-end TLS 1.2+ encryption for all data in transit
• AES-256 encryption for all personal data at rest
• Role-based access controls with principle of least privilege and multi-factor authentication
• Annual third-party penetration testing and continuous vulnerability scanning
• Data Protection Impact Assessments (DPIAs) for high-risk processing activities
• Regular staff training on GDPR, data handling, and security awareness
• Documented incident response plan with defined escalation procedures
• Privacy by design and by default integrated into our software development lifecycle

Data Breach Notification

In the event of a personal data breach, WeForAds will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where it is likely to result in a risk to individuals' rights and freedoms (GDPR Art. 33)
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34)
• Document all breaches in our internal breach register, including those that do not require notification
• Implement appropriate remediation measures and review security controls to prevent recurrence

If you believe your personal data has been involved in a security incident, contact us immediately at [email protected].

Data Protection Officer & Contact

WeForAds has designated a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance programme. You can contact our DPO directly for any data protection matters: