Data Subject Access Request

TapMind respects applicable data-protection and privacy rights and provides mechanisms for individuals to exercise rights relating to their Personal Data.

This Data Subject Access Request (“DSAR”) Notice explains how you can submit a request to access, correct, delete, or otherwise exercise applicable privacy rights in relation to Personal Data Processed by TapMind.

The rights available to you depend on your location, applicable law, and TapMind's role in the relevant Processing activity.

1. What Is a DSAR?

A Data Subject Access Request is a request made by an individual to exercise an applicable privacy right concerning their Personal Data.

Depending on the applicable law, you may be able to request:

• access to your Personal Data;
• information about how your Personal Data is used;
• correction of inaccurate Personal Data;
• deletion of Personal Data;
• restriction of certain Processing;
• objection to certain Processing;
• portability of Personal Data;
• withdrawal of consent, where consent is the applicable legal basis;
• opting out of certain Processing; or
• other rights provided by applicable law.

Not every right is available in every jurisdiction or for every Processing activity.

2. TapMind's Role

TapMind operates within an AdTech ecosystem that may involve publishers, advertisers, agencies, demand partners, supply partners, DSPs, SSPs, exchanges, marketplaces, measurement providers, and other technology providers.

Depending on the Processing activity, TapMind may:

• Process Personal Data on behalf of a publisher, advertiser, or other customer as a Processor, service provider, or contractor; or
• independently determine the purposes and means of certain Processing and act as a Controller, business, or equivalent entity.

Where TapMind Processes Personal Data on behalf of a customer, that customer may be responsible for determining how a DSAR should be handled.

In such circumstances, TapMind will provide reasonable assistance to the relevant customer as required by Applicable Data Protection Laws and the applicable agreement.

3. How to Submit a Request

You may submit a privacy request through:

• Privacy Request Portal: /privacy-choices/dsar

Email: dpo@tapmind.com

Please identify the right you wish to exercise and provide sufficient information for TapMind to understand and process your request.

If your request relates to Personal Data processed through a particular website, application, publisher, or business customer, identifying that relationship may help us route your request appropriately.

4. Identity Verification

TapMind may take reasonable steps to verify your identity before fulfilling a request.

The level of verification will depend on:

• the nature of the request;
• the sensitivity of the information involved;
• the potential risk of unauthorized disclosure; and
• applicable legal requirements.

TapMind will seek to avoid collecting unnecessary Personal Data solely for verification.

If TapMind cannot reasonably verify your identity, it may be unable to fulfill certain requests where verification is legally required.

5. Authorized Agents

Where permitted by applicable law, you may authorize another person to submit a request on your behalf.

TapMind may require:

• evidence of the authorization;
• information necessary to verify the identity of the individual making the request; and
• information reasonably necessary to verify the identity of the requesting individual.

Additional requirements may apply depending on the jurisdiction and type of request.

6. What Happens After We Receive Your Request?

After receiving a request, TapMind may:

• acknowledge receipt;
• determine the nature and scope of the request;
• verify your identity where required;
• determine whether TapMind acts as Controller, Processor, service provider, contractor, or another role for the relevant data;
• locate relevant Personal Data within TapMind's systems where applicable;
• coordinate with the relevant customer or third party where TapMind Processes data on their behalf;
• determine whether any legal exceptions or restrictions apply; and
• provide the applicable response within the period required by law.

Where TapMind is acting on behalf of a customer, TapMind may refer the request to that customer or provide the customer with the information or assistance necessary to respond.

7. Requests Relating to Publisher or Customer Data

If TapMind Processes your Personal Data on behalf of a publisher, advertiser, application developer, or other customer, that organization may be the Controller or equivalent entity responsible for responding to your request.

For example, if your Personal Data was collected directly by a publisher or application operator and subsequently made available to TapMind for a specific Service, the publisher or application operator may be responsible for responding to your request.

TapMind will provide reasonable assistance where required by Applicable Data Protection Laws and the applicable agreement.

8. Requests for Access

Where you have a legally applicable right of access, TapMind may provide information concerning:

• the categories of Personal Data Processed;
• the purposes of Processing;
• the categories of sources;
• the categories of recipients;
• applicable retention information;
• other information required by applicable law; and
• a copy of Personal Data where legally required.

Access may be limited where disclosure would adversely affect the rights of others, compromise security, reveal confidential information, or otherwise fall within a legal exception.

9. Requests for Correction

Where applicable, you may request correction of inaccurate or incomplete Personal Data maintained by TapMind.

TapMind may require reasonable information demonstrating that the relevant information is inaccurate or incomplete.

Where TapMind does not control the relevant Personal Data because it is Processing it on behalf of a customer, TapMind may refer the correction request to the appropriate customer.

10. Requests for Deletion

Where applicable, you may request deletion of your Personal Data.

TapMind may retain or continue Processing information where permitted or required by law, including where necessary for:

• security;
• fraud or invalid-activity prevention;
• legal compliance;
• exercising or defending legal claims;
• completing transactions;
• maintaining required records;
• fulfilling contractual obligations; or
• other legally recognized exceptions.

Where TapMind Processes Personal Data on behalf of a customer, deletion requests may be handled in accordance with the customer's instructions and the applicable DPA.

11. Objection, Restriction, and Withdrawal of Consent

Depending on applicable law and the legal basis for Processing, you may have the right to:

• object to certain Processing;
• request restriction of Processing; or
• withdraw consent where consent is the applicable legal basis.

Withdrawal of consent does not affect the lawfulness of Processing carried out before withdrawal.

Some Processing may continue where another lawful basis applies or where permitted or required by law.

12. Opt-Out Requests

Certain privacy laws provide specific opt-out rights, including rights relating to:

• sale of Personal Data;
• sharing for cross-context behavioral advertising;
• targeted or interest-based advertising; or
• other Processing identified by applicable law.

These requests may be handled through TapMind's dedicated Opt-Out mechanism.

Opt-Out: /privacy-choices/opt-out

An opt-out request does not necessarily constitute a request to access or delete Personal Data.

13. California Requests

California residents may have additional rights under the CCPA/CPRA, including rights to:

• know/access;
• delete;
• correct;
• opt out of sale or sharing;
• limit certain uses of Sensitive Personal Information, where applicable; and
• non-discrimination.

California residents should also review the:

14. Response Times

TapMind will respond to valid and verifiable requests within the time period required by applicable law.

Where an extension is legally permitted and reasonably necessary, TapMind will provide the required notice.

Response timelines may vary depending on:

• the applicable jurisdiction;
• the type of request;
• the complexity of the request;
• whether additional verification is required; and
• whether another organization must participate in the response.

15. Appeals

Where applicable law provides a right to appeal a decision concerning a privacy request, you may submit an appeal through:

• Appeals: /privacy-choices/dsar

Email: dpo@tapmind.com

TapMind will process applicable appeals in accordance with the requirements of the relevant law.

16. Limitations and Exceptions

Privacy rights are subject to applicable legal limitations and exceptions.

TapMind may decline, limit, or partially fulfill a request where permitted or required by law, including where responding would:

• compromise security;
• interfere with fraud prevention;
• violate another person's rights;
• disclose confidential information;
• conflict with legal obligations;
• require disproportionate effort where a lawful exception applies; or
• otherwise fall within a statutory exception.

Where required, TapMind will explain the applicable basis for denying or limiting a request.

17. No Discrimination

TapMind will not unlawfully discriminate against individuals for exercising privacy rights available under applicable law.

18. Contact Us

For questions or to submit a privacy request:

• TAPMIND TECHNOLOGIES PRIVATE LIMITED

Address: Zed Pentagon, 4th floor, NGR Layout, Bengaluru, India – 560068

Privacy Email: dpo@tapmind.com

DSAR / Privacy Request: /privacy-choices/dsar

Appeals: /privacy-choices/dsar