Advertising privacy
Ad360 Advertising Privacy & TCF Disclosure
How the Ad360 demand-side platform processes advertising-related data, the legal bases it relies on, and how privacy signals govern every bid decision.
- Effective date
- June 4, 2026
- TCF Vendor ID
- IAB Europe TCF v2.2 · Vendor 1071
Overview
Ad360 is a demand-side platform (DSP) and Google Authorized Buyer operated by Menadex Ltd. This document describes how the Ad360 bidding platform processes advertising-related data when it receives and responds to OpenRTB bid requests. It is the canonical reference for how privacy signals govern that processing.
Ad360 operates as a final bidder, not as an exchange routing requests to downstream bidders: it evaluates each opportunity and returns a bid or a no-bid.
This disclosure supplements the Ad360 Privacy Policy, which covers the organisation's broader data handling, and the Cookie Policy, which covers the public marketing website.
Controller and processor roles
Ad360 acts in two distinct roles depending on the processing activity.
- Processor — for Advertising Data supplied by or on behalf of a client. Clients retain ownership of their Advertising Data; Ad360 processes it under the applicable Master Service Agreement and Terms of Use to operate campaigns on the client's behalf.
- Controller — for the Ad360 advertising identifier, and, depending on the processing activity, for bid-request processing for eligibility and optimization, audience statistics, fraud prevention, and service development and improvement, where Ad360 determines the purposes and means.
IAB Europe TCF v2.2 participation
Ad360 is a registered vendor under the IAB Europe Transparency & Consent Framework (TCF) v2.2. Ad360's Global Vendor List (GVL) identifier is Vendor ID 1071.
Participation means Ad360 declares its purposes, legal bases, data categories, retention, and device storage to the GVL; reads the Transparency & Consent (TC) string presented on each request; and processes personal data only within the permissions that string conveys for Vendor 1071.
Purposes and legal bases
Within the TCF, Ad360 declares the following purposes and legal bases. Personalised-advertising purposes are processed on consent only, consistent with TCF v2.2, which removed legitimate interest as a basis for those purposes.
| TCF purpose | Legal basis | Retention |
|---|---|---|
| 1 · Store and/or access information on a device | Consent | See device storage |
| 2 · Use limited data to select advertising | Legitimate interest (default) | 365 days |
| 3 · Create profiles for personalised advertising | Consent | 365 days |
| 4 · Use profiles to select personalised advertising | Consent | 365 days |
| 5 · Create profiles to personalise content | Not used | — |
| 6 · Use profiles to select personalised content | Not used | — |
| 7 · Measure advertising performance | Consent | 365 days |
| 8 · Measure content performance | Not used | — |
| 9 · Understand audiences through statistics | Consent | 365 days |
| 10 · Develop and improve services | Legitimate interest | 365 days |
Special Features and Features
Purpose 11 (use limited data to select content) is not used: Ad360 selects advertising, not editorial or platform content. Ad360's use of TCF Special Features is constrained:
- Special Feature 1 — Use precise geolocation data: enabled, but used only after explicit user opt-in. Without opt-in, Ad360 does not use precise geolocation and falls back to coarse location where permitted.
- Special Feature 2 — Actively scan device characteristics for identification: not enabled. Ad360 does not rely on device fingerprinting, even where a TC string signals it.
- Features used: matching and combining data from other sources; linking different devices; and identifying devices based on information transmitted automatically.
The privacy decision
Privacy signals are not interpreted ad hoc throughout the bidder. Immediately after a bid request is parsed, Ad360 computes a single deterministic privacy decision from the applicable signals. Every downstream stage — line-item eligibility, request normalisation, audience and AI filters, creative and tracking-URL generation, and logging — consults that decision and cannot route around it.
Among other things, that decision resolves:
- The permitted bidding mode — whether Ad360 may bid at all, may personalise, or may serve only a contextual ad.
- Identifier and sync permissions — whether the hashed buyer ID may be used or stored, whether the Google user ID or external identifiers may be used, and whether cookie matching is allowed.
- Data-use permissions — whether a profile may be built, whether audience and user data may be used, and whether precise or only coarse location may be used.
- Measurement and logging permissions — whether identifiers may be logged, and whether data may be used for attribution, frequency capping, or fraud detection.
- Recorded metadata — the applicable retention period, the privacy jurisdiction, the source of the governing signal, and a reason code documenting how and why the decision was reached.
TCF signal handling
For EU, EEA, UK, and Swiss traffic, Ad360 reads the TC string and applies the permissions recorded for Vendor 1071.
- A valid TC string with the required consents allows pseudonymous identifier use, profile creation and updates, audience activation, measurement, frequency capping, fraud detection, and personalised bidding — each subject to its purpose and retention.
- Personalised advertising requires consent for Purpose 1 (device storage/access), Purpose 3 (profile creation/update), and Purpose 4 (profile-based selection); user-level measurement requires Purpose 7.
- If Vendor 1071 is not disclosed or not permitted, Ad360 suppresses identifiers, profile updates, audience use, cookie matching, precise geolocation, and user-level tracking.
- A missing, expired, malformed, or ambiguous TC string fails closed for personal-data processing.
GPP, US Privacy String, and Global Privacy Control
For US traffic, Ad360 parses the Global Privacy Platform (GPP) string and its applicable section identifiers, together with the legacy US Privacy String. Where signals overlap or conflict, Ad360 applies the stricter outcome.
An opt-out of sale, sharing, or targeted advertising suppresses personalised data uses — audience targeting, profile building, cookie sync, external identifiers, retargeting, and precise geolocation — while contextual bidding and permitted operational processing continue.
Ad360 treats the Global Privacy Control (GPC) browser signal as an opt-out of sale and sharing where applicable law recognises it, resolved stricter-of with GPP and the US Privacy String.
Google privacy signal handling
As a Google Authorized Buyer, Ad360 also reads Google-provided privacy signals on the request, including the GDPR-applies flag (regs.ext.gdpr), Google privacy treatments, non-personalised-ads and limited-ads indicators, and child-directed treatment signals. These are incorporated into the privacy decision and, where they are stricter, take precedence.
Use of identifiers
Ad360 distinguishes user identifiers from business identifiers and governs them differently.
- User identifiers — the Ad360 advertising identifier (__ad360_ad360uuid), hashed buyeruid, Google user ID, external IDs (eids), device identifiers, IP address, and precise geolocation — are pseudonymous personal data. They are processed only when permitted by the applicable privacy signal, tied to a documented purpose, access-controlled, and retention-limited.
- A hashed buyeruid is pseudonymous personal data, not anonymous data. It is stored only when privacy signals permit and a retention period is defined.
- Business identifiers — agency, advertiser, campaign, line-item, and creative IDs — are operational identifiers, not user identifiers. They are retained in reporting, analytics, billing, pacing, and reconciliation systems.
Device storage disclosure
Ad360 maintains a single advertising identifier in device storage: the cookie __ad360_ad360uuid on the *.ad360.media domain. It is associated with TCF Purposes 1, 2, 3, 4, 7, 9, and 10; has a maximum age of 365 days (31,536,000 seconds); and is refreshed within that window.
It is written or refreshed only when Purpose 1 and the relevant downstream purposes are permitted by the applicable privacy signal. The public marketing website's cookie behaviour is described separately in the Cookie Policy.
Data categories processed
Ad360 declares the data categories it processes, and those it does not.
- Collected or held: IP addresses; device characteristics; device identifiers; browsing and interaction data; non-precise (coarse) location data; and the user's privacy choices.
- Not used: probabilistic identifiers; authentication-derived identifiers; user-provided data; and standalone user profiles obtained from third parties as such.
- Precise geolocation is processed only under Special Feature 1 opt-in; absent opt-in, only coarse location is used.
- Ad360 does not knowingly process special-category data, and does not knowingly build segments on sensitive categories for EEA users.
Retention periods
Ad360 applies per-purpose retention. Advertising and device identifiers used for permitted advertising purposes default to 365 days, and only while the applicable privacy signal permits the relevant purpose. Debugging-only flows use shorter periods; longer retention applies only where justified for fraud prevention, attribution, contractual reporting, or legal obligations.
User rights
Subject to applicable law, individuals may request access to, correction of, deletion of, or restriction or objection to processing of their personal data, and may withdraw consent at any time.
Because Ad360 processes pseudonymous identifiers rather than directly identifying information, requests relating to the Ad360 advertising identifier should reference the identifier or the context in which it was set. EU/EEA, UK, and Swiss individuals may also complain to their supervisory authority.
Ad360 responds within one month, extendable by two further months for complex or numerous requests, consistent with the GDPR.
Opt-out mechanisms
Consent can be withdrawn through the consent management interface on the property where it was given; withdrawal is read by Ad360 in real time.
US residents may opt out of sale, sharing, and targeted advertising via the GPP signal, the US Privacy String, or the Global Privacy Control. On opt-out, Ad360 suppresses personalised processing and continues only contextual and permitted operational processing.
Requests may also be sent to privacy@ad360.media.
TCF purposes and special features referenced on this page
Plain-language explanations of the IAB Europe TCF v2.2 purposes and special features referenced above. Purposes marked as not used are listed for completeness.
- Purpose 1 — Store and/or access information on a device
- Cookies or similar identifiers may be stored on, or read from, your device. IAB reference ↗
- Purpose 2 — Use limited data to select advertising
- Ads can be selected using limited, non-profile data such as the content you are viewing and basic request details. IAB reference ↗
- Purpose 3 — Create profiles for personalised advertising
- Information about you can be combined into a profile used to make advertising more relevant. IAB reference ↗
- Purpose 4 — Use profiles to select personalised advertising
- A profile built about you can be used to choose which ads you see. IAB reference ↗
- Purpose 5 — Create profiles to personalise content
- Building a profile to tailor non-advertising content. Not used by Ad360. IAB reference ↗
- Purpose 6 — Use profiles to select personalised content
- Using a profile to tailor non-advertising content. Not used by Ad360. IAB reference ↗
- Purpose 7 — Measure advertising performance
- Measuring whether and how ads were delivered and performed, at the level of an individual user. IAB reference ↗
- Purpose 8 — Measure content performance
- Measuring how non-advertising content performs. Not used by Ad360. IAB reference ↗
- Purpose 9 — Understand audiences through statistics
- Producing aggregated statistics about audiences to understand reach and effectiveness. IAB reference ↗
- Purpose 10 — Develop and improve services
- Using data to maintain, secure, debug, and improve products and services. IAB reference ↗
- Purpose 11 — Use limited data to select content
- Selecting non-advertising content using limited data. Not used by Ad360. IAB reference ↗
- Special Feature 1 — Use precise geolocation data
- Using precise location data from your device, used by Ad360 only after explicit opt-in. IAB reference ↗
- Special Feature 2 — Actively scan device characteristics for identification
- Identifying a device by actively scanning its characteristics (fingerprinting). Not used by Ad360. IAB reference ↗
Contact
Questions about advertising-related processing may be directed to privacy@ad360.media.
Menadex Limited. 25 Herbert Place, D02 AY86, Dublin 2, Dublin, Ireland.