Privacy Notice Product

Privacy Notice Product

This privacy notice product is to inform you about the processing of personal data when using our platform. Realtime Technologies GmbH (“Kayzen”) ensures a targeted deployment of advertising in apps and mobile websites to draw users’ attention to other apps or mobile websites. To this end, Kayzen offers its Kayzen platform to bring together providers of apps and mobile websites which have ad space (“Providers”) and advertisers who wish to advertise their own apps or mobile websites (“Advertisers”). 

Kayzen uses technologies that are integrated into the apps and mobile websites to allow it to deploy advertising in a more targeted manner to those users who may be interested in the apps or mobile websites advertised and who fit the target groups of the respective advertising (for example, retargeting) campaigns. 

The technologies that are integrated into the apps and mobile websites for this purpose and the associated data processing are monitored by the Providers. Please also refer to their individual privacy policies for more information.

To jump directly to the information on Realtime Technologies GmbH’s opt-out/the possibility to object, please click here: Opt-out.

I. Who processes the data?
The responsibility of the data processing depends on the specific processing: 

1. Kayzen as processor
   • Generally, our customers are responsible for the data processing, e.g. the creation and deployment of targeted advertising in apps and mobile websites, and the measurement of targeted advertising campaigns. In this regard, Kayzen only processes data on behalf of its customers and provides the technical platform to fulfill our customers’ orders. They are the controllers of the data processing, whereas Kayzen is the processor which serves the technical platform.

2. Kayzen as controller
   • Otherwise, Kayzen also processes the data collected in this context exceptionally for its own purposes, e.g. accounting and billing. Then, Kayzen is the controller of this data processing.

3. Contact
   • Kayzen services are provided by Realtime Technologies GmbH (“Kayzen”), Ackerstrasse 29, 10115 Berlin, Germany. You can find further information in our imprint.
   • You can also contact Realtime Technologies’ data protection officer using the following contact information:
     • ISiCO GmbH, Am Hamburger Bahnhof 4, 10557 Berlin, Germany, e-mail: privacy@kayzen.io
   • The data protection officer can be contacted at the above postal address and at the e-mail address given above (keyword: “attn. data protection officer”). We expressly point out that, if you use this e-mail address, the contents will not be exclusively noted by our data protection officer. If you wish to exchange confidential information, we therefore request that you first contact us directly via this e-mail address.

II. How your data is used

1. Purposes of data processing
   • Kayzen processes data on behalf of the Providers so they can market ad space for targeted in-app advertising campaigns. Targeted advertising helps Providers to achieve higher prices for ad space. In the best case, this also causes the use of advertising to become less bothersome and more relevant for users. For Kayzen’s customers, targeted advertising within their campaigns helps reduce costs while reaching users who are genuinely interested in the promoted apps and mobile websites.
   • The usage of Kayzen services can especially include the following customer purposes of data processing:
     • Performance of online marketing campaigns including tracking features for mobile apps or mobile websites as per customer’s instructions (e.g. creation and combination of audiences, targeting and retargeting of specific audiences, generation, selection and optimization of targeting decisions, purchase advertising space in real time using RTB functionalities, defining campaign parameters),
     • Ensuring the security of data processing and the quality and functionality of the Kayzen services so that the customer works with an up-to-date, efficient and safe online platform (e.g. fraud prevention, bot detection, ad security, ad verification services and service misuse prevention, optimisation, testing and automation of functions and features, detection and solving of errors, problems and issues),
     • Provision of the online platform “Kayzen” for the placement of targeted advertisements, through which the customer can manage its marketing campaigns or create, launch and track campaigns (e.g. creation of reports and dashboards, upload and management of external audiences, creation and management of accounts for login on the platform),
     • Provision of managed account services for the online platform “Kayzen” upon customer’s instructions and specified goals, targets, or ranges, e.g. in relation to the budget (e.g. providing assistance for optimization, making suggestions for campaigns), if applicable.
   • Kayzen also processes data for its own accounting and billing purposes.

2. Legal basis of data processing
   • The legal basis for the data processing can be found in our customer’s privacy notice as they are responsible for the data processing.
   • As orientation, usually the following applies for our customers:
     • For users’ personalized advertising, the legal basis is generally your consent given in the consent management platform (CMP) of the app or mobile website according to Art. 6 para. 1 letter a GDPR to forward data and to display the advertising, and the legitimate interest according to Art. 6 para. 1 letter f GDPR to check the consent status which is passed on to us from the Providers. In this case, we are relying on common consent framework technology which ensures the correct obtaining, transfer and documentation of consent for profiling and targeted ads (e.g. IAB’s TCF, OpenRTB).
     • For the data processing of customers’ employees, the legal basis is usually the contractual relationship with the customer according to Art. 6 para. 1 letter b GDPR, or its legitimate interest according to Art. 6 para. 1 letter f GDPR to use the online platform “Kayzen”.
     • Insofar as data from Kayzen is processed for its own purposes, this is done on the basis of Kayzen’s legitimate interests, especially for accounting and billing the usage of the platform. The legal basis in this respect is Art. 6 para. 1 letter f GDPR.

3. Categories of data processed
   • Targeted advertising is implemented using device identifiers, IP addresses or other pseudonyms (hereinafter also referred to as “identifiers”). Kayzen does not know the name, address, or email address of the users of the apps and mobile websites in which advertising is displayed. Therefore, user data is only processed pseudonymously.
   • The following personal data of users can be processed, when it is received from the customer, or from the users’ terminal device when serving ads on customer’s instructions, depending on users’ consent decision:
     • Electronic communications data (e.g. IP address, HTTP header information, user agent)
     • Device data (e.g. device ID, advertising ID, device type, operating system and browser used)
     • Usage data (e.g. web/app content accessed)
     • Event data (e.g. interaction with the ad, clicks, installs, registers, purchases)
     • Ad data (e.g. ad request, ad ID, bid request, bid ID)
     • Consent data (e.g. TC string)
     • Location data, only derived and non-precise (e.g. country, city, region)
   • Furthermore, the following data of customer’s employees can be processed when they are using the online platform “Kayzen”:
     • Login data (e.g. email address, password)
     • Profile data (e.g. name)
     • Usage data (e.g. logfiles, change logs)
     • Further contact details, if applicable

4. Details about the data processing
   • Kayzen’s customers decide for their advertising campaigns, which type of ads (e.g. banners, videos or interactive elements) should be displayed to potential users. These users should correspond to certain criteria and/or target groups. If a user, who corresponds to these target groups, is using an app or mobile website, in which an ad space is available, the data provided to Kayzen facilitate the targeted display of an advertising message.
   • Technically, when an app or mobile website is accessed, the Provider’s system sends a bid request via a specially created platform (often called exchanges) via which ad space is auctioned. If an ad space is available on the app or mobile website and it fits the eligibility criteria of an advertising campaign of a Kayzen customer, Kayzen’s system will place a bid on the bid request (called bid response). Depending on whether the bid response led to a won bid, the related ad space can be acquired within a short timeframe and an impression can be delivered, i.e. the ad is shown to the user.
   • Under these processes, Kayzen does not know the actual identity of users. Kayzen generally receives data about interactions with ads and installations. By means of identifiers, Kayzen can recognise those users who have previously received one of the deployed ads.
   • Besides, the location data (only derived and non-precise) is used to roughly determine the region or approximate location of the user’s device on which the app or mobile website is currently being used. In particular, this location data is intended to ensure that advertising is only displayed for apps and mobile websites that are also available at the user’s respective location, in their app store and/or in the national language. In their campaigns, Kayzen customers specify in which regions the respective ad should be displayed.
   • The process outlined above in general allows Kayzen to bill for its own services with customers and to create statistical reports for customers as well as to measure the reach and efficiency of ads for Kayzen’s customers.

III. Transfer of your data 

1. General information
   • The data we collect about you will only be transferred if there is a legal basis for this in the specific case, in particular if:
     • you have given your explicit consent in accordance with Art. 6 para. 1 letter a GDPR,
     • the disclosure pursuant to Art. 6 para. 1 letter f GDPR is necessary to protect our interests or for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
     • we are legally obliged to disclose your data in accordance with Art. 6 para. 1 letter c GDPR, in particular if this is necessary for legal prosecution or enforcement due to binding requirements (e.g. in the context of tax audits by the tax authorities), official enquiries, court orders and legal proceedings, or
     • this is legally permissible and required pursuant to Art. 6 para. 1 letter b GDPR for the processing of contractual relationships with you or for the implementation of pre-contractual measures taken at your request.
   • Some of the data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular, data centers, software providers (e.g. for logfile management), IT service providers, help desks, agencies, market research companies and consultancies. If we pass on data to our service providers, they may only use data to fulfill their tasks. Service providers are carefully selected and commissioned by us.
   • Furthermore, we share your data with our group companies on the basis of a joint controller agreement to perform jointly determined purposes for our services, including especially customer management, campaign management, trading management, product development, and analytics. For all aspects regarding this joint processing of data with our group companies, we are your preferred contact point.

2. Specific information
   • Kayzen discloses data to third parties where necessary for the display of advertising, the execution of campaigns on behalf of its customers, or for other purposes outlined in this Product Privacy Notice.
   • The collection, storage and disclosure of data by the Providers (where ad space is made available) – including data related to ad impressions, and user interactions with ads – as well as data processed about app installations are carried out under the sole control and responsibility of those respective Providers. Kayzen processes such data strictly on behalf of its customers and in accordance with their instructions.
   • As part of the ad delivery process, data is also exchanged between Kayzen and external platforms (exchanges) that facilitate programmatic auctions for mobile ad inventory. When Kayzen receives a bid request and wins ad space for a customer through such an auction, it replies with a bid response and transmits the relevant ad creative to the platform.

3. Transfer to third countries
   • We may use services whose providers are partly located in so-called third countries (outside the European Union or the European Economic Area) or transfer personal data there, i.e. countries whose level of data protection does not correspond to that of the European Union.
   • If there is an adequacy decision by the European Commission (Art. 45 GDPR) for these countries, we base the data transfer on this. This applies, for example, to transfers to Argentina, Israel, Japan, Canada, the Republic of Korea, New Zealand, Switzerland, Uruguay or the United Kingdom. In the case of the USA, this only applies if the US recipient has certified itself for the EU-US Data Privacy Framework.
   • Where the European Commission has not issued an adequacy decision for these countries, we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include, among others, the standard contractual clauses of the European Union or binding internal data protection regulations (Art. 46 GDPR).

IV. Retention period

We store your personal data only as long as it is necessary for the fulfillment of the purposes for which we have collected your data. Thereafter, we delete your data, unless we need your data as evidence for civil law purposes or until the statutory retention periods expire or there is another legal basis under data protection law for the continued processing of your data in the specific individual case.

If an ad has been deployed or if an interaction with ads or an installation or interaction with a new app or mobile website has occurred, Kayzen stores information on the successful deployment, interaction or installation. This is used to monitor the type and number of deployments in order to process and check the billing of campaigns to Kayzen customers, to detect and correct technical and other errors and conspicuous constellations in the context of the deployment of ads or the installation of and interaction with apps and mobile websites. 

The data is stored for as long as the usage data and data about interactions with ads and installations of the new apps and mobile websites are required for these purposes. After that the data is erased or completely anonymised. 

User data will generally only be stored in case that a bid request is relevant and  the bid has been won and the ad has been displayed. In this case, user data is stored for six months. Otherwise, if bid requests are not bidded on or a bid response was placed but the bid was not won or a bid was won but the ad has not been displayed, user data is deleted within nine days.

V. Your rights

You have the rights of data subjects set out in Art. 7 para. 3, Art. 15 – 22 GDPR at any time if the respective legal requirements are met:

• You have the right to obtain information about the processing of your personal data by us at any time. We will explain the data processing to you and give you an overview of the personal data we store about you (Art. 15 GDPR). 
• If your personal data stored with us is incorrect or no longer up to date, you have the right to have this data corrected (Art. 16 GDPR).
• You also have the right to have your data deleted (Art. 17 GDPR). If deletion is not possible due to other legal requirements, your data will be blocked so that it is only available for the legally prescribed purposes. 
• You also have the right to restrict the processing of your personal data (Art. 18 GDPR) if, for example, you dispute the accuracy of the data. 
• You also have the right to data portability (Art. 20 GDPR), i.e. we will provide you with a digital copy of your personal data stored with us upon request.
• You have the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you, including, where applicable, the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision (Art. 22 GDPR).

However, since Kayzen generally processes data on behalf of customers, users may better contact the Providers of the respective apps or mobiles websites and/or the Advertisers, who process their data in accordance with their own privacy policies. If you contact us regarding data processing in the Providers’ or Advertisers’ own responsibility, we forward your request to these companies.

Right of withdrawal (Art. 7 Para. 3 GDPR):

• You have the right to withdraw your consent at any time. This means that we will no longer process the data based on this consent in the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

Right of objection (Art. 21 GDPR):

• General objection: If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time on grounds relating to your particular situation.
• Objection for direct marketing: If it is a matter of objecting to the processing of data for direct marketing purposes, you have a general right of objection, which will also be implemented by us without giving reasons.

Assertion of your rights:

• If you wish to exercise your right of withdrawal or objection, it is sufficient to send an informal message to the above contact details.
• Finally, you have the right to complain to any data protection supervisory authority. You can assert this right, for example, with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement. In Berlin, where we are based, the competent supervisory authority is: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
• To exercise your rights described here, you can contact us at any time using the contact details above. This also applies if you wish to receive copies of guarantees demonstrating an adequate level of data protection. Provided that the respective legal requirements are met, we will comply with your data protection request.
• Your enquiries regarding the assertion of data protection rights and our responses to them will be stored for documentation purposes for a period of up to three years and, in individual cases, for a longer period if there are grounds for asserting, exercising or defending legal claims. The legal basis is Art. 6 para. 1 letter f GDPR, based on our interest in defending against any civil claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR and fulfilling our accountability obligations under Art. 5 para. 2 GDPR.

VI. Opt-out in-app advertising

You can withdraw your consent for in-app advertising at any time. Besides this, you have the following possibilities to prevent personalized advertising:

Kayzen offers an opt-out/possibility to object. If you no longer wish to receive targeted in-app advertising that is deployed based on Kayzen services, please use the following link: Disable ad deployment by Kayzen.

You also have the option of preventing the deployment of targeted advertising on your device via advertising ID. You can find the required setting in your device’s system settings: 

• iOS: “Privacy & Security” > “Apple Advertising” > “Personalized Ads”: https://www.apple.com/legal/privacy/data/en/apple-advertising/; 
• Android: “Privacy” > “Ads” > “Delete Advertising ID”: https://support.google.com/googleplay/android-developer/answer/6048248#zippy=%2Cdelete-your-devices-advertising-id;.

Please note that this opt-out only applies to the device used. With regard to data processing by the Providers or Advertisers, please use the withdrawal, objection and opt-out options available there.

VII. Changes to this privacy notice

From time to time, we may update this privacy notice, for example, if we make changes to our services or if legal or regulatory requirements change.

Version: 2.0 / Status: 02 February 2026