Skip to main content

​
Understanding data subject rights

Privacy laws such as the General Data Protection Regulation (GDPR) in the EU and California Consumer Privacy Act (CCPA) in the US grant individuals rights concerning their personal data. These are collectively known as data subject rights and they endow individuals (data subjects) with legally-enforceable rights to how their personal data is collected and processed. The key rights under privacy laws include:
  • Right of access: Individuals can request confirmation of whether their personal data is being processed and, if so, obtain a copy of that data along with information about how it is used.
  • Right to erasure: Also known as the “right to be forgotten”, individuals can request deletion of their personal data under certain circumstances.
  • Right to object: Individuals can object to processing of their personal data in certain circumstances, including for direct marketing purposes.

​
Permutive’s role as a data processor

Permutive operates as a data processor, processing personal data on behalf of our customers—typically media companies and advertisers—who act as data controllers. This relationship is governed by the Data Processing Agreement (DPA) between Permutive and each customer. As the data controller, you are responsible for responding to data subject requests from your users. Permutive provides the capabilities necessary for you to fulfill these obligations where we have processed your users’ data as a processor acting on your instructions. The sections below outline how to submit requests to Permutive to action data subject rights on behalf of your users.

​
Right of access requests

To fulfill a data subject’s right of access request, compile the relevant user IDs in a list or spreadsheet and email it to [email protected]. User IDs may be submitted as either Permutive user IDs or identifiers. Please specify which identifier type you are providing in your email. We will action your request within 14 days of receipt and send confirmation once the request is complete.

​
Right to erasure requests

To fulfill a data subject’s right to erasure request, compile the relevant user IDs in a list or spreadsheet and email it to [email protected]. User IDs may be submitted as either Permutive user IDs or identifiers. Please specify which identifier type you are providing in your email. We will respond to confirm the date by which your request will be actioned, which will be no later than 14 days from the date we received your email. For example, a request received on the 1st of a month will be processed by the 15th of that month at the latest. For efficiency, we batch erasure requests. Any additional requests received between your initial submission and the processing date will be included in the same batch. Requests received after the batch is processed will begin a new 14-day cycle. You will receive a separate confirmation email for each request submitted, and a final confirmation once the erasure has been successfully processed.