Data Privacy & GDPR
Personal data handled with responsibility and transparency.
Programmatic LLC respects individual privacy rights and is committed to handling personal data responsibly and transparently. This page explains how our practices align with the General Data Protection Regulation (GDPR) and other applicable data protection laws. It should be read together with our Privacy Policy.
How privacy responsibilities flow through an engagement
GDPR responsibilities can involve lawful processing, controller and processor roles, data subject rights, contractual safeguards, security measures, retention, transfers, and incident response.
1. Our commitment to GDPR compliance
Programmatic implements technical and organizational measures designed to support GDPR principles.
GDPR obligations are addressed through internal policies, contractual safeguards, and operational controls appropriate to the scope of services provided.
- Lawfulness, fairness, and transparency
- Purpose limitation and data minimization
- Accuracy and storage limitation
- Integrity and confidentiality
- Accountability
2. Roles under GDPR
Depending on the engagement, Programmatic may act as a Data Processor when processing personal data on behalf of a client, or as a Data Controller for limited personal data related to our own business operations.
Examples of Programmatic's own business operations include marketing, recruitment, and website usage. Specific roles and responsibilities are defined in applicable agreements.
- Data Processor: processing personal data on behalf of a client
- Data Controller: limited personal data related to Programmatic's own business operations
3. Lawful bases for processing
We process personal data under one or more lawful bases defined by GDPR.
The applicable lawful basis depends on the nature of the data and services involved.
- Performance of a contract
- Compliance with legal obligations
- Legitimate business interests
- Consent, where required
4. Data subject rights
Where GDPR applies, individuals may exercise the rights available to them under applicable data protection law.
Requests may be subject to identity verification and legal limitations.
- Right to access personal data
- Right to rectification of inaccurate data
- Right to erasure, where applicable
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
5. Data Processing Agreements
For services involving the processing of personal data on behalf of clients, Programmatic enters into Data Processing Agreements that define relevant processing and data protection responsibilities.
- Scope and purpose of processing
- Security and confidentiality obligations
- Sub-processor requirements
- Assistance with data subject rights
- Breach notification procedures
6. Security measures
Programmatic applies reasonable and appropriate security controls to protect personal data.
Additional information about our wider security approach is available on the Security & Compliance page.
- Access controls and authentication mechanisms
- Encryption of data in transit
- Secure development and operational practices
- Monitoring and incident response procedures
7. International data transfers
Where personal data is transferred outside the European Economic Area, Programmatic relies on appropriate safeguards.
- Standard Contractual Clauses
- Contractual data protection commitments
- Other lawful transfer mechanisms recognized by GDPR
8. Data retention
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or meet contractual requirements.
Retention periods vary depending on the data type and service scope.
9. Sub-processors
Programmatic may engage trusted sub-processors to support service delivery, including providers used for cloud infrastructure, analytics, or communication tools.
Sub-processors are subject to appropriate contractual and security obligations.
10. Personal data breach response
In the event of a personal data breach, Programmatic maintains procedures for assessing, containing, and responding to the incident.
- Assess and contain the incident
- Notify affected clients without undue delay where required
- Support regulatory notifications as applicable
11. Exercising your rights
To exercise GDPR rights or submit a privacy request, contact Programmatic LLC through our contact page or by email at info@programmatic.llc.
We aim to respond to valid requests within the timeframes required by applicable law.
12. Updates to this page
We may update this page to reflect changes in legal requirements or our data protection practices. Updates will be posted with a revised Last Updated date.
Privacy documentation
Read our full Privacy Policy.
The Privacy Policy explains how Programmatic collects, uses, shares, protects, and retains personal information across our website and business operations.
Read Privacy Policy