01Who we are and the scope of this policy
This Privacy Policy explains how MISSENA, a société par actions simplifiée (SAS) with a share capital of €149,189, registered with the Créteil Trade and Companies Registry (RCS Créteil) under number 824 333 421, whose registered office is located at 14 avenue du Général de Gaulle, 94160 Saint-Mandé, France ("Missena", "we", "us", "our") collects, uses and discloses personal data when an advertisement is requested, selected or delivered through our advertising technology (our "Services") on the websites and applications of our publisher partners ("Publisher Properties").
This policy covers the data we process as part of our advertising Services — i.e. when you browse a Publisher Property that uses Missena to monetise its inventory. It also describes, in Section 13, how we handle data of visitors to missena.com and of our business contacts.
This policy does not govern how our publisher and advertiser partners process data through their own properties; those activities are governed by their respective privacy policies.
02Our role: joint controllership with publishers
For the processing of end-user personal data carried out through the Services, Missena acts as a joint controller together with the publisher operating the Publisher Property, within the meaning of Article 26 GDPR.
In practice:
- The publisher is responsible, on its property, for informing you and for collecting your consent (or, where applicable, recording your objection) before our technology is activated, generally through a Consent Management Platform (CMP).
- Missena is responsible for processing the resulting data for the purposes set out in Section 5, in line with the choices transmitted to us.
A summary of the essence of the arrangement between joint controllers is available on request at the contact details in Section 15.
03Personal data we process
We do not process data that directly identifies you (such as your name, postal address or email). We process technical identifiers and signals that, alone or combined, allow your browser or device to be recognised. Under the GDPR — and consistent with the position confirmed by the French Conseil d'État in 2026 regarding pseudonymous advertising identifiers — these identifiers are treated as personal data.
We may process:
- Online identifiers: cookie identifiers, mobile advertising identifiers (e.g. IDFA / AAID), and identifiers provided by third-party identity solutions where consent allows, in particular ID5, LiveRamp (RampID) and UID2;
- Device and connection data: IP address, browser type and version, operating system, language, plugins;
- Approximate location derived from the above (e.g. country / region);
- Bid-request signals (OpenRTB): the Publisher Property URL / app, page context, ad-slot characteristics, and the consent signals (TCF string) transmitted with the request;
- Interaction data: ad impressions, viewability, clicks and similar measurement events.
We do not process special categories of data within the meaning of Article 9 GDPR.
04How we collect this data
- Automatically, through cookies and similar technologies placed (subject to consent) when you browse a Publisher Property, and through the bid request generated by the publisher's header-bidding / Prebid setup;
- From our partners, including the publisher's CMP (consent signals) and demand and identity partners participating in the auction.
05Purposes and legal bases
We process the data described above for the following purposes. Because we rely on the publisher's CMP and the IAB Europe Transparency & Consent Framework (see Section 6), consent is the primary legal basis; we rely on legitimate interest only for the limited operational purposes indicated.
| Purpose | TCF reference | Legal basis |
|---|
| Store and/or access information on your device | Purpose 1 | Consent |
| Select, deliver and report on basic (non-personalised) ads | Purposes 2 & 7 | Consent |
| Build a profile and select personalised ads | Purposes 3 & 4 | Consent |
| Measure ad performance and audience | Purposes 7 & 9 | Consent |
| Develop and improve our Services | Purpose 10 | Consent |
| Technically deliver ads | Special Purpose 2 | Legitimate interest |
| Ensure security, prevent fraud and debug | Special Purpose 1 | Legitimate interest |
06Consent and the Transparency & Consent Framework (TCF)
Missena participates in the IAB Europe Transparency & Consent Framework (TCF) and complies with its Policies and Specifications. Our IAB Europe vendor ID is 687.
Within the EEA and the UK, we rely entirely on the consent (and, where applicable, the legitimate-interest signals) collected by the publisher through its CMP and transmitted to us as a TCF consent string. We do not place or read information on your device, nor process your data for consent-based purposes, in the absence of a valid signal authorising us to do so. You can change your choices at any time using the CMP on the relevant Publisher Property.
07Recipients of your data
To run the real-time auction and deliver advertising, we may share the data described in Section 3 with the following categories of recipients:
- Demand partners: demand-side platforms (DSPs), advertising exchanges and buyers participating in the auction;
- Identity and measurement partners: providers of identity resolution and of ad-delivery / performance measurement;
- Our sub-processors: hosting and infrastructure providers acting on our instructions under Article 28 GDPR;
- Competent authorities: where required by law or to protect our rights.
A current list of the specific partners and sub-processors we work with is available on request at the contact details in Section 15.
08Where your data is processed and international transfers
We process data on infrastructure located in the region of the corresponding traffic:
- European traffic is processed on servers located in the European Economic Area;
- US traffic is processed on servers located in the United States;
- Asia-Pacific traffic is processed on servers located in Singapore and Japan.
Personal data of users in the EEA is therefore processed on EEA-based infrastructure. However, when a bid request is broadcast to demand partners, recipients may be located outside the EEA. Where such a transfer occurs, it is governed by an appropriate safeguard under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses. A copy of the relevant safeguards is available on request.
09How long we keep your data
We retain the personal data processed through the Services for a maximum of 360 days, after which it is deleted or anonymised, unless a longer period is required to comply with a legal obligation or to establish, exercise or defend legal claims.
10Security
We implement appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration and disclosure, and we require our sub-processors to provide an equivalent level of protection.
11Your rights
Subject to the conditions set out in the GDPR, you have the right to access your data, to rectification, to erasure, to restriction of processing, to object to processing, to data portability, and to withdraw your consent at any time (without affecting processing already carried out).
How to identify your data. Because we only hold pseudonymous technical identifiers and cannot otherwise identify you, we will generally need you to provide the relevant identifier (for example a screenshot of your advertising ID, or information about your device or browser) so that we can locate the data relating to you. This also protects you against disclosing data to the wrong person.
To exercise your rights, or for any question about this policy, contact our Data Protection Officer (Section 15). You also have the right to lodge a complaint with your supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL).
To opt out of interest-based advertising more broadly, you can also use youronlinechoices.eu (EDAA).
12Children
Our Services are not directed at children, and we do not knowingly process the data of persons under the age of 16.
13Website visitors and business contacts
When you visit missena.com, fill in a contact form, or interact with us as a (prospective) publisher, advertiser or partner, we process the data you provide (such as name, business email, company and role) to respond to your request, manage the relationship, and send you business communications.
- Legal bases: performance of pre-contractual / contractual measures, our legitimate interest in promoting our business, and your consent for marketing where required.
- Retention: 3 years from last contact for prospects; duration of the relationship for clients.
The rights described in Section 11 apply equally to this data, and here we can act on your request directly using your contact details.
14Changes to this policy
We may update this policy to reflect changes in our practices or in applicable law. The effective date above indicates the latest version, and we encourage you to review it periodically.
15Contact
For any question about this policy or to exercise your rights, you can contact our outsourced Data Protection Officer, Dipeeo:
- Email: contact@dipeeo.com
- Postal address: Dipeeo SAS, 95 avenue du Président Wilson, 93100 Montreuil, France
You may also write to us at: MISSENA — 14 avenue du Général de Gaulle, 94160 Saint-Mandé, France.
