Panel Privacy Notice

This Privacy Notice explains how ATTEX Data AB processes data when you participate in our mobile panel used to measure media exposure and attention behaviour on mobile devices.

Data Controller ATTEX Data AB

Contact: info@attexdata.ai

Postal address: ATTEX AB Kvarnvägen 53 182 39 Danderyd Sweden

We process data in order to:

We do not intend to sell raw participant-level data.

• —measure media exposure and attention behaviour across mobile devices and environments;
• —operate and improve ATTEX Data’s panel-based measurement product;
• —validate performance across devices, operating systems, cohorts, and markets;
• —generate anonymised derived datasets, aggregated insights, analytics, benchmarking, and reporting outputs; and
• —support research, product development, and commercial analytics based on anonymised and aggregated outputs.

We only collect data from a defined whitelist of supported apps, browsers, and environments that are relevant to media and advertising measurement.

This means ATTEX Data does not collect data from all apps on your device.

Depending on how you use those supported apps and browsers, we may collect:

We do not collect screenshots or screen recordings.

• —device model and operating system version;
• —technical device metadata;
• —timestamps and session-related identifiers;
• —app package names;
• —browser URLs;
• —search queries;
• —visible interface text captured from supported app or browser contexts;
• —gaze / attention-related measurements (if enabled); and
• —a panel ID linked to your participation record.

Because the measurement technology relies on app and browser context within a limited whitelist of supported media and advertising-relevant environments, some visible on-screen content may be collected as part of the measurement process.

This may sometimes include:

We do not intentionally collect sensitive or third-party data, but such information may appear incidentally depending on what is visible on your screen.

• —usernames;
• —social media posts or comments;
• —search terms;
• —URLs;
• —text visible in supported apps or browser pages; and
• —content relating to third parties.

Our legal basis for this processing is your consent. Where sensitive information may appear incidentally in collected content, we rely on your explicit consent where required.

Participation is voluntary, and you can pause or withdraw at any time.

We keep raw and intermediate panel data for a maximum of 12 months for operational, quality assurance, validation, and analysis purposes.

Within this 12-month period, we ensure that raw and intermediate datasets are either:

• —deleted; or
• —transformed into anonymised derived data that no longer contains personal data and cannot be linked back to you or other individuals by any reasonably likely means.

Where data has been transformed into genuinely anonymised derived data, it may be retained for a longer period for purposes such as benchmarking, analytics, reporting, research, product development, and commercial insight generation.

We use service providers to support our operations, including hosting, communications, operational systems, consent management, panel administration, and technical services.

Relevant systems and providers may include:

We do not intend to share raw participant-level datasets with customers.

Customers and external partners may receive only:

• —AWS;
• —Salesforce;
• —Firebase;
• —Customer.io;
• —Alchemer;
• —panel providers; and
• —relevant technical SDK providers.

• —anonymised derived data;
• —anonymised outputs;
• —aggregated datasets;
• —statistical outputs; and
• —reporting-level insights.

Your raw or participant-level data will not be shared with customers for AI or machine learning model training.

Customers may use ATTEX Data data for AI / machine learning training only where the relevant dataset has been transformed into genuinely anonymised derived data that is free from personal data.

We use EU-based hosting infrastructure, including AWS services in Ireland and Stockholm.

If any service provider processes or accesses data outside the EU/EEA, we will ensure appropriate safeguards are in place as required by applicable law.

You can:

Because raw data is processed using a panel ID, we also support privacy-related requests to the extent we can link your request to your panel participation record, for example deletion requests.

Under GDPR, you may also have rights of access, rectification, erasure, restriction, objection, and the right to lodge a complaint with a supervisory authority.

• —choose whether to participate;
• —pause measurement; and
• —withdraw from the panel at any time.

We use technical and organisational safeguards designed to protect data, including encrypted transmission, protected storage environments, restricted access to raw data, and restricted access to systems that contain identity-linkage information.

We may update this Privacy Notice if our processing changes. If we make material changes, we will inform participants as required.

ATTEX Data AB Contact: info@attexdata.ai

Postal address: ATTEX AB Kvarnvägen 53 182 39 Danderyd Sweden