Privacy Policy

Part B: Spider AF Service Privacy Notice

This Part B applies to individuals whose personal information is collected through Spider AF tags or services deployed on websites, applications or advertising campaigns operated by our customers, including order information processed through the Anti-Resale Service and lead-submission information processed through the Fake Lead Protection Service. This Part B also covers information that we receive through advertising, analytics and other platform integrations enabled by our customers, as described in Sections 10 and 10A. Where we process this information on behalf of a customer, the customer is the controller or business, the customer's privacy notice and our agreement with the customer (including the Data Protection Agreement in the Spider AF Terms of Service) govern that processing, and requests concerning it are best addressed to the customer. Where we process this information for our own purposes described in Section 11, such as operating shared fraud-detection databases and improving our detection, we act as a controller or business and this Policy applies. Section 11 describes the information processed through Spider AF by category (directly identifying information, technical and behavioral identifiers, and derived and other information), our role for each category, how we use it, the shared fraud-detection databases and the applicable retention periods. Sections 3.1 to 3.5, 4 and 8 and Part C, including the retention periods in Section 12.2, your rights in Sections 12.3, 13 and 14 and our contact details in Section 15, also apply to the processing described in this Part B. The purposes for which we process information under this Part B are described in Sections 10, 10A and 11. Operators of websites and applications that use Spider AF may refer their users to this Part B.

10. Google Ads Account Data

Certain Spider AF features connect to a customer’s Google Ads account through Google APIs. Information received from Google APIs will be used and transferred in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

• We do not request or receive your Google Ads username or password. You authorize access through Google’s authorization process and may revoke that access through your Google account settings.
• We access and retain the account, campaign, placement, performance, cost, configuration and audience-list metadata reasonably necessary to provide the enabled fraud-detection, reporting, tracking-template and exclusion features. The precise fields depend on the features you enable and Google’s API functionality.
• Through this integration, we do not access the individual members or underlying end-user identifiers contained in Customer Match or similar audience lists, and we do not upload email addresses, telephone numbers or other end-user identifiers to Google Ads for Customer Match or similar audience creation.
• We do not sell Google Ads account data. We use it only to provide, secure, support and improve the enabled integration, comply with law, and as otherwise permitted by the applicable customer agreement and Google’s policies.
• At the customer’s direction or as authorized through the enabled configuration, Spider AF may set or update tracking templates and transmit or apply fraud-related configuration, including IP, placement or audience-related exclusions. Customers should review enabled permissions and configuration settings before authorizing the integration.

10A. Platform Integrations

Spider Labs offers optional integrations with advertising, analytics and other third-party platforms. Our Platform Integrations Privacy Notice, available at https://spideraf.com/legal/platform-integrations and through the applicable integration setup and authorization pages, describes the information accessed, received, stored or transmitted through each integration, the purposes of processing, retention practices, available controls, revocation and data-deletion procedures. That notice supplements this Privacy Policy. If a platform-specific disclosure directly conflicts with a general statement in this Privacy Policy, the more specific platform-integration disclosure will control for that integration.

11. Information Processed Through Spider AF

11.1 What Spider AF Collects, by Category

Spider AF services process the following categories of information collected through tags, forms, integrations and scans deployed by our customers on their websites, applications, advertising campaigns and order or lead flows. Because the rules that apply (our role, permitted uses, sharing and retention) depend on the category of information and the purpose of the processing rather than on the individual service alone, this Section is organized by category.

• (a) Directly identifying information. Names, email addresses, telephone numbers, postal addresses and similar contact details of individuals. Spider AF receives this category as input data only through the Anti-Resale Service (order information, which may also include order and transaction identifiers, product and order details and payment or fulfillment status, but not full payment-card data) and the Fake Lead Protection Service (structured fields entered into forms on our customers' websites; free-text form content is not collected).
• (b) Technical and behavioral identifiers. When an end user uses a server, website or application on which a Spider AF JavaScript tag (or any similar technological measure) is deployed, or submits an order or a form protected by Spider AF, we acquire the IP address, user agent, IDFA, AAID or similar advertising or device identifiers where enabled, referrer, URL, time stamp, browser information, browser-storage identifiers (including identifiers stored in localStorage or comparable technologies), session and request identifiers, user interaction data (such as clicks, cursor location and movement, touches and scrolls) and other behavioral history information, together with the country and, for U.S. IP addresses, the state inferred from the IP address, with state-level information used only to exclude California IP addresses from shared block lists (collectively, the "Behavioral History Information"). The specific technical and behavioral identifiers collected depend on the Spider AF service, its configuration and the applicable service specifications.
• (c) Derived and other information. Fraud scores, classifications, alerts, block lists, exclusion feeds and similar outputs generated by Spider AF; models, rules, signatures, statistics and aggregated or de-identified information; and information about websites, servers and domains, including URLs, HTML, script and other content, headers and scan results collected through the Anti-Ad Fraud Service and the SiteScan Service. Scanned content may incidentally include personal information appearing on a website; we do not use such incidental information to identify or profile individuals. Information in this category may still relate to an individual where it is linked to an identifier such as an IP address, and we treat it as personal information to that extent.

For the specific information collected by each service, please refer to the Spider AF Terms of Service, including Schedule 1 of its Data Protection Agreement, and the applicable order forms and service specifications.

11.2 Our Role for Each Category

Where we process personal information in any of categories (a), (b) and (c) on a customer's behalf to provide the agreed service under that customer's instructions (including results generated for that customer and scan results), we act as a processor or service provider on behalf of that customer under the applicable customer agreement (including the Data Protection Agreement in the Spider AF Terms of Service), and the customer is the controller or business. Where we process information in categories (b) and (c) for our own purposes described in this Section, in particular to create, maintain and operate the shared fraud-detection databases described in Section 11.4 and to protect, secure, maintain and improve our fraud-detection services, we act as a controller or business, as applicable. We do not process directly identifying information in category (a) for our own purposes, except that we may use Anti-Resale order information to improve the accuracy of fraudulent-resale detection and may derive non-identifying characteristics from Fake Lead Protection form fields, as described in Section 11.3, in which case we act as a controller for that processing and apply the safeguards and rights described in this Policy.

11.3 How We Use Each Category

• (a) Except as described below and in Section 11.2, directly identifying information is used only to provide the relevant service to the customer that collected it. Anti-Resale order information is used to detect and prevent fraudulent resale activities and to improve the accuracy of such detection (including updating detection databases) as permitted by the applicable customer agreement and applicable law. Fake Lead Protection form fields are used only to provide the Fake Lead Protection Service to the customer that collected them (including the detection of duplicate or repeat submissions); we do not incorporate them into the shared fraud-detection databases and systems described in Section 11.4, and we do not use them to develop or improve our services for other customers. However, we may derive from these fields characteristics that do not identify an individual and from which the original values cannot be reconstructed, such as the domain of an email address, whether that domain is associated with disposable email services and the format of the submitted values, and use those characteristics in our shared fraud-detection databases and systems and to improve our detection for all customers. The customer's privacy notice governs the processing we carry out on its behalf.
• (b) Behavioral History Information is used for the purpose of taking anti-fraud measures through bot detection and other monitoring of unauthorized use, detecting fraudulent, invalid or abusive traffic, leads and orders, optimizing those measures, conducting analysis to optimize them, and developing new services. Browser-storage identifiers may be used to recognize or correlate a device or browser across customer properties and may contribute to the shared fraud-detection databases, scores, classifications, block lists and other outputs described in this Section. Where applicable law (for example, the EU and UK rules on storing or accessing information on a user's device) requires consent for storing or accessing such identifiers, the operator of the website or application on which the tag is deployed is responsible for implementing the applicable consent mechanism and obtaining any required consent before such identifiers are stored or accessed. This allocation does not relieve Spider Labs of any obligations applicable to its own processing under applicable law. On our own Sites, where we deploy Spider AF tags ourselves, we obtain that consent through our cookie banner.
• (c) Derived and other information is used to provide results to our customers, to operate and improve the shared fraud-detection databases and our detection models, and, in aggregated or de-identified form, for analytics, benchmarking, research, service improvement and the development of new services.

11.4 Shared Fraud-Detection Databases

Spider Labs may combine Behavioral History Information and other fraud-related information in categories (b) and (c) obtained from or generated in connection with multiple customers, services and other sources to create, maintain and operate shared fraud-detection, security, risk-scoring and verification databases and systems. As part of Spider AF and other current or future fraud-prevention, security, risk-scoring, verification and related services, Spider Labs may provide customers and other authorized recipients with database-derived results, including fraud scores, classifications, alerts, block lists, exclusion feeds and fraud-related identifiers such as IP addresses, domains, URLs and comparable technical identifiers. Directly identifying information in category (a) is not disclosed through these databases or the results we provide: Fake Lead Protection form fields are not incorporated into them, other than the non-identifying characteristics described in Section 11.3(a), and Anti-Resale order information may be used to update our detection databases as described in Section 11.3, but only derived indicators and technical identifiers are disclosed. For this processing, Spider Labs acts as a controller or business, as applicable. Spider Labs limits such disclosures to information reasonably necessary for the applicable purpose and does not identify the customer from which particular fraud-related information originated unless authorized by that customer or required by applicable law. Where we rely on aggregated or de-identified information for service improvement or development, we take reasonable measures designed to prevent that information from identifying an individual.

We may prepare anonymously processed data and provide the same to a third party upon taking appropriate protective measures to ensure that individuals will not be identified or specified and that personal information used for the preparation of such data cannot be restored. Anonymously processed data prepared by us may be derived from user agent information (such as IP addresses, terminal device information and referrer), behavioral information such as clicks, viewing and installation, server and domain information, and text, image, audio and HTML information, and such provision will be prepared in data files and by data transmission in a secure manner.

11.5 Retention by Category

The retention periods that apply to information processed through Spider AF are set out in Section 12.2 and, for California residents, in Section 13.1. In summary:

• (a) Directly identifying information is deleted within 60 days of collection, unless otherwise provided in the applicable customer agreement or required by law.
• (b) Behavioral History Information and other technical information are generally retained for 90 days from collection in operational and reporting databases. Such information may additionally be retained in access-restricted archival storage for up to two years solely for fraud detection, security investigations and maintaining records of exclusion settings.
• (c) Fraud scores, classifications, block-list entries and similar derived data are, to the extent they contain IP addresses or other information relating to an individual, retained for up to two years and are then deleted or de-identified. No maximum retention period applies to statistical information, models, rules and other information that does not identify an individual. Other personal information in this category that we hold on a customer's behalf (such as scan results) is retained in accordance with the customer agreement.

Copies maintained in system backups may be retained for up to approximately 12 months before deletion or overwriting through our backup cycles.

System and infrastructure logs are retained for between 30 days and two years depending on the type of log and its purpose. This summary does not extend the periods stated in Section 12.2; the limited exception in Section 12.2 for specific legal claims and incidents applies only to information we hold as a controller or business and does not extend the deletion procedures and periods in our customer agreements.

11.6 Your Rights Regarding Information Processed Through Spider AF

When you would like to request notification or disclosure of the purpose of use of your personal information processed through Spider AF, correction, addition or deletion of a portion thereof, suspension of the use thereof, deletion thereof, or suspension of provision to a third party, we will accommodate your request through the procedures set forth in this Privacy Policy subject to applicable law and verification requirements. Because information processed through Spider AF is generally held against technical identifiers rather than names, we may ask for proportionate additional information to locate the relevant records and verify that they relate to you. If we cannot establish that link, we will explain this where possible; if you provide information that enables us to establish it, we will assess and respond to your request under applicable law. Where we process your information on behalf of a customer, we may refer your request to that customer or ask the customer to respond, as it is the controller or business for that processing. Additionally, for the steps to activate or inactivate IDFA, AAID, or other information or to delete such information, please see "9. Cookies and Similar Technologies".

11.7 Service-Specific Details and Integrations

Spider AF currently comprises the Anti-Ad Fraud Service, the Anti-Resale Service (Scalping Protection), the Fake Lead Protection Service and the SiteScan Service. The Anti-Resale Service is currently offered to customers in Japan. Some customers connect Spider AF to their own systems, for example through our API or through connections to their CRM, e-commerce cart or chat platforms, so that Spider AF outputs are applied automatically in those systems (for example, holding or cancelling an order or rejecting a lead). The customer enables and controls those integrations and is responsible for the decisions taken through them, as described in Section 7 of the GDPR Policy below. This does not relieve Spider Labs of its own obligations in relation to its processing. Optional integrations with advertising, analytics and other third-party platforms are described in Section 10A and in our Platform Integrations Privacy Notice. Where Spider Labs processes personal data on behalf of its customers in the course of providing these services, such processing is governed by the agreement with the customer, including the Data Protection Agreement set out in Annex I of the Spider AF Terms of Service.

Part C: General Provisions (Parts A and B)

This Part C applies to all individuals covered by this Policy, whether under Part A or Part B.

12. European Users

The following applies to individuals in the European Economic Area (EEA). The retention periods in Section 12.2 apply to all individuals covered by Part B, wherever they are located.

12.1 Lawful Bases for Processing

Spider Labs is required to inform you of the lawful bases of our processing of your personal information, which are described below. If you have questions about the lawful basis of how we process your personal information, contact us at the address listed in the section titled "CONTACTING US" below.

We process personal information on one or more of the following bases, depending on the purpose and context:

• (a) Contract. Processing is necessary to enter into or perform a contract with you, including providing requested products or services, administering an account, processing a transaction, and responding to service requests.
• (b) Legitimate interests. Processing is necessary for our or a third party’s legitimate interests, including securing and operating the Platform and services, detecting and preventing fraud and abuse, improving products and services, managing business relationships, and conducting proportionate business-to-business marketing, except where those interests are overridden by your interests or fundamental rights and freedoms.
• (c) Consent. We rely on consent where required, including for certain electronic marketing and non-essential cookies or similar technologies. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• (d) Legal obligation. Processing is necessary to comply with applicable legal or regulatory obligations.
• (e) Legal claims and vital interests. Where applicable, processing is necessary to establish, exercise or defend legal claims or to protect an individual’s vital interests.

We will use your personal information only for the purposes for which we collected it, unless we reasonably determine we need to use it for another reason and that reason is compatible with the original purpose. For example, we consider deidentification, aggregation, and other forms of anonymization of personal information to be compatible with the purposes listed above and, in your interest, because the anonymization of such information reduces the likelihood of improper disclosure of that information.

PLEASE NOTE WE MAY PROCESS YOUR PERSONAL INFORMATION WITHOUT YOUR KNOWLEDGE OR CONSENT, IN COMPLIANCE WITH THE ABOVE RULES, WHERE THIS IS REQUIRED OR PERMITTED BY LAW.

12.2 Retention

Spider Labs retains your personal information:

• For so long as your Account is active or as needed to provide you with the Platform or to fulfill our contractual obligations;
• As necessary to comply with our legal obligations, resolve disputes, and enforce our agreements;
• For so long as is necessary for the purposes for which we collected such personal information;
• For information processed through Spider AF, according to the category-specific periods in Section 11.5. Directly identifying information is deleted within 60 days of collection, subject to the contractual and legal exceptions stated there. Behavioral History Information and other technical information are generally retained for 90 days from collection in operational and reporting databases and may be retained in access-restricted archival storage for up to two years solely for fraud detection, security investigations and maintaining records of exclusion settings. Copies maintained in system backups may be retained for up to approximately 12 months before deletion or overwriting through our backup cycles; and
• For system and infrastructure logs, for between 30 days and two years depending on the type of log and its purpose: operational server and application logs are rotated on shorter cycles, while security, integration and diagnostic logs may be retained for up to two years for security monitoring, troubleshooting and compliance purposes, subject to access restrictions.

When we retain raw event data in archival storage, we restrict access to authorized personnel, limit its use to the stated purposes, and delete or de-identify it when the applicable retention period expires, unless a longer period is required by law.

Fraud scores, classifications, block-list entries and similar derived data generated through the shared fraud-detection databases described in Section 11.4 are, to the extent they contain IP addresses or other information relating to an individual, retained for up to two years and are then deleted or de-identified. No maximum retention period applies to statistical information, models, rules and other information that does not identify an individual.

Notwithstanding the periods described in this Section, we may retain specific records that we hold as a controller or business only where and for as long as reasonably necessary to establish, exercise or defend a specific legal claim or to investigate a specific fraud or security incident; such records are kept separately with restricted access, are used only for that purpose, and are reviewed periodically and deleted or de-identified when no longer needed. This exception does not extend the deletion procedures and periods that apply to personal information we process on behalf of a customer under our agreement with that customer.

12.3 Your Rights

European data protection laws give you certain rights regarding your personal information. You may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Correct. Update or correct inaccuracies in your personal information.
• Delete. Delete your personal information.
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict. Restrict the processing of your personal information.
• Object. Object to the processing of your personal information based on our legitimate interests, as provided by applicable law.

When we receive your request, we may ask you to verify your identity before we can act on your request. We may refuse or limit a request only where applicable law permits, for example where a request is manifestly unfounded or excessive. Where providing information would adversely affect the rights and freedoms of others, we will limit the affected information as permitted by law and provide the remainder. If we refuse or limit a request, we will tell you why. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find contact information for the relevant supervisory authorities through the European Data Protection Board’s website.

If you are not satisfied with our response, and are in the European Union, you may have a right to lodge a complaint with your local supervisory authority.

13. California Privacy Notice

This Section provides additional information for California residents regarding Spider Labs’ privacy practices. Based on our current operations, Spider Labs does not believe that it meets the thresholds for a “business” subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). We nevertheless provide the disclosures in this Section voluntarily for transparency. Providing these disclosures does not constitute a representation that Spider Labs is currently subject to the CCPA or an undertaking to comply voluntarily with all requirements applicable to a CCPA business. If the CCPA becomes applicable to Spider Labs, we will provide the rights, notices and request methods required by applicable law. For purposes of describing our practices in this Section, “personal information,” “sensitive personal information,” “sell,” “share,” and other terms defined by the CCPA are used with their CCPA meanings. Processing that Spider Labs performs solely as a service provider or contractor on behalf of a customer is governed by the applicable customer agreement and applicable law.

13.1 California Collection and Disclosure Information

The table below describes the categories of personal information that we may collect, the purposes for which we collect and use them, the categories of sources, the categories of recipients to which we disclose them for business purposes, whether the relevant practices would constitute a “sale” or “sharing” using the CCPA definitions, and our retention criteria. “Shared” refers to disclosure for cross-context behavioral advertising. We do not sell personal information for money. Certain advertising disclosures may constitute a sale or sharing under the CCPA even when no money is exchanged. The “Sold” and “Shared” columns use those CCPA terms descriptively and do not mean that Spider Labs represents that it is currently a CCPA business. Any sale or sharing described in this table relates only to our own websites and marketing (for example, advertising cookies and pixels on our Sites) and to our business operations. Personal information that Spider AF processes solely on behalf of our customers as a service provider or contractor, including end-user event data, fraud indicators, conversion events and lead-submission data, is not sold or shared. Where Spider AF applies fraud-exclusion settings to a customer's advertising accounts, it does so at the customer's direction and on the customer's behalf. That customer-directed processing is not treated as a sale or sharing by Spider Labs in this table.

13.2 Sensitive Personal Information

Spider Labs does not use or disclose sensitive personal information for purposes that are subject to the CCPA right to limit if the CCPA applied to Spider Labs. If our practices or applicable legal obligations change, we will update this notice and provide any method required by applicable law.

13.3 California Privacy Rights

The CCPA provides certain rights to California residents when their personal information is processed by a business subject to the CCPA, including rights to know, access, delete and correct personal information, to opt out of certain sales or sharing of personal information, to limit certain uses or disclosures of sensitive personal information, and not to be discriminated against for exercising applicable CCPA rights. As explained above, Spider Labs does not currently believe that it meets the thresholds for a business subject to the CCPA. You may nevertheless contact us with a privacy request as described in Section 13.5, and we will consider and respond to the request as required by applicable law and otherwise as reasonably practicable.

13.4 Sale or Sharing Opt-Out

Because Spider Labs does not currently believe that it is a business subject to the CCPA, we do not currently provide a CCPA “Do Not Sell or Share My Personal Information” mechanism or process opt-out preference signals, such as Global Privacy Control, as CCPA opt-out requests. If Spider Labs becomes subject to those requirements, we will provide and honor the applicable opt-out methods and signals as required by law.

13.5 Submitting a Privacy Request

You may submit a privacy request by emailing dpo@spideraf.com, with info@spideraf.com available as a general alternative, or through the request or support method identified on our Site, including our website support interface. Describe the request and provide information reasonably necessary to identify the relevant records. We will respond as required by applicable law and may also accommodate other requests where reasonably practicable.

13.6 Verification and Authorized Representatives

For privacy requests that we process, we may verify the request using information reasonably related to the request and the sensitivity of the information. We may request additional information where reasonably necessary to protect against fraud or unauthorized disclosure. If you submit a request through an authorized representative, we may request information reasonably necessary to verify the representative’s authority or your identity, subject to applicable law.

13.7 Response Timing

We will respond to privacy requests within any period required by applicable law. For requests that we address voluntarily rather than pursuant to a statutory requirement, we will seek to respond within a reasonable period based on the nature and complexity of the request. We generally do not charge a fee for privacy requests, but may decline or limit a request where permitted by applicable law or where we cannot reasonably verify or locate the relevant information.

13.8 No Discrimination

We will not discriminate against you for submitting a privacy request or inquiry. If applicable law provides additional protections against discrimination or retaliation for exercising privacy rights, we will comply with those requirements.

13.9 California “Shine the Light”

California Civil Code section 1798.83 permits certain California residents to request information regarding disclosure of personal information to third parties for their own direct-marketing purposes. You may submit such a request using the contact information in Section 15.

13.10 Changes to this California Privacy Notice

We will update this Section when our practices or applicable legal obligations materially change. The effective date appears at the end of this Privacy Policy.

14. Exercising Your Privacy Rights

When exercising the rights or options described in this Privacy Policy, the following guidelines apply:

14.1 No Fee Usually Required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, where applicable law permits, we may charge a reasonable fee or decline to comply with your request if your request is manifestly unfounded or excessive, in particular because of its repetitive character.

14.2 What We May Need from You

When exercising your rights or otherwise assisting you, where reasonably necessary, we may need to request specific information from you to help us confirm your identity. This is a security measure to ensure we do not disclose personal information to any person who is not entitled to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

14.3 Time to Respond

We will respond to legitimate requests within the period required by applicable law and, unless a different statutory period applies, within one month of receiving your request. Where a request is particularly complex or you have made a number of requests, we may extend this period where applicable law allows (for individuals in the EEA, by up to two further months); in that case we will inform you of the extension and the reasons for it within one month of receiving your request. For California residents, Section 13.7 also applies.

14.4 No Discrimination

You will not be subject to discrimination as a result of exercising the rights described herein. In some cases, when you exercise one of your rights, we will be unable to comply with the request due to legal obligations or otherwise, or we will be unable to provide you certain products or services. These responses are not discrimination and our reasons for declining your request or ceasing services will be provided at that time.

15. Contacting Us

When you would like to request notification or disclosure of the purpose of use of Personal Information, correction, addition or deletion of a portion thereof, suspension of the use thereof, deletion thereof, or suspension of provision to a third party, please make a request to our contact indicated below. We will accommodate such requests as required by applicable law. For such purpose, we will verify your identity using information reasonably related to your request and, where necessary and proportionate, may ask you to provide identification documents or other supporting materials, and we will confirm the specifics of your request.

For any question regarding the identification document, fees, and other specific procedures, please also make an inquiry to our contact indicated below.

For any inquiry concerning the handling of Personal Information or if you have any questions or concerns about our Privacy Policy or any other privacy or security issue, please contact us at:

Spider Labs, Inc.
Representative Director: Satoko Ohtsuki
Attention: Personal Information Manager
Minamiaoyama ST Bldg. 4F, 7-10-3 Minamiaoyama, Minato-ku, Tokyo 107-0062
Privacy and data-subject requests: dpo@spideraf.com
General Inquiries: info@spideraf.com
Data Protection Officer: Eurico Doirado, dpo@spideraf.com

GDPR Policy

For individuals residing in the European Economic Area ("EEA"), Spider Labs, Inc. has adopted the following additional provisions for the processing ('processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction) of personal information and other information provided by individuals residing in EEA based on the General Data Protection Regulation ("GDPR").These additional provisions shall prevail to the extent it conflicts with any provision in the main body of the Privacy Policy.

1. Processing of the Information

• (1) Categories of the information
  We collect and retain from individuals residing in EEA the Information including the following categories (collectively the "Information"):

• Basic information (name, address, phone number, e-mail address, etc.)
• Additional information (occupation, title, office information (company name, address, telephone number, department name), etc.)
• Informative matters/Messages (e-mail, website form input, fax, a phone note, letter, the answers to the questionnaires, etc.)
• Information collected on the internet (IP address, device and OS information, cookies, mobile identifiers such as the ID for Advertising for iOS (IDFA), Google Advertising ID or similar mobile identifiers, interactions within an app, information regarding which advertisements have been seen or clicked on, etc.)

• (2) Purposes of use:
  We will use the Information for the purposes described in Part A (Section 2) and Part B (Sections 10, 10A and 11) of the Privacy Policy.

• (3) Acquisition of the Information
  We collect the Information from the following sources in conducting business related to our facilities, services and products:

• Direct acquisition from an individual: by telephone, letter (including email and other electro-magnetic records), business cards, verbally, through the internet, etc.
• Acquisition from persons with proper authorization to provide information for an individual: an individual applying on behalf of another, a party introduced by a second party, business partners and agents.
• Acquisition from published material or public sources: internet, newspapers, telephone directories, books and other publications, etc.
• Acquisition from third parties' data analytics tools embedded in third party websites and mobile applications

• (4) Provision to a third party:
  We provide the Information to a person who falls under any of the following items:

• a business operator whom we entrust with handling of the Information;
• a Joint User among which we jointly use personal Information;
• customers and other authorized recipients of fraud-detection results (such as fraud scores, classifications, block lists and technical identifiers) derived from the shared fraud-detection databases described in Section 11.4 of the Privacy Policy; and
• information providing destination specified by laws and regulations, etc., in case of provision of the Information under laws and regulations, etc.

• (5) Retention Period
  We retain the information for the period necessary to accomplish its purpose of processing and, where Section 12.2 of the Privacy Policy specifies a period, for that period. Following the retention period, we eliminate or anonymize such Information in a secure way within a reasonable period of time.

2. Legal Basis

We process the Information on the lawful bases described in Section 12.1 of the Privacy Policy.

Our Sites and business: we rely on performance of a contract (including steps taken at your request before entering into a contract) for accounts, orders and support; on our legitimate interests in securing and operating our Sites, managing business relationships and conducting proportionate business-to-business marketing; on compliance with legal obligations; and on consent where applicable law requires it, for example for certain electronic marketing and for non-essential cookies or similar technologies.

The Spider AF service: where we process personal data on behalf of a customer, the customer determines the lawful basis for that processing. Where we process personal data for our own purposes described in Section 11, such as operating shared fraud-detection databases and improving our detection, we rely on our and our customers' legitimate interests in detecting and preventing advertising fraud, fake leads, fraudulent resale and other misuse, on compliance with legal obligations, and, where applicable, on the establishment, exercise or defence of legal claims.

3. Transfer of the Information to a Third Country Located Outside of the EEA

We store the Information primarily in Japan. In addition, we may transfer the Information to business partners of ours located in countries outside of the EEA.

When we transfer personal data from the EEA to Japan, we rely on the European Commission’s applicable adequacy decision to the extent the transfer is within its scope. For transfers to another country or recipient not covered by an adequacy decision, we use an applicable safeguard under Chapter V of the GDPR, such as the European Commission’s standard contractual clauses, binding corporate rules, or another lawful mechanism. Where required, we assess the laws and practices of the destination country and implement supplementary measures. You may contact us to request information about the applicable transfer mechanism and, where available, a copy of the relevant safeguards.

4. Data Subject’s Rights

You have the following rights with respect to us based on laws and regulations and you may exercise these rights by contacting our DPO. In the event that you exercise these rights, we will respond in good faith, barring statutory exceptions, after confirming that the requesting person is the person in question.

• The right of access: The right to obtain confirmation as to whether or not the Information concerning you is being processed, and where that is the case, (the right to) access to the Information and the accompanying information.
• The right to rectification: The right to obtain the rectification of inaccurate Information concerning you.
• The right to erasure: The right to obtain the erasure of personal information concerning you in certain cases.
• The right to restriction of the processing: The right to obtain restriction of the processing in certain cases.
• The right to object to the processing: The right to object to the processing of Information based on the purposes of the legitimate interests pursued by us or third parties.
• The right to data portability: The right to receive the Information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us.

5. Withdrawal of Consent

You can withdraw consent on the processing of information at any time. Withdrawing consent does not affect the lawfulness of the processing based on consent before the withdrawal. You can withdraw consent by contacting our DPO.

6. Lodging a Complaint with an Authority

You have the right to lodge a complaint on the processing of Information with the protection authority having jurisdiction over your residence.

7. Automated Individual Decision-Making, Including Profiling

Our Sites and business: we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

The Spider AF service: Spider AF uses automated processing, including profiling, to detect and score fraudulent, invalid or abusive traffic, leads and orders, based on signals such as IP address, device and browser characteristics, and interaction patterns. These outputs are provided to our customers as scores, classifications and block lists. Any decision that may affect you (for example, whether to accept an order or respond to a lead) is taken by the relevant customer under its own responsibility. Some customers enable integrations under which these outputs are applied automatically, for example through our API or through connections to their CRM, e-commerce cart or chat platforms, so that an order may be held or cancelled, or a lead rejected, without individual review by the customer; in that case the customer is responsible for its use of the Spider AF output and for any safeguards applicable to the decision it makes, such as informing you and allowing you to obtain human intervention and to contest the decision. Customers are responsible for configuring and using these integrations in compliance with applicable law. Spider Labs remains responsible for its own processing and for any obligations applicable to Spider Labs, including where a Spider AF score, classification or other output plays a determining role in a decision subject to applicable automated-decision-making law. Where applicable law provides additional rights regarding automated decision-making, including with respect to certain significant decisions under California law, those rights and any applicable notices or safeguards will be provided as required by law. If you believe a decision about you was based on Spider AF outputs, please contact the customer concerned; you may also contact our DPO (Section 9) with questions about this processing or to exercise your rights in relation to it.

8. Security and Confidentiality Measures

We handle the Information with appropriate security and confidentiality measures.

9. Data Protection Officer (DPO) and EU Representative

(1) DPO

Data Protection Officer: Eurico Doirado
Spider Labs, Inc.
Minamiaoyama ST Bldg. 4F, 7-10-3 Minamiaoyama, Minato City, Tokyo 107-0062
Email: dpo@spideraf.com

(2) EU Representative

SPIDER LABS PORTUGAL, UNIPESSOAL LDA
Avenida Duque de Loulé 22, 7.º, 1050-090 Lisboa, Portugal
Email: dpo@spideraf.com

Last Revised: November 19, 2026