Data Processing Agreement (DPA)
For partners subject to GDPR or other data protection laws that require a formal DPA, Praevis provides a signed Data Processing Agreement.
Full DPA: Available on request — email [email protected].
Overview
Praevis Exchange acts as a data processor on behalf of supply sources (Publishers) (data controllers) when processing personal data of their end users for the purpose of serving targeted advertising.
| Role | Party |
|---|---|
| Data Controller | Supply source (you determine the purpose and means of processing) |
| Data Processor | Praevis Exchange (Nucleus AI Pte. Ltd.) |
| Sub-processors | See list below |
Scope of processing
| Processing activity | Legal basis | Retention |
|---|---|---|
| Real-time bid request creation | Legitimate interest / consent (where required) | In-auction only |
| IP-to-geo translation | Legitimate interest | IP discarded post-lookup |
| Advertising ID in bid requests | Consent (where TCF 2.2 applies) | 90 days |
| Impression tracking | Legitimate interest | 90 days |
| Fraud detection | Legitimate interest | 90 days |
| Aggregate analytics | Legitimate interest | 12 months (anonymised) |
Sub-processors
| Sub-processor | Location | Purpose |
|---|---|---|
| DigitalOcean | FRA, NYC, LON | Infrastructure hosting |
| Cloudflare | Global edge | DDoS protection, CDN |
Praevis will notify partners of sub-processor changes with 30 days notice.
Data transfers
| Region | Data stays in | Legal mechanism |
|---|---|---|
| EU/EEA traffic | Frankfurt (FRA) | No transfer — EU data stays in EU |
| US traffic | New York (NYC) | Standard Contractual Clauses (SCCs) |
| UK traffic | London (LON) | UK IDTA |
| Other regions | FRA (default) | SCCs |
EU auction data never leaves Frankfurt. This is a technical guarantee enforced by regional routing — not just a policy commitment.
Security measures
Technical and organisational measures (TOMs) include:
- TLS 1.3 in transit for all auction and API traffic
- Data isolated by region (no cross-region data sharing)
- Access controls: role-based, MFA enforced for admin accounts
- Audit logging: all access to personal data logged
- Incident response: P1 breach notification within 72 hours (GDPR Article 33)
- Penetration testing: annual
Data subject rights
For GDPR data subject requests (access, deletion, portability) from end users:
- Supply source receives the request from their user
- Supply source submits request to [email protected] with user identifier (advertising ID or IP if retained)
- Praevis responds within 30 days
- Deletion: data removed from all systems within 30 days
TCF 2.2
For EU/UK traffic, Praevis supports IAB Transparency & Consent Framework 2.2:
- Supply sources must pass a valid TC string in VAST requests or OpenRTB
regs.ext.consent - Praevis respects purpose consent signals (Purpose 1–10)
- Demand sources receive the TC string in bid requests and are responsible for their own consent-based processing
Getting a signed DPA
Email [email protected] with:
- Your company name and registration number
- Your jurisdiction (EU, UK, other)
- Signatory name and title
We’ll return a signed DPA within 5 business days.