GDPR & Regional Compliance
Praevis Exchange operates across three regions (EU, US, UK) and supports participants in global markets including MENA. This page covers our regulatory compliance posture by jurisdiction.
Data sovereignty — where data lives
| Traffic origin | Processed in | Legal basis |
|---|---|---|
| EU / EEA | Frankfurt, Germany (FRA) | GDPR |
| United Kingdom | London, UK (LON) | UK GDPR |
| United States | New York, USA (NYC) | CCPA/CPRA |
| MENA (UAE, Saudi, etc.) | Frankfurt (FRA) | PDPL / UAE DPL |
| All other regions | Frankfurt (FRA) | Praevis Privacy Policy |
Technical guarantee: EU auction data never leaves Frankfurt. Regional routing is enforced at the infrastructure level — it is not just a policy commitment.
GDPR (EU / EEA)
Praevis’s role: Data processor for supply sources (Publishers); data controller for our own platform users.
Legal bases used:
- Legitimate interest: fraud detection, frequency capping, analytics
- Consent: personalised advertising (where TCF 2.2 signal is required)
TCF 2.2 support:
- Supply sources must pass a valid TC string for EU users
- VAST: pass via
gdpr=1&gdpr_consent={TC_STRING}URL params - OpenRTB: pass via
regs.ext.consent - Praevis forwards the TC string to demand sources in all EU bid requests
- Demand sources are responsible for respecting the consent signal in their own processing
Purpose use:
- Purpose 1 (Store and/or access information on a device): Praevis does not set cookies — not applicable
- Purpose 2 (Basic ads): supported
- Purposes 3–10 (personalisation, analytics): forwarded to demand sources; demand sources are responsible
Data subject rights: See Privacy Policy — rights requests via [email protected].
UK GDPR
Applies to UK traffic processed in our LON region. Same framework as EU GDPR post-Brexit, with UK ICO as supervisory authority.
Transfers: UK data processed in LON only. Transfers to FRA (e.g., for consolidated analytics) use UK IDTA (International Data Transfer Agreement).
UK representative: Jonas Ras, [email protected]
CCPA / CPRA (California)
Applicable to: US traffic processed in NYC region.
Praevis’s role: Service provider to supply sources.
Key rights supported:
- Right to opt out of sale of personal information: Praevis does not sell personal data
- Right to know: accessible via [email protected]
- Right to delete: accessible via [email protected]
Do Not Sell/Share signals:
- Praevis respects
regs.ext.us_privacyin OpenRTB bid requests - CCPA opt-out passed to demand sources as
us_privacystring:1YYN(opted out)
MENA regional compliance
| Jurisdiction | Law | Praevis status |
|---|---|---|
| Saudi Arabia | PDPL (Personal Data Protection Law) | Compliant — no sensitive data collected |
| UAE | Federal Decree-Law No. 45 of 2021 | Compliant |
| Qatar | Law No. 13 of 2016 | Compliant |
| Kuwait, Bahrain, Oman | National data laws | Compliant |
MENA data is processed in FRA (Frankfurt) under Standard Contractual Clauses for cross-border transfers where applicable.
COPPA (Children’s Online Privacy Protection Act)
Praevis does not knowingly collect personal information from children under 13.
Supply sources with audiences that may include children under 13 must:
- Disclose this to Praevis in writing
- Enable COPPA-compliant mode on their supply source account (disables behavioural targeting)
- Pass
coppa=1in bid requests for affected inventory
Demand sources receiving coppa=1 must not use that data for behavioural profiling.
PDPA (Singapore)
As a Singapore-incorporated entity, Nucleus AI Pte. Ltd. complies with the Personal Data Protection Act 2012.
Supervisory authority: Personal Data Protection Commission (PDPC), Singapore Notification obligation: Material breaches notified to PDPC within 3 business days
Getting a DPA
For GDPR-required Data Processing Agreements: → Data Processing Agreement page
For other jurisdiction-specific compliance questions: Email: [email protected]