SLIDE 1
INTERNAL USE · SEEDTAG
Data Protection
Awareness Training
Seedtag Advertising · Employee training programme
October 2026

SLIDE 2
Agenda
GDPR as our baseline, key concepts, principles, legal bases, rights, transfers and breaches — plus how other jurisdictions differ.
01 · Basics
How data flows in programmatic advertising, which identifiers are personal data, consent signals and Seedtag’s role in the chain.
02 · AdTech
Practical do’s and don’ts, hot topics (CTV, AI, sensitive inferences) and who to contact.
03 · Daily rules
10-question test with answer key to validate what you have learned.
04 · Quiz
Why this training? 
Seedtag processes personal data every day — in our ad technology, with clients and partners, and about our own people across many countries.
Goal: 
give every employee a common baseline to recognise personal data, apply the rules and know when to escalate.

SLIDE 3
INTRODUCTION
Why data protection 
matters at Seedtag
€20M / 4%
Maximum GDPR fine: €20 million or 4% of worldwide annual turnover, whichever is higher.
72 h
Time to notify the supervisory authority of a personal data breach once we become aware of it.
1 month
Deadline to answer a data subject request under GDPR (extendable by two further months in complex cases).
Beyond fines: 
our clients, publishers and partners only work with vendors they trust. Privacy compliance is a commercial requirement in 
contracts
, DPAs and audits — and a condition for keeping access to industry frameworks such as the IAB TCF and GPP.
Everyone is responsible: 
most incidents start with an everyday action — a file shared, a tool tested, an email sent.

SLIDE 4
DATA PROTECTION AWARENESS TRAINING
01
Data protection basics

SLIDE 5
01 · DATA PROTECTION BASICS
One baseline, 
many jurisdictions
Seedtag’s technology and most processing are centralised in Spain, so the 
GDPR is our baseline
. But we contract locally and have people in many countries, so local laws add requirements on top. When in doubt, apply the stricter rule and ask Legal/DPO.
Europe
EU: GDPR (Reg. 2016/679) + ePrivacy rules on cookies
Spain: LOPDGDD (LO 3/2018)
UK: UK GDPR + Data Protection Act 2018
Americas
US: CCPA/CPRA (California) + other state laws
Canada: PIPEDA · Quebec: Law 25
Brazil: LGPD · Mexico: LFPDPPP
Colombia: Law 1581/2012 · Chile: Law 21.719
MENA
UAE: PDPL (Federal Decree-Law 45/2021); DIFC/ADGM free zones
Saudi Arabia: PDPL
Egypt, Qatar, Bahrain, Kuwait, Oman
Israel: Privacy Protection Law
Asia-Pacific
Australia: Privacy Act 1988 (APPs)
India: DPDP Act 2023

SLIDE 6
01 · DATA PROTECTION BASICS
Key concepts: 
what counts as personal data?
Personal data (art. 4.1 GDPR): 
any information relating to an identified or 
identifiable
 natural person — directly or indirectly, including through 
online identifiers.
Typical examples at Seedtag
1
Employees & candidates
name, ID, payroll, performance, images
2
Client & partner contacts
name, business email, phone, role
3
Users who see our ads
cookie IDs, mobile ad IDs, CTV IDs, IP address, device data, approximate location
Special categories (art. 9)
Health, religion, political opinions, sexual orientation, ethnic origin, biometrics, trade union membership. Also when they are inferred.
Pseudonymised data
Hashed emails, user IDs or truncated IPs are still personal data if they can be linked back to a person.
Anonymous data
Only truly aggregated or irreversibly anonymised data (e.g. campaign-level CTR) falls outside the GDPR.
Processing
Anything we do with data: collect, store, match, analyse, share, delete — even just viewing it.

SLIDE 7
01 · DATA PROTECTION BASICS
Who is who: 
controller, processor, joint controller
Controller
Decides why and how personal data is processed.
At 
Seedtag
: 
Seedtag
 for its employees, its own marketing — and, by default, for its advertising technology.
Processor
Processes data only on the controller’s documented instructions (art. 28 GDPR).
At Seedtag: 
Our suppliers (e.g. cloud, HR or CRM tools). Seedtag itself in specific cases, e.g. performance campaigns using a client’s CRM audiences.
Joint controllers
Two or more parties jointly decide purposes and means (art. 26 GDPR).
At Seedtag: 
Only exceptionally and limited to a specific phase (e.g. cookie placement), as sometimes requested in Germany or France.
Seedtag’s default position: 
independent controller vis-à-vis advertisers, publishers, agencies and tech partners. Roles depend on the facts and are not negotiable — never accept a different role in a contract without Legal/DPO approval.

SLIDE 8
01 · DATA PROTECTION BASICS
The 7 principles 
(art. 5 GDPR) in practice
01
Lawfulness, fairness, transparency
Have a legal basis and tell people what we do (privacy policies, notices).
02
Purpose limitation
Data collected for ad delivery is not reused for unrelated purposes without a new basis.
03
Data minimisation
Collect only what is needed — e.g. truncated IPs, no unnecessary fields in exports.
04
Accuracy
Keep client, supplier and employee data up to date.
05
Storage limitation
Apply the retention periods; delete or anonymise logs and files when they expire.
06
Integrity & confidentiality
Access on a need-to-know basis, secure tools, encryption, no personal accounts.
07
Accountability
Be able to prove compliance: RoPA, DPIAs, LIAs, TIAs, contracts, training records.
Privacy by design and by default: 
involve Legal/DPO before launching a new product, feature, tool or integration — not after.

SLIDE 9
01 · DATA PROTECTION BASICS
Every purpose needs a 
legal basis
 (art. 6 GDPR)
Consent
Freely given, specific, informed, unambiguous and as easy to withdraw as to give.
Example: 
Cookies and ad identifiers for personalised advertising (collected by the publisher’s CMP); image rights.
Contract
Necessary to perform a contract with the person.
Example: 
Employment relationship; managing contracts with individual suppliers.
Legal obligation
Required by law.
Example: 
Payroll, tax and social security; answering authorities.
Legitimate interest
Our interest is not overridden by the person’s rights — requires a documented balancing test (LIA).
Example: 
B2B relationship with client contacts, security, fraud prevention, some internal processes.
Vital interest
To protect someone’s life.
Example: 
Medical emergencies.
Public interest
Task in the public interest or official authority.
Example: 
Rarely relevant for Seedtag.

SLIDE 10
01 · DATA PROTECTION BASICS
Transparency and 
data subject rights
Access
know what data we hold
Rectification
correct inaccurate data
Erasure
“right to be forgotten”
Restriction
pause processing
Portability
receive data in a usable format
Objection
e.g. to direct marketing or profiling
Withdraw consent
at any time, as easily as given
Opt-out of sale/sharing
US state laws (e.g. CCPA)
Received a request? Follow 3 steps
1
Do not answer it yourself
Requests can arrive by any channel (email, Slack, LinkedIn, a client) and in any wording.
2
Forward it immediately
Send it to Legal (legal@seedtag.com) and the DPO (seedtagdpo@ecija.com) with all the details.
3
Support as instructed
Help locate the data in your systems. Legal/DPO verify identity and reply.
Deadlines: 
1 month under GDPR; 45 days under CCPA. The clock starts when anyone at Seedtag receives the request.

SLIDE 11
01 · DATA PROTECTION BASICS
Same goal, 
different rules
: what changes by country
Topic
EU / UK (GDPR)
Other jurisdictions — examples
Advertising consent model
Opt-in consent for cookies and ad identifiers (ePrivacy).
US states: opt-out of “sale/sharing” (no prior consent as a rule). Australia, Quebec: implied consent possible with high transparency. Egypt, Saudi Arabia, Qatar, Kuwait, Oman, Bahrain, Morocco, Algeria, Jordan: explicit consent; legitimate interest not 
recognised
 for marketing
 in 
some
 
countries
.
Legitimate interest
Valid basis with a documented LIA.
Brazil (LGPD): recognised, with a documented three-step test. Not recognised in US state laws or most MENA laws.
Minors
Age of digital consent 13–16 (Spain: 14).
CCPA: opt-in under 16, parental consent under 13. Quebec: under 14. Bahrain, Egypt: under 18.
Secondary uses
Must be compatible with the original purpose.
US states under the IAB MSPA and Quebec restrict secondary uses (e.g. AI training, service improvement) without specific consent.
Outbound transfers
Adequacy, SCCs + TIA, or other safeguards.
Algeria: prior 
authorisation
. Egypt: 
licence
 + consent. Quebec: privacy impact assessment before transferring.

SLIDE 12
01 · DATA PROTECTION BASICS
International 
data transfers
Sending personal data, or giving remote access to it, from the EEA to a country outside it is an international transfer — including using a non-EU SaaS tool or sharing a file with a colleague in another region.
Adequacy
FREE FLOW
Countries recognised by the European Commission, e.g. Canada (commercial organisations), Uruguay, UK, Brazil, and US companies certified under the EU-US Data Privacy Framework.
Safeguards
SCCS + TIA
Standard Contractual Clauses plus a Transfer Impact Assessment, e.g. UAE, Mexico, Colombia, Chile, Ecuador, Australia or non-certified US providers.
Local rules
CHECK THE SOURCE COUNTRY
Some countries also restrict data leaving them (e.g. Algeria, Egypt, Quebec). Transfers into Spain are not always free.
Your rule of thumb: 
before uploading personal data to a new tool, vendor or AI service — or sharing it with a new partner — check with Legal/DPO. Seedtag maintains TIAs for its main processing areas (programmatic & research, HR, marketing, office tools).

SLIDE 13
01 · DATA PROTECTION BASICS
Security incidents and 
personal data breaches
Personal data breach: 
a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
It affects confidentiality, integrity or availability — in digital or paper format.
What it can look like at Seedtag
An audience or log file sent to the wrong client or partner
A shared Drive/Slack link left open to anyone
Lost or stolen laptop or phone
Credentials compromised through phishing
Unauthorised access to employee or HR data
Data kept or exposed after it should have been deleted
If you suspect an incident
1
Report immediately
Even if it is only a suspicion. Contact IT/Security, Legal and the DPO.
2
Do not investigate or delete evidence
Contain only if instructed (e.g. revoke a link, recall an email).
3
Cooperate
Provide details: what, when, which data, how many people.
4
Legal/DPO assess
Notification to the authority within 72 h and to affected people if high risk. Clients may also need to be told.

SLIDE 14
01 · DATA PROTECTION BASICS
Seedtag’s 
compliance toolkit
These documents exist so that we can prove compliance. You may be asked to contribute to them — keep them in mind when something changes.
RoPA
Record of processing activities (art. 30): what we process, why, where and for how long.
DPIAs
Impact assessments for high-risk processing, e.g. ad serving, curation, fraud prevention, cookie sync, LIZ.
LIAs
Legitimate interest balancing tests, e.g. agencies’ access to databases, surveys, security.
TIAs
Transfer impact assessments for data leaving the EEA.
DPAs & JCAs
Contract templates with publishers, agencies and advertisers defining roles and obligations.
Policies
Employee and web privacy policies, security policy, rights, breach and DPO procedures.
Privacy by design
Reviews before new tools or integrations go live (e.g. calendar integrations, AI tools).
DPO
Seedtag has appointed a Data Protection Officer, supported by ECIJA.

SLIDE 15
DATA PROTECTION AWARENESS TRAINING
02
Personal data in AdTech

SLIDE 16
02 · PERSONAL DATA IN ADTECH
How an ad reaches a user — 
and where personal data flows
User
visits a website, app or CTV
Publisher + CMP
collects consent and sends the signal
Seedtag
receives the bid request, analyses the context and decides
DSP / Advertiser
bids and buys the impression
Ad served
impression, click and conversion are measured
What typically travels in a bid request
Cookie / mobile ad ID / CTV ID
personal data
IP address (truncated)
personal data
Approx. geolocation
derived from IP
Device & user agent
personal data in combination
Page URL & context
can reveal interests
Consent string (TCF / GPP)
tells us what we may do
Key message: 
even without names or emails, online identifiers make the user identifiable — the GDPR applies.

SLIDE 17
02 · PERSONAL DATA IN ADTECH
Contextual advertising 
still involves personal data
Seedtag’s contextual AI (LIZ) classifies 
pages, not people
: it analyses text, images and structure to understand the topic of the content.
However, serving, measuring and securing each ad still uses identifiers, IPs and device data. And when contextual signals are combined with retargeting segments or advertiser data, the risk increases.
Sensitive inferences: the red line
Classifying a URL as “health” or “religion” is about the content
Labelling a user as “interested in diabetes” or “Catholic” is special category data (EDPB Guidelines 8/2020)
Never build or activate segments that single out people by health, religion, politics, sexual orientation or ethnicity
Other AdTech techniques to be aware of
Cookie syncing / ID matching
Linking IDs between platforms creates new personal data flows.
Retargeting & CRM audiences
Hashed emails or phone numbers are pseudonymised, not anonymous.
Frequency capping & measurement
Require recognising the same device over time.
Fraud prevention
Legitimate and necessary, but must be proportionate and documented.
Web scraping & AI
Content analysis can capture personal data that appears on pages.

SLIDE 18
02 · PERSONAL DATA IN ADTECH
Consent signals: 
TCF, GPP and our responsibility
IAB TCF
Transparency & Consent Framework used in the EEA, UK and Canada. The publisher’s CMP generates a consent string listing purposes and vendors.
IAB GPP / MSPA
Global Privacy Platform for US state laws: carries opt-out signals for sale, sharing and targeted advertising.
No framework
Outside these regions, the partner’s CMP must still identify Seedtag, collect valid consent where required and pass the signal to us.
How we read the risk of each signal
NO RISK
TCF/GPP signal + signed contract
LOW
TCF/GPP signal, no signed contract
MODERATE
CMP marked “not applicable” + signed contract
HIGH
CMP marked “not applicable”, no contract
Golden rule: 
the publisher collects consent, but Seedtag must respect it. If there is no valid signal where one is required, personal data must not be used for advertising purposes — and recurrent gaps with a partner must be escalated.

SLIDE 19
02 · PERSONAL DATA IN ADTECH
Seedtag’s role 
in each relationship
Advertisers
Independent controllers
Targeting is mainly defined by the advertiser; Seedtag does not control data the advertiser held before, nor the campaign’s results.
Publishers
Independent controllers
Seedtag
 does not define campaign criteria for publishers; it manages ad inventory. Publishers collect consent and inform users.
Agencies
Seedtag = independent controller
The agency acts for its client and must contractually guarantee the client’s compliance (information, consent).
Tech providers
Case by case
Joint controllership may only arise for cookie placement/access — every other flow stays separate.
Performance / CRM
Seedtag
 = 
controller
 
or
 
processor
When an advertiser provides its own customer data for a campaign, we
 
may
 act on its instructions under a DPA
 
or
 
we
 
may
 use 
the
 data 
for
 
our
 
own
 
purposes
, 
depending
 
on
 
the
 case.
.
Contracts: 
always use Seedtag’s DPA/JCA templates and route any counterparty paper to Legal.

SLIDE 20
DATA PROTECTION AWARENESS TRAINING
03
Day-to-day rules

SLIDE 21
03 · DAY-TO-DAY RULES
Hot topics: 
CTV, AI and minors
1
Connected TV
The device maker, app or FAST channel collects the data and must give notice before collection
.
Check local restrictions before launching CTV in a new country (e.g. Canada, LATAM, MENA).
2
AI tools & LIZ
Do not upload third-party personal data or confidential client data to AI tools that are not approved.
Using data to train or improve models is a separate purpose: in many US states it requires specific consent.
Follow the LIZ terms of use and the Information Security Policy.
3
Minors
We do not target children. Ages vary: 13–16 in the EU (14 in Spain), under 16 opt-in under CCPA, up to 18 in some MENA countries.
Avoid inventory and segments directed at children.

SLIDE 22
03 · DAY-TO-DAY RULES
Everyday 
do’s and don’ts
DO
DON’T
Share data on a need-to-know basis, through approved tools only
Use aggregated or anonymised reports whenever possible
Ask Legal/DPO before a new tool, vendor, integration, product or country launch
Use Seedtag’s contract templates (DPA, JCA) and the latest privacy policies
Forward any rights request or privacy complaint immediately
Report incidents and suspicious emails straight away
Respect retention periods and clean up files and exports
Send audience files, logs or employee data to personal accounts
Open sharing links to “anyone with the link”
Build segments on health, religion, politics, sexual orientation or ethnicity
Process ad data without a valid consent signal where one is required
Upload personal or confidential data to unapproved AI tools
Accept a different data protection role in a contract without Legal
Ignore a request because it is informal or comes from a non-client

SLIDE 23
Five things to remember
1
Online identifiers, IPs and device data are personal data — the GDPR applies to AdTech.
2
The GDPR is our baseline; local laws add rules on consent, minors and transfers. 
3
Seedtag is, by default, an independent controller — roles are set by facts, not by contract wording.
4
No valid consent signal, no personalised processing. Never infer sensitive traits about people.
5
When in doubt, ask: Legal and the DPO. Report incidents and requests immediately.

SLIDE 24
DATA PROTECTION AWARENESS TRAINING
04
Knowledge check

SLIDE 25
04 · KNOWLEDGE CHECK
Test your knowledge 
(1/2)
1
Which of these is personal data under the GDPR?
A) 
An aggregated campaign report
B) 
A cookie ID linked to a browser
C) 
A publisher’s domain name
D) 
A country-level impressions total
2
A hashed email received from an advertiser is…
A) 
Pseudonymised personal data
B) 
Anonymous data, outside the GDPR
C) 
Only personal data if combined with a name
D) 
A special category of data
3
A user emails you asking what data Seedtag holds about them. What do you do?
A) 
Reply yourself with what you can find
B) 
Ignore it if the user is not a client
C) 
Forward it immediately to Legal and the DPO
D) 
Ask them to resend it via LinkedIn
4
How long does Seedtag have to notify the authority of a personal data breach under the GDPR?
A) 
24 hours
B) 
One month
C) 
There is no deadline
D) 
72 hours from becoming aware
5
By default, what is Seedtag’s role towards publishers and advertisers?
A) 
Independent controller
B) 
Processor
C) 
Joint controller in every case
D) 
It has no role

SLIDE 26
04 · KNOWLEDGE CHECK
Test your knowledge 
(2/2)
6
A bid request from an EU publisher arrives without a valid consent signal. What applies?
A) 
Process it anyway: we are contextual
B) 
Rely on legitimate interest instead
C) 
Don’t use the personal data for ads; escalate if it recurs
D) 
Ask the user directly
7
Which statement about contextual advertising is correct?
A) 
It never involves personal data
B) 
Classifying pages is fine; inferring a user’s health or religion is sensitive data
C) 
Sensitive segments are allowed if the advertiser asks
D) 
The GDPR does not apply to AI classification
8
An advertiser shares its CRM audience (hashed emails) for a performance campaign. Seedtag acts as…
A) 
Processor, under a DPA
B) 
Independent controller
 
or
 
processor
, 
depending
 
on
 
the
 case
C) 
Joint controller
D) 
Not relevant: the data is hashed
9
You want to test a new AI tool by uploading a campaign log with device IDs. What should you do?
A) 
Go ahead if it is a free trial
B) 
Delete the IDs after the test
C) 
Check with Legal/DPO and Security first
D) 
Use your personal account
10
Which statement about global privacy laws is true?
A) 
GDPR compliance automatically satisfies every country
B) 
Laws only apply where Seedtag has an office
C) 
Consent rules are identical worldwide
D) 
Some countries restrict transfers out; US states give sale/sharing opt-outs

SLIDE 27
04 · KNOWLEDGE CHECK
Answer 
key
1
B
Online identifiers make a person identifiable (art. 4.1 GDPR).
2
A
Hashing is pseudonymisation: the data can still be linked to a person.
3
C
Requests can arrive by any channel; Legal/DPO manage identity checks and replies.
4
D
Art. 33 GDPR: without undue delay and, where feasible, within 72 hours.
5
A
Seedtag decides its own purposes and means in its ad technology.
6
C
No valid signal where one is required means no personalised processing.
7
B
EDPB Guidelines 8/2020: inferred sensitive traits are special category data.
8
Depending
 
on
 
whether
 
Seedtag
 uses 
the
 data 
for
 
its
 
own
 
purposes
.
9
C
New tools may involve transfers, new processing and need a DPA.
10
D
E.g. Algeria/Egypt transfer rules; CCPA opt-out of sale/sharing.
Suggested pass mark: 8/10.
B

SLIDE 28
QUESTIONS
Questions? 
We are here to help
Seedtag
 
Privacy
 Office
gdpr
@
seedtag.com
Contracts, new projects, tools and vendors, privacy questions.
Data Protection Officer
seedtagdpo@ecija.com
Rights requests, incidents, DPIAs and any privacy concern.
Guidelines
 and 
Policies
Compliance
 Drive
Policies
 
and procedures (latest versions).