Serafino Privacy Statement
Last updated: 1 August 2025
We, Serafino Pte. Ltd., have issued this Privacy Statement to describe how we collect, use, disclose and otherwise process your personal data when you access online services operated by members of our digital ad network. This Privacy Statement also includes information about statutory rights you may have with respect to our processing of your personal data and how to exercise them.
Members of our digital ad network include “advertisers”, which are third parties that contract with us to deliver their own digital ads to you and others, and “publishers”, which are third parties that contract with us to display advertisers’ ads in their own online services. We use the term “online services” to include all types of services that are connected to the Internet, including websites, mobile applications, digital ads, and emails.
Advertisers and publishers separately and
independently operate their own online services and determine the means and
purposes of processing your personal data when you visit those services. Advertisers
and publishers may disclose to us some of the personal data they collect from
you when you access their online services so that we can provide them with our
digital ad network services. In these cases, we process your personal data for
the purposes described in this Privacy Statement. Please also refer to advertisers’
and publishers’ own privacy statements for information about how they process
your personal data when you visit their respective online services and your
choices with respect to such processing.
If you reside in the European Economic
Area (EEA) or United Kingdom (collectively, “EEA+”), or the U.S., please
also see our Supplemental Jurisdiction-Specific Terms further below.
We may collect various types of personal data about you depending on how you interact with our online services and those operated by members of our digital ad network. These types of personal data include the following:
· Ad Metadata and Interaction Data: This includes data about how you interact with the digital ads we serve, including whether you view or click an ad, the date and time of those actions, impression IDs (unique identifiers assigned when an ad is shown), click IDs (unique identifiers assigned when an ad is clicked), deeplink activity (whether you are redirected to another app or page), session IDs (used to group related user interactions that occur during a single session), request IDs (used to track each data transmission event), attribution tokens (which help determine whether an ad resulted in a desired action, such as an app install or purchase), download completion status, metadata about the ads themselves (such as about the ad’s placement, content, format and targeting criteria), metadata about the apps through which you access ads (such as the app’s name, version number and platform) and any redirection or bounce events (e.g., when a user is taken to an unintended or fallback destination due to a failed redirect link) related to the ad.
We may collect personal data from the following sources:
· Publishers: When you use an online service operated by a publisher in our digital ad network, we may collect your Device Information, Ad Identifiers, Location Data, Consent and Preference Data, Ad Metadata and Interaction Data, and Behavioral Data. Publishers are responsible for designing their own online services and may include functionality that collects personal data from your device. Publishers may disclose some of this data to us to receive our advertising services, such as to help us deliver, measure or personalize ads shown in their services.
· Advertisers: When you interact with an online service operated by an advertiser in our digital ad network, we may receive your Device Information, Ad Identifiers, Ad Metadata and Interaction Data, and Behavioral Data. Advertisers decide what personal data to collect through their services and may disclose certain data to us for purposes such as measuring whether an ad led to an installation of their mobile applications, an online transaction or another interaction with their online services.
· Third-Party Data Providers: We may also receive Ad Identifiers, Ad Metadata and Interaction Data, and Behavioral Data from third-party data providers who collect such information from users of their own services, including gaming platforms. These third parties may disclose personal data to us to supplement the data we collect from other sources and to help improve the delivery, relevance, and performance of our advertising services.
We may process your personal data for the following purposes depending on the Consent and Preference Data you have provided to us and members of our digital ad network.
· Deliver and target ads: We may deliver and
target digital ads on publishers’ online services based on your Device Information, Ad
Identifiers, Location Data, Ad Metadata and Interaction Data, and Behavioral
Data.
· Track your preferences across online services: We may analyze your activity across different online services over time, build a profile of your Behavioral Data across time and services, and use that profile to determine which ads to show you.
· Improve the accuracy of our ad targeting and recommendation systems: We may process your Device Information, Ad Identifiers, Ad Metadata and Interaction Data, and Behavioral Data to train and refine the systems we use to predict which ads are most relevant to different categories of individuals.
· Optimize bidding strategies in real time: We may process Ad Metadata and Interaction Data to help determine how much advertisers should bid to display an ad. This includes evaluating how well certain ads perform at specific times, in specific geographies, or on specific online services or devices, and how valuable each impression may be to the advertiser.
· Measure and analyze ad performance: We may process Ad Identifiers and Ad Metadata and Interaction Data to understand whether and how you interact with ads that we deliver, such as whether you clicked on an ad or installed an app afterwards. This helps us report to advertisers the effectiveness of their campaigns and improve future ad targeting.
· Generate aggregated reports: We may aggregate or perform other operations on sets of personal data to create reports that do not contain any personal data. We may then use these reports for any lawful business purpose, including disclosing them to members of our digital ad network to help them understand how their ads and our services are performing.
· Troubleshoot technical issues: We may process Device Information and Ad Metadata and Interaction Data to diagnose and resolve technical problems affecting our systems. For example, we may review logs to investigate errors or crashes involving our ad delivery process.
· Detect and prevent fraud: We may process Device Information and Ad Metadata and Interaction Data to help identify and block suspicious or invalid traffic, such as fake clicks or spoofed devices. This protects advertisers from being charged for fraudulent activity and helps ensure ads reach real users.
· Improve our products and services and develop new ones: We process Device Information and Ad Metadata and Interaction Data to evaluate how our systems are working, identify areas for improvement, and develop new products and services. This includes analyzing past performance, user interaction trends, and technical errors to optimize the advertising experience for users and members of our digital ad network.
· Comply with legal obligations and respond to lawful requests: We may process any personal data we have collected to comply with applicable laws, regulations, legal processes or government requests.
· Establish, exercise or defend legal claims: We may process any personal data we have collected where necessary to protect our rights, resolve disputes, enforce our agreements, or participate in legal proceedings.
· Support corporate transactions: We may use any personal data we have collected to evaluate or effectuate an actual or potential merger, acquisition, financing, asset sale, bankruptcy, or other corporate transaction involving our business. Where appropriate, we will take steps to ensure that personal data remains subject to confidentiality and data protection obligations.
We may disclose your personal data to the following categories of third parties. In all cases, we will take steps to ensure that personal data remains subject to confidentiality and data protection obligations as required by applicable laws.
· Service Providers: We may disclose personal data to third-party service providers that process the data on our behalf and under our instructions. These include cloud hosting and infrastructure providers and analytics vendors that help us measure ad performance and user engagement. These service providers are contractually obligated to protect the personal data we disclose to them and are not permitted to use it for their own purposes.
· Authorities: We may disclose personal data if required to do so by law or legal process, or in response to valid requests from government authorities, courts or regulators. We may also disclose personal data where necessary to protect our legal rights or the rights of others, or to investigate potential violations of law or our agreements.
· Parties to Corporate Transactions: We may disclose personal data to evaluate or effectuate an actual or potential merger, acquisition, financing, asset sale, bankruptcy, or other corporate transaction involving our business. Where appropriate, we will take steps to ensure that personal data remains subject to confidentiality and data protection obligations.
· Third Parties with Your Consent or Direction: We may disclose your personal data to advertisers, publishers, and other third parties when you direct us to do so or otherwise provide your consent.
We also disclose aggregated and de-identified data to publishers and advertisers in our digital ad network and other third parties. For example, we may provide aggregated statistics about how many individuals installed an app after seeing an ad for that app. In addition, when you click on an ad, you may yourself cause the advertiser to receive personal data about you. This is because clicking the ad may redirect you to the advertiser’s own online services, where the advertiser receives your IP address and other personal data.
We are located in Singapore, rely on
service providers in the United States of America, and we support advertisers
and publishers around the world. When we transfer your personal data
internationally, we enter into data protection and processing agreements with
the recipients to protect your data. We also maintain technical,
administrative, and organizational data security measures intended to protect your
personal data from unauthorized access, loss, misuse, alteration or
destruction. These include access controls, data encryption, network firewalls,
and internal data security protocols.
In general, we retain your personal data for up to 3 years from when it was collected, unless you request that we delete it, in which case we will delete the data as soon as required by applicable laws. We may also retain personal data for longer than the 3-year period mentioned above if it is necessary for us to do so to comply with applicable laws or to establish, exercise or defend our legal rights in the context of an anticipated or actual dispute. Once the personal data is no longer necessary for such purposes, we will delete it or permanently convert it into non-personally identifiable information.
Our online services are not specifically targeted or directed at minors. We contractually require publishers and advertisers that disclose personal data to us to comply with laws that apply to any collection and further processing of minors’ personal data. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete such data promptly or otherwise handle it in accordance with applicable laws. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us using the information provided in Section 10 of this Privacy Statement.
There are various ways in which you can exercise control over the personal data processing activities described in this Privacy Statement, including by using the online mechanisms or exercising the statutory rights described below.
·
Device-Level Settings: Many mobile device platform and software providers provide options
for limiting the use of advertising identifiers. For example:
o
On iOS devices, you can go to “Settings”
> “Privacy & Security” > “Tracking” to manage whether apps can track
your activity across other companies’ apps and websites.
o
On Android devices, you can go
to “Settings” > “Security and Privacy” > “Privacy Controls” > Ads” to
delete your advertising ID or adjust your ad personalization settings.
If the
operators of apps you use are members of our digital ad network, these settings
will affect whether and how we may use data about your device and activities on
such apps to show you personalized ads.
·
The Choices Advertisers and
Publishers Give You: When you access an online
service operated by an advertiser or publisher in our digital ad network, the
operator of that service is required to present you with notices about how they
collect, use, disclose and otherwise process your personal data, and obtain
your consent as may be required under applicable law. Consent interfaces may
give you the option to agree to, decline, or opt out of, the processing of your
personal data for certain purposes such as personalized advertising based on
the processing of Behavioral Data. We contractually require advertisers and
publishers to provide notices and collect consents as required by law.
· The Choices We Give You: You may out of receiving personalized ads that we deliver based on your Behavioral Data through Your Privacy Choices. Opting out of personalized ads based on Behavioral Data does not mean that you will no longer see ads because we may still deliver contextual ads or other ads not based on Behavioral Data to you.
In addition, depending on the privacy laws that apply to our processing of your personal data and the conditions that apply under these laws, you may have some or all of the following rights with respect to your personal data:
· Access: You may have the right to access information about how we process your personal data and copies of such data.
· Correction: You may have the right to ask us to correct or complete your personal data if it is wrong or incomplete.
· Deletion: You may have the right to ask us to delete your personal data when certain conditions apply.
· Restriction on processing: You may have the right to ask us to restrict the use of your personal data when certain conditions apply.
· Object to processing: You may have the right to object to us processing your personal data when certain conditions apply.
· Portability: You may have the right to receive your personal data in a structured and commonly used format so you can use this data with another company when certain conditions apply.
· Opt-out of targeted advertising: Some jurisdictions give you the right to opt out of targeted advertising where opt-in consent is not otherwise required. You may opt out by following the instructions following the sub-heading “The Choices We Give You” above.
· Non-discrimination: You may have the right not to receive discriminatory treatment for exercising your statutory rights over your personal data.
· Consent withdrawal: There are certain circumstances where we rely on your consent to process your personal data. If you have provided consent, you may have the right to withdraw your consent at any time. If you withdraw your consent, this will not affect the lawfulness of our use of your personal data before your withdrawal.
To submit a request to exercise your statutory rights over your personal data, you can contact us by any method described in Section 10 of this Privacy Statement.
From time to time, we may update this Privacy Statement if applicable laws or changes to our practices require changes. When we make changes to this Privacy Statement, we will change the date at the beginning of the document. We may work with advertisers and publishers in our digital ad network to address any notice and consent requirements that apply to our Privacy Statement updates.
If you have any questions about our privacy practices, personal data processing activities, or would like to exercise your rights under privacy laws, you may email us at dataprotection@bucoup.com complete our data subject rights request form Serafino DSR Request Form, or write to us at: Serafino Pte. Ltd., 10 Anson Road, #21-07, International Plaza, Singapore 079903.
In your request, please describe how you would like us to assist or what rights you are exercising. We may need to request specific information from you to help us verify your identity and that you have the right to request what you are requesting. These are security measures to ensure that we do not disclose personal data to any person who has no right to receive it or otherwise process the data in unauthorized ways. We may also contact you to ask for further information about your request to clarify the scope of your request and speed up our response. We will respond to requests to exercise statutory rights according to applicable laws.
We address this Supplemental EEA+ Privacy Statement to individuals located in the EEA and United Kingdom only. If you are located in the EEA, the EU General Data Protection Regulation applies to our processing of your personal data, as well as local data protection laws, as the case may be. If you are located in the UK, the UK General Data Protection Regulation applies to our processing of your personal data. References to the “GDPR” are references to the General Data Protection Regulation as it applies in the country where you are located.
The data controller is us, Serafino Pte. Ltd., 10 Anson Road, #21-07, International Plaza, Singapore 079903.
|
Jurisdiction |
Representative |
Address |
Contact details |
|
EU |
Proxima Beta Europe B.V. |
Buitenveldertselaan1-5,1082 VA, Amsterdam, the Netherlands |
|
|
UK |
Image Frame Investment (UK) Limited |
Suite 1, 3rd Floor 11 - 12
St. James’s Square, London, United Kingdom, SW1Y 4LB |
You can contact our data protection officer here.
Please see Section 1 of this Privacy Statement.
Please see Section 2 of this Privacy Statement. We currently rely on one third-party data provider, Miniclip, whose privacy policy is accessible here.
The table further below outlines the purposes for which we process personal data and the lawful bases of processing that correspond with each processing purpose. For more information about what the purpose of processing entails, please see Section 3 of this Privacy Statement. The lawful bases of processing include the following:
· The processing is necessary for us to comply with an applicable legal obligation per Article 6(1)(c) GDPR (“Legal Obligations Legal Basis”);
· The processing is necessary for us or another to pursue a legitimate interest based on an assessment of that interest and your privacy and other fundamental interests per Article 6(1)(f) GDPR (“Legitimate Interest Legal Basis”)—you can request more information on how we weigh your interests against the legitimate interests pursued by contacting us using the details at Section 10 of this Privacy Statement; or
· The processing is performed according to your consent per Article 6(1)(a) GDPR (“Consent Legal Basis”). In these cases, you can withdraw your consent at any time with future effect through Serafino DSR Request Form, or by contacting us using the details at Section 10 of this Privacy Statement with a description of what data processing activities of ours you would like to withdraw your consent from.
Where the lawful basis of processing is the Legitimate Interest Legal Basis, we describe the legitimate interests pursued in the table below.
|
Purpose
of Processing |
Lawful Basis
and Legitimate Interests Pursued |
|
·
To deliver and target ads.
|
·
Consent Legal Basis if we target ads at
you based on your Behavioral Data or where
applicable laws require your consent for such processing. ·
Otherwise, Legitimate Interest Legal
Basis—namely, to enable us and members of our digital ad network to promote
products and services more effectively by displaying ads based on your personal
data other than Behavioral Data. |
|
·
To track your preferences
across online services. |
·
Consent Legal Basis where applicable
laws require your consent for such processing. ·
Otherwise, Legitimate Interest Legal
Basis—namely, to enhance ad delivery and user experience. |
|
·
To improve the accuracy
of our ad targeting and recommendation systems. |
·
Legitimate Interest Legal Basis—namely,
to deliver more relevant personalized ads to you and more effective services
to members of our digital ad network. |
|
·
To optimize bidding
strategies in real time. |
·
Legitimate Interest Legal Basis—namely,
to help advertisers in our digital ad network maximize the value of their
investments in advertising campaigns. |
|
·
To measure and analyse ad
performance. |
·
Legitimate Interest Legal Basis—namely,
to understand the effectiveness of ad campaigns and optimise the ad
strategies of advertisers in our digital ad network. |
|
·
To generate aggregated reports. |
·
Legitimate Interest Legal Basis—namely,
to enable us to provide aggregated insights to members of our digital ad
network and other parties so that we and they can optimize our respective
businesses. |
|
·
To troubleshoot technical issues. |
·
Legitimate Interest Legal Basis—namely,
to ensure the reliability and security of the systems that enable delivery of
ads to you. |
|
· To detect
and prevent fraud. |
·
Legitimate Interest Legal Basis—namely,
to protect us and advertisers and publishers in our digital ad network from
fraudulent activity. |
|
· To improve
our products and services and develop new ones. |
·
Legitimate Interest Legal Basis—namely, to
enhance our services and design new features that may result in benefits for
you and advertisers and publishers in our digital ad network. |
|
· To comply
with legal obligations and respond to lawful requests. · To
establish, exercise or defend legal claims. |
·
If applicable laws in your jurisdiction
require us to process your personal data for these purposes, Legal
Obligations Legal Basis. ·
Otherwise, Legitimate Interest Legal
Basis—namely, to enable us to comply with applicable laws, enforce contracts,
and defend, exercise or establish our legal rights. |
|
·
To support corporate transactions. |
·
Legitimate Interest Legal Basis—namely,
to engage in a transaction that our management team considers to be
advantageous to our business interests. But we will seek your consent if we
wish to use your personal data for any new purpose incompatible with those
set forth in this Privacy Statement, and if you provide such consent, the
Consent Legal Basis applies. |
Please see Section 4 of this Privacy Statement.
We are located in Singapore and disclose personal data to processors in the United States of America. Publishers and advertisers are based in many countries worldwide. We take measures to ensure that our processors provide an adequate level of data protection by entering into appropriate data transfer agreements based on Standard Contractual Clauses and performing data transfer assessments. Data transfer agreements are accessible upon request by contacting us using the details at Section 10 of this Privacy Statement.
In the EEA and the UK, you have the following rights, subject to the conditions under the GDPR and local data protection law:
· To object, on grounds relating to your particular situation, to the processing of your personal data by us. This includes the right to object to our processing of our personal data where a legitimate interest is being pursued. If you object to such processing, we will cease processing your personal data unless the processing is based on compelling legitimate grounds or is needed for legal reasons.
· To obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to details about how we process your personal data and copies of the personal data.
· To obtain from us the rectification of inaccurate personal data concerning you.
· To erase your personal data.
· To restrict the processing of your personal data.
· To receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and to transmit the personal data to another entity.
· To withdraw your consent at any time where the lawful basis of processing is the Consent Legal Basis. This will not affect the lawfulness of our use of your personal data before your withdrawal.
· To lodge a complaint with a supervisory authority.
· In some jurisdictions such as France and Portugal, you also have the right to provide us with guidelines as to the processing of your personal data after your death.
You may view a list of supervisory authorities in the EEA and UK and their respective contact information here:
· EEA: https://edpb.europa.eu/about-edpb/about-edpb/members_en
· United Kingdom: https://ico.org.uk/global/contact-us/
To submit a request to exercise your privacy rights, you can contact us using the details in Section 10 of this Privacy Statement.
No. You are not legally required to provide personal data to us.
No. We may use automated tools to analyze your interactions with online services operated by members of our digital ad network, and to determine which ads may be most relevant to your interests. This type of analysis is often referred to as “profiling”, and we use it to deliver personalized ads across different websites, applications, and devices. But we do not use profiling to make decisions that produce legal effects or similarly significant effects concerning you within the meaning of Article 22(1) of the GDPR.
Yes,
we participate in the IAB Europe Transparency & Consent Framework and comply
with its Specifications and Policies. Our identification number within the
framework is 1440.
We address this Supplemental U.S. Privacy Statement to individuals residing in the U.S. only.
If you reside in certain states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have, or you may soon have, the following rights under the privacy laws of your state, subject to the conditions under applicable laws:
· To confirm whether or not we process your personal data and obtain copies of such data (in some cases, in a portable format);
· To correct inaccuracies in the personal data we hold about you, taking into account the nature of the personal data and the purposes for which it is processed;
· To delete personal data that we hold about you;
· To opt out of our processing of your personal data for the purposes of targeted advertising. You can opt out of our processing of your personal data for targeted advertising purposes (i.e., targeted ads at you based on your Behavioral Data) by following the instructions available at Your Privacy Choices. We also respond to opt-out preference signals communicated via the Global Privacy Control and will process such signals with respect to the browser, device or, if known, the individual, communicating the signals. Opting out of personalized ads does not mean that you will no longer see ads because we may still deliver contextual ads or other ads not based on Behavioral Data to you.
· To opt out of the sale of your personal data. We do not sell your personal data.
· To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not engage in such profiling. We may use automated tools to analyze your interactions with online services operated by members of our digital ad network, and to determine which ads may be most relevant to your interests. This type of analysis is often referred to as “profiling”, and we use it to deliver personalized ads across different websites, applications, and devices. But we do not use profiling to make decisions that produce legal effects or similarly significant effects concerning you.
· If you reside in Oregon, you may have the right to request from us a list of the specific third parties, other than individuals, to whom we have disclosed your personal data or any personal data.
You may submit a request to exercise your rights by contacting us using the information provided in Section 10 of this Privacy Statement. If we decline to take action on a request exercising one of your rights set forth above, you may have the right to appeal our decision. In these cases, we will notify you providing our reasons for denying the request and instructions for how you can appeal the decision.
This Notice for California Residents provides
details about how we collect, use, disclose and otherwise process California
residents’ personal information and rights that they may have under the
California Consumer Privacy Act (“CCPA”). This Notice for California
Residents only applies to you if you reside in California,
and does not reflect our processing of California residents’ personal
information where an exception under the CCPA applies. When we use terms in
this Notice that the CCPA has defined, those terms have the meanings that the
CCPA defined.
We may collect the following categories of
personal information about California residents:
· Identifiers.
·
Internet
or other electronic network activity information.
·
Geolocation
data, but not precise geolocation data.
·
Electronic
or similar information.
·
Inferences
drawn from the information we collect to create a profile about a consumer
reflecting the consumer’s preferences and behavior.
For more details about the categories of
personal information we collect, please see Section 1 of this Privacy
Statement. For details about the purposes for which we process personal
information, please see Section 3 of this Privacy Statement. We do not sell
personal information or share it for cross-context behavioral advertising. Below
is a copy of our CCPA Privacy Policy.
This CCPA Privacy
Policy describes our personal information processing activities over the
preceding 12 months. We collected the following categories of personal
information about California residents:
· Identifiers.
· Commercial information.
· Internet or other electronic network activity
information.
· Geolocation data, but not precise geolocation
data.
· Electronic or similar information.
· Inferences drawn from the information we
collect to create a profile about a consumer reflecting the consumer’s
preferences and behavior.
For more details about the categories of
personal information we collect, please see Section 1 of this Privacy
Statement. For details about the sources from which we collected the personal
information, please see Section 2 of this Privacy Statement. For details about
the purposes for which we processed personal information, please see Section 3
of this Privacy Statement. For details about our disclosures of personal
information and the recipients of the information, please see Section 4 of this
Privacy Statement.
We did not sell California residents’ personal
information or share it for cross-context behavioral advertising. We do not
have actual knowledge that we sell, or share for cross-context behavioral
advertising, the personal information of California residents under 16 years of
age. We may use deidentified information for any purpose. We commit to
maintaining and using deidentified information in deidentified form and not to
attempt to reidentify the information, except for the purpose of determining
whether our deidentification processes satisfy applicable legal requirements.
As a
California resident, you have the following rights under the CCPA, subject to
the conditions therein:
To
submit a request to exercise your rights to know, delete or correct, please contact
us using the information provided in Section 10 of this
Privacy Statement.
Only
you, or someone legally authorized to act on your behalf, may make a request
related to your personal information. In
your request or in response to us seeking additional information, you, or your
authorized agent, must provide
sufficient information to allow us to reasonably verify that you are, in fact,
the person whose personal information was collected which will depend on your
prior interactions with us and the sensitivity of the personal information being
requested. We may ask you for information to verify your identity and, if you
do not provide enough information for us to reasonably verify your identity, we
will not be able to fulfil your request. We will only use the personal
information you provide to us in a request for the purposes of verifying your
identity and to fulfill your request.
You can designate an authorized agent to make a
request under the CCPA on your behalf if:
If you
provide an authorized agent with power of attorney pursuant to Probate Code
sections 4121 to 4130, it may not be necessary to perform these steps and we
will respond to any request from such authorized agent in accordance with the
CCPA.