Marketing & Platform Privacy Policy

In this Policy, "Publishers" refers to entities selling advertising space across digital assets, including mobile applications, Smart TV/Connected TV (CTV) apps, websites, social media platforms, and Digital Out-Of-Home (DOOH) assets such as electronic billboards. "Advertisers" refers to brands, agencies, and programmatic providers (SSPs, DSPs, and exchange platforms). Arayot acts as the strategic conduit, connecting Publisher inventory with Advertiser demand through our proprietary technology (the "Offering").

The Offering includes display and video ad units (pre-roll, mid-roll, post-roll), interactive components, instream units, AI-driven dynamic audio, and real-time auction bidding. These are managed via our web-based platform (the "Platform"), allowing for comprehensive campaign management, reporting, and analytics. Collectively, the website, Offering, and Platform are referred to as the "Services".

This Privacy Policy describes our protocols for collecting, utilizing, and disclosing Personal Data concerning individuals who interact with our Services. This Policy is an integral part of our Terms of Use and is designed to comply with the Israeli Privacy Protection Law, 5741-1981, the EU General Data Protection Regulation (GDPR), and other relevant privacy legislation.

Policy Amendments

We reserve the right to refine this Policy periodically to reflect changes in our technological stack or legal obligations. The "Last Update" header will indicate the most recent revision. Material changes will be notified via the Platform or our website. We encourage a regular review of this Policy to ensure you remain fully informed of our data stewardship practices.

Contact Information & Data Controller

Arayot LTD serves as the Data Controller for the Personal Data processed under this Policy. We have designed our data architecture to prioritize the sovereignty of the individual's data.

The Nature of Data Processed

Our data philosophy is built on the principle of data minimization. We distinguish between Non-Personal Data (aggregated, technical information that does not identify you) and Personal Data (information that identifies you or could reasonably be used to identify you).

A. Non-Personal Data

During your interaction with our Services, we may collect technical information transmitted by your device, such as browser type, operating system, device settings, and aggregated usage patterns. This data is used solely to optimize our delivery and ensure technical compatibility.

B. Personal Data

We do not knowingly collect "Special Categories of Personal Data" (e.g., racial origin, political opinions, or health data). The categories of Personal Data we process include contact information, account credentials, and business-related data necessary for service delivery.

How We Collect Information

We utilize two primary collection channels:

• Voluntary Disclosure: Data you provide when registering an account, contacting support, or engaging in a business partnership.
• Automatic Collection: We use cookies, pixels, and web beacons to gather data on how the Services are navigated. These technologies allow us to remember your settings and provide a coherent, personalized interface without requiring repetitive manual input.

Technical Note on Third-Party Integration: Our website may include features from partners like LinkedIn or Google. These parties may link data collected on our site with information they already hold about you. This processing is governed by the respective third-party privacy policies.

Data Sharing: Recipients & Safeguards

Arayot discloses Personal Data only to the extent necessary to provide the Services or comply with legal mandates.

• Internal Group Sharing: We may share data within Arayot business units for operational efficiency and unified reporting.
• Service Processors: We utilize trusted third-party providers for cloud hosting (e.g., AWS/Azure), CRM management, and billing. These parties are contractually prohibited from using your data for any purpose other than providing services to Arayot.
• Legal & Enforcement: We will disclose data to law enforcement or regulatory bodies if compelled by a verified legal request, specifically regarding anti-fraud or criminal investigations.
• Corporate Evolution: In the event of a merger, acquisition, or asset sale, Personal Data will be transferred to the acquiring entity under the same protections outlined here.

Your Sovereign Rights

We acknowledge your right to control your digital identity. You may exercise the following rights:

• Access & Portability: Request a copy of your data in a structured, machine-readable format.
• Rectification: Correct any inaccuracies in your profile or contact information.
• Erasure ("Right to be Forgotten"): Request the deletion of your data, subject to our legal retention requirements (e.g., tax records).
• Restriction & Objection: Object to processing based on Legitimate Interest or request that we "freeze" the processing of your data.
• Withdrawal of Consent: Revoke your consent for marketing or non-essential cookies at any time.

Data Retention & Security

Retention: We retain data only for as long as necessary to fulfill the purposes for which it was collected. For example, billing information is kept for the duration required by Israeli tax laws, while inquiry correspondence is archived for a period sufficient to address potential follow-up claims.

Security: We implement a defense-in-depth security strategy. This includes SSL/TLS encryption for data in transit, strict access control (least-privilege principle), and regular vulnerability assessments. Our security posture is designed to be a silent but robust shield for your information.

International Data Transfers

Arayot's primary infrastructure is located in Israel. If we transfer data to a third country (e.g., a US-based cloud provider), we ensure adequacy through:

• Standard Contractual Clauses (SCCs): Implementing the latest approved templates.
• Adequacy Decisions: Relying on regulatory assessments of the destination country's legal framework.

Eligibility

The Services are intended for a professional audience. We do not knowingly collect data from children under the age of 16. If we become aware of such collection, we will execute an immediate purge of that data.

Governing Law