Privacy Policy Sonata

This Privacy Policy has been updated in accordance with the General Data Protection Regulation (UE) 2016/679.

Effective Date: 25 May 2018

TAPTAP contact details


Paseo de la Castellana, 111, 1ª

28046 Madrid, Spain

Mail for requests and queries on privacy: privacy@taptapnetworks.com

Data Protection Officer contact: DPOprivacy@dwf-rcd.law

Personal data we process

We receive personal data about internet users (Users Data) from publishers, exchanges and other data providers, such as segment name and associated device IDs (IDFA, AAID) or cookie IDs, including navigation and location data (as derived from IP address or GPS for mobile), unique identification numbers (e.g. IP address and mobile phone device ID), interest segments like inferred information on the behavior or likely interests associated with a device, or retargeting data revealing previous interest in a product or website.

We also process contact and billing information of our customers and providers, as necessary to manage and render our services.


We act as data processor for advertisers and their agencies.

As an ad tech, TAPTAP acts as a service provider to enable advertisers and their agencies to customize and manage their digital and mobile advertising campaigns, to collect, analyze and use data to efficiently select and buy digital mobile advertising and ad inventory from ad exchanges and/or publishers, and to show more relevant digital advertisement and to engage with the relevant audiences.

By using our Sonata platform, companies and agencies do profile audiences. Sonata can analyze or predict aspects concerning the personal preferences or interests of end users based on their personal data, including navigation and location data.

Our platform also manages publicity adverts through the geolocation of final users, and after the detection of a user in the proximities of the advertiser’s establishment, it generates advertising content in the different supports managed by the platform.

Legal basis

TAPTAP processes personal data to the extent that at least one of the following applies:

  1. The data subject has given consent for one or more specific purposes; this consent is obtained either by publishers and/or their providers, or by our other data providers.
  2. Processing is necessary for the performance of our agreements with our partners and customers.
  3. Processing is necessary to comply with our legal obligations, such as tax or labor.
  4. Processing, including profiling, is necessary for the purposes of the legitimate interest of our customers to provide their audiences with targeted ads and to optimize the cost of providing content free and interest-based digital and mobile advertising to consumers, when that interest is not overridden by the individual’s data protection rights.

Disclosure to other recipients

Typically, we may share the Users Data we collect from publishers, exchanges and other data providers with our customers (advertisers and their agencies).

We also may share the personal data of our customers and providers to other service providers, when we have consent or as necessary to render our services.


TAPTAP services allow our customers to profile their audiences according to interest segments, to show them more relevant digital advertisement. Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling.

Transfers to third countries

We may transfer or share User Data with customers or providers located outside the UE, only to countries where European Commission has decided that the country in question ensures an adequate level of protection, or with appropriate safeguards, like the signature of contract with standard data protection clauses adopted by the European Commission.

Data retention period

TAPTAP only works with accurate and updated Users Data as necessary for our service to provide efficient predictions for our customers. Generally, we do not process Users Data for more than six (6) months from collection.


We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk using generally accepted security standards to help protect information from unauthorized access, destruction, use, modification, or disclosure.

Data subject rights

Our customer can exercise their rights addressing their queries to TAPTAP (see contact details above) were they can request access to and rectification or erasure of personal data or restriction of processing or to object to processing as well as the right to data portability.

For Users Data which processing is based on consent, the data subject can withdraw consent at any time, addressing their requests to data controller (owner or manager of the website where their consent was given).

Data Subjects also have the right to lodge a complaint with the Spanish Data Protection supervisory authority.


We use cookies or similar technologies to enable our customers to deliver ads and monitor the performance of such ads.

Review and update

This Privacy Policy is reviewed and updated at least on a yearly basis.