Privacy policy

01Scope of this notice

This notice describes the public CoreAds website, contact and campaign enquiry forms, Media Kit previews and the public publisher demonstration. It explains the information involved in those activities and how to ask questions about it.

Advertiser and publisher accounts, an agreed commercial campaign and a publisher’s own website can involve additional processing. The relevant account, campaign or publisher information must be read alongside this notice. A demonstration is not evidence that a commercial service or an optional integration is active.

02Data controller and privacy contact

The controller of the personal data described in this notice is MDD Impact Srl, via Adeodato Ressi 12, Milano, Italy, VAT number IT14373450965. CoreAds is the name used for the service.

For a privacy question or request, use the form on the Contact page and identify the request as relating to privacy, or write to the published postal address. Include enough information to locate the relevant enquiry, such as its reference and the email address used. Do not include passwords, payment credentials or identity documents unless specifically needed and requested through an appropriate channel.

03Information involved

The information depends on the feature you use. Browsing a page, submitting a form and signing in to an account are different activities.

• Enquiries: name, email, company and website if supplied, message, enquiry type and selected audience for a campaign request. The record also includes a reference, submission time, processing status and the form acknowledgement version.
• Technical operation: the server receives information needed to handle a web request, such as IP address, requested URL, request time and browser headers. Request and error logs may contain these details. Form rate limiting uses a keyed identifier derived from the IP address.
• Account services, when used: registration and business details, authentication information, account actions and the creative or site information submitted through the relevant portal. Do not put personal information about other people in an enquiry unless it is necessary and you are entitled to provide it.
• Publisher invitation requests can include available campaign parameters (UTM source, medium, campaign, content, term and ID), the entry-page path and the referring website origin. Other query parameters and URL fragments are excluded from this attribution record.

04Purposes and legal bases

The appropriate legal basis depends on the purpose and the relationship with the person concerned. The form acknowledgement is not consent to receive unrelated marketing.

• Assessing a campaign request and taking steps you request before a contract: pre-contractual measures where applicable, or legitimate interests in handling business enquiries made on behalf of an organisation.
• Answering general questions and protecting the service: legitimate interests in business communication, reliable operation, security and abuse prevention, balanced against the interests and rights of the person concerned.
• Administering an agreed service: performance of the relevant contract where applicable. Accounting, lawful disclosure and other mandatory records: compliance with applicable legal obligations.
• Optional uses that require consent must be explained separately before activation. Where consent is the basis, it can be withdrawn without affecting the lawfulness of processing already carried out.
• Evaluate the presentation of internal CoreAds promotions through page-level event counts and protect those records against duplicate or abusive requests: legitimate interest in understanding and securing the site’s own communications, subject to the safeguards and right to object described in this notice.

05Required and optional information

The enquiry forms require a name, a valid email address, a message and confirmation that the details may be used to respond. Company and website fields are optional in the current contact and campaign forms. A campaign form also asks which audience is of interest. Without the required information, the form cannot be processed.

Provide business information relevant to your request. These forms are not intended to collect sensitive personal information, health information or financial account credentials.

06Cookies and browser storage

The site uses session mechanisms for continuity, form security and, where relevant, authenticated access. A language preference cookie, CoreAds_language, is configured with a lifetime of up to one year. Session lifetimes can depend on the browser and the relevant account configuration.

Cookie preferences and the date of the choice are stored in this browser’s local storage under coreads_cookie_consent and coreads_cookie_consent_date. The current implementation has no automatic expiry for these entries. You can change the choice through Cookie preferences in the footer or Cookie settings on the sign-in page, or remove it in the browser’s site-data settings. It is not an account-wide preference shared across devices.

On coreads.net, Google Analytics measures website usage only after you accept optional measurement cookies. Google receives usage and device information; _ga cookies are configured for up to two years. Google Signals and advertising personalization are disabled. You can withdraw consent through Cookie preferences: measurement stops and Analytics cookies are removed. Google processes data under its privacy policy (https://policies.google.com/privacy), which describes international processing.

The contact and campaign-request forms use Google reCAPTCHA v3 for spam and abuse prevention when you submit a request. Google processes browser, device and interaction information to assess risk under its privacy policy and terms. Security verification is separate from optional Analytics consent. CoreAds verifies a short-lived token and does not store it with your enquiry. The publisher demonstration can use session storage to remember the previous sample creative for a placement. Browser settings let you inspect or remove cookies and site data. Blocking essential storage can affect forms, language preferences or account access.

If you allow optional measurement, the latest tagged campaign or referring website can be retained in this tab’s session storage for up to 30 minutes, so it can accompany a publisher invitation request after navigating between pages. Choosing necessary storage only clears this stored attribution. Campaign parameters directly supplied with the invitation form can still be included in the submitted request without this browser storage.

07Previews and advertising links

Images and copy entered in the public Media Kit editor remain in the browser for that preview. This editor does not submit the chosen file to CoreAds. An advertiser’s authenticated upload workflow is a separate feature with separate storage.

The public publisher test page uses sample ads and does not create billable impressions or clicks. Technical requests to load the demonstration still reach the serving infrastructure.

Following a gallery or advertiser link opens the destination selected for that link. The URL may include campaign attribution parameters. The destination then processes your visit under its own privacy information; CoreAds does not control that website’s cookies or subsequent processing.

The public galleries also contain internal CoreAds promotions. Their measurement records the promotion, page, position, event type and time, with a token tied to the page load to avoid counting duplicate copies. The event table does not store a visitor’s name, email or raw IP address. Requests still reach the server, and abuse controls use an IP-derived key. These internal records are separate from paid campaign accounting and do not use a persistent visitor identifier in the gallery script.

08Access, recipients and service providers

Submitted enquiries are stored in the service’s private enquiry inbox and are available to authorised staff through the administrative workflow. Hosting, infrastructure and technical support can require service-provider access. Professional advisers or public authorities may receive information where necessary for an applicable obligation or a legal claim.

Sending an enquiry does not automatically forward its contents to a publisher, an advertiser, an external email platform or an AI service. Any additional recipient or processing arrangement must be identified and assessed for the relevant service.

09International processing

An international audience does not by itself establish where personal data is stored or accessed. Hosting locations, support access and any onward transfers need to be assessed for the providers actually used.

If a transfer outside the European Economic Area is involved, an applicable lawful transfer mechanism and any necessary supplementary protections must be identified. Ask through the privacy contact route for information about the safeguards relevant to your data.

10Retention and deletion

Retention needs are assessed by purpose: handling and following up an enquiry, maintaining a service relationship, complying with record-keeping duties, investigating abuse or establishing and defending legal claims. The relevant factors include whether the request is still open, whether it led to an agreement and whether a specific legal obligation applies.

The current enquiry workflow does not impose an automatic deletion deadline. Records in operational storage and backups can have different retention needs. You can request information or deletion through the contact route now.

11Security and responsible disclosure

The enquiry workflow includes input validation, checks against forged form submissions, rate limiting and restricted access to stored requests. Access to management features is controlled separately. These measures reduce risk, but no website can promise absolute security.

If you believe information has been exposed or a link is unsafe, report the page, approximate time and a description through Contact. Avoid including another person’s full records or publishing a vulnerability before it can be assessed.

12Your rights and complaints

Where the GDPR applies, you may request access, correction, erasure or restriction, object to processing in the circumstances provided by law and request portability where its conditions are met. Rights are subject to their legal conditions; information needed for a legal obligation or a claim may have to be retained.

A request may require proportionate verification of identity. Under the GDPR, a response is generally due within one month; a permitted extension must be explained. You may also lodge a complaint with the competent supervisory authority, including the Italian Garante per la protezione dei dati personali. Contacting CoreAds first is not a prerequisite to making a complaint.

Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. State which processing concerns you so the request can be assessed. Where the legal conditions are met, processing must stop unless overriding compelling grounds or the establishment, exercise or defence of legal claims justify its continuation.

13Automated decisions and intended audience

The public enquiry workflow does not make decisions producing legal or similarly significant effects solely through automated processing. Technical abuse checks may prevent a form submission. Publisher admission and campaign assessment require a separate review.

CoreAds is presented as a business service for advertisers and publishers. These forms and account services are not designed for children. If you believe a child has submitted personal information, contact us so the situation can be assessed.

14Updates and related information

The version date identifies this text. Changes to features, recipients or processing purposes require a review of the relevant privacy information before those changes are relied on. A revised notice does not replace any consent that the law separately requires.

The terms of service govern advertiser and publisher agreements. Publisher and placement rules govern site admission and integration; advertising policy governs creative content and destinations. Cookie and browser-storage information is included in this notice rather than repeated in a separate cookie document.