Glass Labs Technology Limited

Privacy Policy

Effective date: 01.06.26 | Version 1.4

1. Who We Are

This Privacy Policy applies to Glass Labs Technology Limited ("Glass Labs", "we", "us", "our"), a company registered in England and Wales under company number 17300816, with registered office at Sunnyside, Birchill, Axminster, Devon, EX13 7LF. Glass Labs operates byglasslabs.io (the "Website") and a programmatic advertising exchange platform that facilitates the buying and selling of digital advertising inventory between supply partners (publishers and supply-side platforms) and demand partners (advertisers and demand-side platforms). We are committed to protecting the privacy of individuals whose data we process in connection with our platform and website. This policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.

2. Scope of This Policy

This policy applies to three categories of people who interact with Glass Labs:

Business Partners: companies and individuals who engage with us commercially as supply or demand partners, or who contact us via the Website.
Website Visitors: individuals who visit byglasslabs.io.
End Users: individuals whose data may be processed as part of the programmatic bid stream when Glass Labs facilitates the delivery of digital advertising.

This policy does not govern the data practices of our supply or demand partners. We recommend reviewing the privacy policies of any digital properties or platforms you interact with directly.

3. Our Role in the Advertising Ecosystem

Glass Labs acts as a programmatic exchange intermediary, connecting supply-side and demand-side partners to facilitate real-time bidding (RTB) for digital advertising inventory. Our role in the ecosystem means we may process personal data in more than one capacity:

As an intermediary: when routing bid request data between our supply and demand partners, the purposes of processing are largely determined by those partners. Glass Labs facilitates this transmission and does not independently determine the purposes for which that data is used.
As a data controller: when we enrich bid request data — for example, by appending content category, genre, or contextual classification signals — we are making decisions about the means and purposes of that enrichment and act as data controller for those activities.

We participate in the IAB Europe Transparency and Consent Framework (TCF) where applicable, and respect the consent signals communicated to us via TC Strings from our supply partners' Consent Management Platforms. We intend to register as an IAB TCF vendor and will update this policy when that registration is complete.

4. What Data We Collect and Why

4.1 Business Partners

When you engage with us as a commercial partner we may collect:

Business contact information: company name, contact name, job title, business email address, telephone number.
Account and contractual data: information required to set up and manage commercial relationships, including insertion orders, terms acceptance, and platform credentials.
Financial data: invoicing details, payment records, and VAT information necessary for billing.
Communications: records of correspondence relating to our commercial relationship.

We use this data to fulfil our contractual obligations, manage accounts, process payments, communicate about our services, and comply with applicable legal and regulatory requirements.

4.2 Website Visitors

When you visit byglasslabs.io we may collect:

Technical data: IP address, browser type and version, operating system, pages visited, time and date of visit.
Form submissions: if you contact us via the Website, we collect the information you provide (name, email address, message content).
Cookie data: see Section 8 (Cookies) below.

We use this data to operate and improve the Website, respond to enquiries, and ensure its security.

4.3 End Users (Bid Stream Data)

When Glass Labs facilitates programmatic advertising transactions, we may process personal data about end users contained in bid requests received from our supply partners. This data may include:

Digital identifiers: cookie IDs, device advertising identifiers (such as Apple IDFA or Android AAID), and other online identifiers present in the bid stream.
Device and browser information: device type, operating system, browser type and version, user agent, screen resolution, network connection type.
IP address: used for non-precise geolocation inference (country, city level) and fraud detection.
Non-precise location data: derived from IP address at country or city level.
Contextual and content signals: page URL, app name or bundle ID, content category, genre, and contextual classification signals.
Consent signals: TC Strings and other consent signals as received from supply partners, processed in accordance with IAB TCF requirements.
Inferred data: audience or interest signals provided by supply or demand partners.

We use this data to route bid requests to demand partners, perform contextual enrichment, detect invalid traffic (IVT) and fraudulent activity, ensure brand safety compliance, and fulfil our contractual obligations to supply and demand partners.

5. Legal Basis for Processing

We process personal data under the following legal bases under UK GDPR:

Contract: processing necessary to perform our contractual obligations to business partners, including account management, billing, and service delivery.
Legitimate Interests: processing for ad delivery facilitation, IVT and fraud detection, contextual data enrichment, platform security, and improvement of our services.
Legal Obligation: processing required to comply with applicable laws and regulatory requirements, including responding to valid requests from law enforcement or regulatory authorities.
Consent: where we rely on consent for specific processing activities (including certain cookie placements), we will obtain that consent through appropriate mechanisms.

Where end user data is processed within the IAB TCF framework, Glass Labs processes TC Strings representing user consent choices. Where those signals indicate a lack of consent for a particular purpose, we will not process data for that purpose.

6. How We Share Personal Data

Glass Labs does not sell personal data. We may share personal data with the following categories of recipients:

Demand Partners (DSPs and Buyers): we transmit bid request data to demand partners for the purpose of facilitating real-time bidding.
Supply Partners (SSPs and Publishers): we may share bid response data and reporting with supply partners to fulfil our platform obligations.
Third-party service providers: we engage trusted third-party vendors to support the operation of our platform, including IVT and fraud detection vendors, data enrichment API providers, infrastructure and hosting providers, and analytics tools.
Legal and regulatory recipients: we may disclose personal data to competent courts, regulators, or law enforcement bodies where required by law.
Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the relevant third party, subject to equivalent privacy protections.

7. International Data Transfers

Glass Labs is incorporated in England and Wales. Our programmatic exchange operates globally, and bid request data may be transmitted to demand partners located outside the United Kingdom or European Economic Area, including in the United States, Singapore, Israel, and Hong Kong. We ensure that all international transfers of personal data are conducted in compliance with UK GDPR. Where we transfer data to countries not covered by a UK adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. As a programmatic exchange intermediary, the onward transmission of bid request data to demand partners constitutes an inherent feature of the RTB process. By contracting with Glass Labs, supply partners acknowledge and agree that this international transmission occurs as part of the service.

8. Cookies

The Website (byglasslabs.io) uses a limited set of cookies for website functionality and analytics. We do not use cookies on the Website for advertising targeting purposes. Our programmatic exchange platform may set or read cookies and similar tracking technologies on publisher digital properties where we are integrated, for the purposes described in Section 4.3 above. These are subject to the consent signals and cookie policies of the relevant publisher digital properties. You can manage cookie preferences through your browser settings. For more information on managing cookies, visit www.allaboutcookies.org.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or contractual obligation.

Business Partner data: retained for the duration of the commercial relationship plus such period as required for legal, regulatory, and accounting purposes (typically six years in line with UK statutory requirements).
Website visitor data: retained for up to 12 months, after which it is deleted or anonymised.
End user bid stream data: event-level data is retained for a maximum of 13 months, after which it is deleted or de-identified. Aggregated, non-identifiable reporting data may be retained for longer for analytics and commercial purposes.

10. Children

Our Website and services are directed at business professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. We contractually require our supply partners not to direct our technology at digital properties targeting children, and to comply with applicable age-related restrictions including COPPA and the UK Children's Code where relevant.

11. Ad Quality and Invalid Traffic

Glass Labs is committed to maintaining high standards of supply quality. We take reasonable technical and operational measures to detect and filter invalid traffic (IVT) and non-human traffic within our platform. We require our supply partners to maintain adequate brand safety and ad quality standards, as set out in our commercial agreements. Glass Labs works towards alignment with industry standards published by the TAG (Trustworthy Accountability Group) and IAB Tech Lab in relation to IVT detection and brand safety. We reserve the right to suspend or terminate supply relationships that fail to meet acceptable quality thresholds.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include encryption of data in transit, access controls, and regular review of security practices. In the event of a personal data breach that poses a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, and will notify affected individuals where required by law.

13. Your Rights

If you are located in the United Kingdom or European Economic Area, you have the following rights:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your personal data in certain circumstances.
Right to restriction: to request that we limit processing of your data in certain circumstances.
Right to data portability: to receive your data in a structured, machine-readable format where processing is based on consent or contract.
Right to object: to object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.

To exercise any of the above rights, please contact us at legal@byglasslabs.io. We aim to respond to all valid requests within one calendar month.

14. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance at legal@byglasslabs.io. We take all complaints seriously and will investigate and respond promptly. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: ico.org.uk Telephone: 0303 123 1113

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The effective date at the top of this document will be updated accordingly. Where changes are material, we will notify business partners directly where possible.

16. Contact Us

Glass Labs Technology Limited Registered address: Sunnyside, Birchill, Axminster, Devon, EX13 7LF Company number: 17300816 (England and Wales) Email: legal@byglasslabs.io Website: byglasslabs.io

Glass Labs Technology Limited is registered in England and Wales. Company number: 17300816.