1. Data Controller and Contact

For the purposes described in this Privacy Policy, the Data Controller is:

Where Magma processes personal data solely on behalf of advertisers, agencies or retailers in connection with the production of advertising formats, Magma acts as a Data Processor, and the advertiser/agency/retailer acts as the Data Controller. This distinction is explained in Section 7.

2. Personal Data We Collect

We collect the personal data listed below, depending on how you use the Service.

2.1 Information You Provide Directly

• Identification and contact details (first name, last name, business email address).
• Job title, company name, and other professional information.
• Creative assets and materials you upload through our platform, which may contain personal data (e.g., identifiable persons in images or videos, logos containing names, audio or text content).
• Campaign information and instructions provided by advertisers, agencies, or retailers.

2.2 Usage and Technical Data

Collected automatically when you access the Service:

• IP address, browser type and version
• Device information, operating system
• Pages visited, time and date of visit, time spent on pages
• Referrer information
• Log files and diagnostic data

2.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate and improve the Service. Only strictly necessary cookies are activated without consent. For other categories (functional or audience measurement where required by CNIL guidelines), we request consent via a cookie banner. For more information, please consult our Cookie Policy below.

3. Purposes and Legal Bases for Processing

Under GDPR, we must identify the lawful basis for each processing activity.

4. How We Use Creative Assets Containing Personal Data

Advertisers, agencies, or retailers may upload images, videos, audio or text containing personal data (e.g., models, employees, customers). Magma processes these assets exclusively to produce advertising formats requested by the client and never reuses them for unrelated purposes.

It is the responsibility of the uploading party to ensure that:

• appropriate rights and permissions have been obtained, and
• personal data embedded in creative assets complies with GDPR and advertising regulations.

5. How We Share Personal Data

We may share personal data only as described below:

5.1 Service Providers

Trusted vendors assisting us with:

• hosting and cloud infrastructure
• security and monitoring
• analytics and performance measurement
• email delivery and support

All providers are bound by confidentiality and data processing agreements compliant with GDPR.

5.2 Retailers, Agencies, or Advertisers

When necessary to execute the advertising workflow (e.g., sharing produced formats).

5.3 Business Transfers

In the event of a merger, acquisition, financing, or sale of assets, personal data may be transferred under appropriate safeguards.

5.4 Legal Compliance

Where required to comply with a legal obligation or enforce our rights.

We do not sell personal data.

6. International Data Transfers

Your data may be processed outside the European Economic Area when necessary (e.g., if our service providers operate abroad).

When this occurs, we ensure appropriate safeguards, including:

• European Commission adequacy decisions, where applicable; or
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Additional technical and organizational protections.

7. Magma as Controller vs. Processor

Depending on the processing activity:

Magma as Data Controller

For data such as:

• user accounts
• usage analytics
• support requests
• administrative or contractual communications

Magma as Data Processor

When handling creative assets or campaign data solely on behalf of advertisers, agencies, or retailers, Magma processes data according to their instructions. In such cases, a separate Data Processing Agreement (DPA) may apply.

8. Data Retention

We retain personal data only as long as necessary for the purposes described:

• Account and contact information: retained for the duration of the business relationship and required statutory periods.
• Creative assets: retained for the campaign duration plus internal archiving periods, unless otherwise instructed.
• Usage logs: typically retained for security and diagnostic purposes for a limited period.

We may retain data longer where legally required.

9. Your Rights Under GDPR

As an individual, you have the following rights:

• Right of access to your personal data
• Right to rectification if data is inaccurate
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to certain processing
• Right to withdraw consent at any time (when processing is based on consent)
• Right to lodge a complaint with the French supervisory authority, CNIL: https://www.cnil.fr

To exercise your rights, contact us at support@magma-ads.com

10. Security

We implement appropriate technical and organizational measures to protect personal data. However, no online service can be guaranteed 100% secure.

11. Links to Third-Party Sites

Our Service may include links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their policies.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The date at the top indicates the latest version. Substantial changes will be communicated via email or a notice on the Service before they take effect.

13. Contact

For questions or requests regarding this Privacy Policy, you may contact us at:

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us operate the Service, enhance its performance, remember preferences, and understand how users interact with the platform.

Cookies may be:

• Session cookies, deleted when you close your browser; or
• Persistent cookies, stored for a defined period.

Cookies can be:

• First-party cookies, set directly by Magma; or
• Third-party cookies, set by external service providers (e.g., analytics tools).

2. Types of Cookies We Use

Magma only uses cookies necessary for operating the platform, and—where consent is required—activates non-essential cookies only after you provide your explicit consent in our cookie banner.

3. Cookie Banner and Consent Management

In accordance with EU GDPR and CNIL guidelines, Magma uses a cookie consent banner that allows you to:

• Accept all cookies
• Refuse all non-essential cookies
• Customize your cookie choices
• Withdraw consent at any time

Your consent choices are stored for a limited period, after which we ask you again.

You can update or withdraw your consent at any time via a link provided in the footer or settings menu of the website.

4. How to Manage or Disable Cookies

You can manage cookies directly in your browser settings. Most browsers allow you to:

• see which cookies are stored
• delete cookies
• block all cookies
• block cookies from specific websites
• receive alerts before cookies are stored

Please note: If you disable essential cookies, certain parts of the Service may not function properly.

5. Third-Party Service Providers

Some cookies may be set by external providers assisting us with:

• security
• analytics
• infrastructure hosting

Any third party setting cookies on our platform must comply with GDPR and CNIL rules, and is bound by contractual obligations to process data only for specified purposes.

We do not authorize third parties to use cookies for advertising or profiling.

6. Changes to This Cookie Policy

We may update this Cookie Policy from time to time. Any significant changes will be communicated via the website and will require consent again when necessary.

7. Contact

For any questions about this Cookie Policy or your data rights, contact us at: