Privacy Notice

This notice is also available in: 한국어 · Português (Brasil) · Español · العربية · Türkçe · ไทย · 日本語 · 繁體中文 · Bahasa Indonesia · Deutsch · Français · Italiano · Nederlands · Polski · Svenska · Dansk · Norsk.

Scope of this notice

This notice explains how PathIQ Pte. Ltd. handles personal data in two distinct contexts: (a) our website and business relationships, and (b) our data, identity, insight and risk products. Sections 3 onward deal mainly with (b), where most people whose data we process have never interacted with us directly.

PathIQ processes personal data relating to individuals in Australia, Austria, Belgium, Brazil, Colombia, Denmark, France, Germany, Hong Kong, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, the Netherlands, New Zealand, Norway, the Philippines, Poland, Portugal, the Republic of Korea, Saudi Arabia, Singapore, Spain, Sri Lanka, Sweden, Taiwan, Thailand, Türkiye, the United Arab Emirates, the United Kingdom and the United States. We do not knowingly process personal data relating to residents of Vietnam, and we do not offer our data products there.

Residents of the United States should also read section 12, which explains how to opt out of the sale and sharing of personal information and how to access, correct or delete it. Section 13 contains additional information for individuals in other specific countries.

1. Who we are

PathIQ Pte. Ltd. is a company incorporated in Singapore with its registered office at 1 Raffles Place, #34-04, One Raffles Place, Singapore 048616.

Our role under data protection law depends on the product. Where we decide why and how personal data is processed, we are a controller (under the PDPA, an organisation) and this notice describes that processing. Where we process personal data solely on a customer's documented instructions, we are a processor (under the PDPA, a data intermediary), and the customer's own privacy notice governs.

2. Data Protection Officer and representatives

Our Data Protection Officer can be contacted at hello@path-iq.ai.

EU and UK representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)
• United Kingdom (UK)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/18230372912

Other representatives and local officers

We have appointed, or are appointing, the following representatives and local officers. You may contact them about any matter relating to the processing described in this notice.

3. Personal data we process

The categories differ by product. We do not hold a single uniform record for every individual.

• Pseudonymous identifiers — hashed email addresses, hashed phone numbers, mobile advertising identifiers, cookie identifiers received from our data sources, and platform-specific identifiers.
• Probabilistic identifiers — identifiers we create by statistically associating devices, browsers or records that are likely to relate to the same person or household.
• Device and technical signals — IP addresses, device type, operating system, browser characteristics, and connection metadata.
• Approximate location — derived at postcode, city or country level.
• Precise geolocation — latitude and longitude accurate to within 500 metres. For individuals in the EEA and the United Kingdom, we process precise geolocation only where the individual has opted in through the consent interface of the publisher or app. Without that opt-in, we reduce location to postcode, city or country level before storing it. In other markets, we process precise geolocation only where our data source confirms a valid legal basis under local law. We do not collect, use or sell precise geolocation relating to individuals in the United States.
• Inferred attributes and segment membership — commercial interest, purchase propensity and lifestage categories.
• Risk and verification signals — consistency and confidence indicators used by Trust IQ.
• Privacy choices — records of the consent and objection choices individuals have made, including IAB Europe Transparency and Consent Framework (TCF) consent strings, which we keep as evidence of our legal basis.
• Business contact data — name, employer, job title, business email and phone, for our customers, prospects and website visitors.

4. Where we obtain personal data

Most personal data we process is not collected from individuals directly. We obtain it from the following categories of source:

• Publishers and app developers operating consented first-party data collection
• Licensed data partners
• Survey and panel providers
• Telcos and mobile carriers
• Card spend insights providers, which supply aggregated, pre-segmented insights. We do not receive transaction-level data, card numbers or account details.
• Our customers, where they provide their own data for matching, enrichment or verification.

Where we receive data about individuals in the EEA or the United Kingdom from publishers and app developers, consent is collected through consent management platforms operating under the IAB Europe Transparency and Consent Framework (TCF), in which PathIQ participates as a vendor. We process that data only where the consent signal we receive covers PathIQ and the relevant purposes.

We require each supplier to confirm contractually that it has a valid legal basis for disclosing personal data to us and, where consent is the basis, that the consent obtained covers disclosure to PathIQ, licensing to our customers and the purposes described in this notice, and to provide evidence of that consent on request. A list of our current data source categories is available on request from hello@path-iq.ai.

Because we receive personal data from these sources rather than from you, and hold it against pseudonymous identifiers without contact details, we generally cannot tell individuals directly that we hold their data. We make this notice publicly available instead, and in the EEA and the United Kingdom we are disclosed as a vendor in the consent interfaces of the publishers and apps we receive data from. We do not use hashed email addresses or phone numbers to contact individuals. You can ask us where we obtained personal data about you by emailing hello@path-iq.ai.

5. Why we process personal data, and our legal basis

Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interests against the rights and expectations of the individuals concerned.

Where we rely on consent obtained by a data source, that source is responsible for obtaining and evidencing it. We require evidence of consent to be available on request and for audits.

6. Data we do not process

We do not knowingly build, hold or sell segments that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, or criminal offences. We do not knowingly process the personal data of children under 18 and our products are not directed at children.

7. Automated decision-making and profiling

We create profiles in the sense that we group pseudonymous records into interest and propensity segments, and we generate risk and confidence signals.

To do this, we combine data from the sources listed in section 4, and we link identifiers that are likely to belong to the same person across different devices and browsers, for example a phone and a laptop. We also recognise devices using information they send automatically, such as IP address and device characteristics.

We do not use computer programs to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect an individual's rights or interests, including decisions producing legal or similarly significant effects. Our outputs are signals supplied to customers, who make their own decisions and are responsible for how those signals are used, including any requirement to provide human review.

8. How long we keep personal data

Records that reach the end of their retention period are deleted or irreversibly anonymised. We do not retain personal data indefinitely on the basis that it may become useful.

9. Who we share personal data with

• Customers — advertisers, agencies, platforms and financial services organisations who license segments, insights or risk signals.
• Data partners — organisations with whom we exchange or match data under contract.
• Activation and measurement partners — advertising platforms and measurement providers to whom segments are delivered at customer direction.
• Infrastructure providers — cloud hosting (AWS, GCP), storage and security vendors acting as processors on our instructions.
• Professional advisers — legal, audit, accounting and insurance advisers.
• Authorities — regulators, law enforcement and courts where legally required.
• Corporate transactions — a purchaser or investor in connection with a sale, merger or financing, subject to confidentiality.

We impose written contractual controls on every recipient, including purpose limitation, security requirements and restrictions on onward transfer.

10. International transfers

PathIQ is established in Singapore and operates across multiple markets. Personal data may therefore be transferred outside the country in which the individual is located, unless specifically prohibited under the local jurisdiction's privacy laws and regulations.

Personal data relating to individuals in the EEA is transferred to Singapore, which the European Commission has not recognised as providing an adequate level of data protection. We protect these transfers with the European Commission's Standard Contractual Clauses. Transfers of personal data relating to individuals in the United Kingdom are protected by the UK International Data Transfer Addendum to those clauses. You can request a copy of the relevant safeguards at hello@path-iq.ai.

We store and process personal data on Amazon Web Services (AWS) in Singapore, except personal data relating to individuals in India and Indonesia, which we store in those countries in line with local data residency requirements. We disclose it to customers and partners in the countries listed at the start of this notice. Where the law of the country the data comes from requires a specific transfer mechanism, such as the standard contractual clauses of Brazil's ANPD, the standard contracts of Türkiye's Personal Data Protection Authority or the standard contractual clauses of Saudi Arabia's SDAIA, we use that mechanism.

11. Your rights

Subject to your location and to applicable exemptions, you may have the right to:

• ask whether we hold personal data about you and obtain a copy;
• have inaccurate personal data corrected;
• have personal data deleted;
• restrict how we process your personal data;
• receive personal data you provided in a portable format;
• object to processing carried out on the basis of legitimate interests;
• object at any time to the use of your personal data for direct marketing, including profiling related to direct marketing;
• withdraw consent at any time, without affecting processing already carried out; and
• be informed about how your personal data is used, which is the purpose of this notice.

You may request access to and correction of your personal data, and withdraw consent to its collection, use or disclosure using our privacy request form or by emailing hello@path-iq.ai. Residents of the United States have the additional rights and request methods set out in section 12.

Your right to object to direct marketing. If you are in the EEA or the United Kingdom, you can object at any time to our use of your personal data for direct marketing, including the creation of audience segments and related profiling. If you object, we will stop using your personal data for those purposes. You do not need to give a reason.

If your data reached us through a website or app in the EEA or the United Kingdom, you can also withdraw consent or object to processing at any time through that website's or app's privacy settings, usually a "privacy" or "cookie settings" link or menu. Choices you make there are passed to PathIQ through the IAB Europe TCF, and we apply them to the data we hold.

12. Additional information for United States residents

This section applies to residents of US states with consumer privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. In this section, "personal information" has the meaning given by the law that applies to you.

Data broker status

PathIQ is a data broker: we collect and sell personal information about consumers with whom we do not have a direct relationship. PathIQ is registering as a data broker in California, Texas, Oregon and Vermont.

What we do not do in the United States

• We do not collect, use or sell precise geolocation relating to individuals in the United States. Location data we hold about US consumers is approximate (postcode, city or state level).
• We do not offer Trust IQ in the United States, and we do not use Trust IQ data in any product relating to US consumers.
• We do not collect, sell or share sensitive personal information about US consumers, and we do not use personal information to infer the characteristics described in section 6.
• We do not knowingly collect, sell or share personal information of consumers under 18.
• Our products are not consumer reports under the Fair Credit Reporting Act. They must not be used to decide a person's eligibility for credit, insurance, employment, housing or similar purposes, and our customer contracts prohibit that use.

Personal information we collected, sold and shared in the last 12 months

Sources: the categories of source in section 4. Purposes: building and maintaining our identity graph, creating audience segments and licensing them for advertising and marketing, producing aggregated insights, security and service integrity, and the other purposes in section 5. Recipients: we sell or share personal information with our customers (advertisers, agencies and advertising platforms), activation and measurement partners, and data partners, as described in section 9. We disclose personal information for business purposes to infrastructure providers and professional advisers. Retention: see section 8.

Do Not Sell or Share My Personal Information

Licensing audience segments to our customers is a "sale" of personal information, and delivering them for targeted advertising is "sharing" and "targeted advertising" under US state laws. You have the right to opt out of the sale and sharing of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects (we do not carry out that kind of profiling, as explained in section 7).

To opt out, use our privacy request form (also linked from our Do Not Sell or Share My Personal Information page), call 1-866-I-OPT-OUT (1-866-467-8688) and enter service code 2522, or email hello@path-iq.ai. Tell us the identifiers you want us to act on, such as your mobile advertising identifier, email address or phone number. We add them to our suppression list, stop selling and sharing data linked to them, and tell the third parties we have sold or shared that data with to stop. You do not need to verify your identity to opt out.

We treat a Global Privacy Control (GPC) signal sent by your browser to our website, or passed to us with data by a publisher or partner, as a valid request to opt out for that browser or device.

Your rights to access, correct and delete

Depending on your state, you have the right to:

• Know and access — confirm whether we process your personal information, and receive the categories and specific pieces of personal information we hold about you, in a portable format;
• Correct — have inaccurate personal information corrected;
• Delete — have your personal information deleted; and
• Opt out — of sale, sharing, targeted advertising and profiling, as described above.

We will not discriminate against you for exercising any of these rights.

How to make a request

• Online: our privacy request form.
• Toll-free: call 1-866-I-OPT-OUT (1-866-467-8688) and enter service code 2522.
• Email: hello@path-iq.ai.

California residents can also ask every registered data broker to delete their personal information in a single request through the California Delete Request and Opt-out Platform (DROP) at privacy.ca.gov/drop. We check DROP at least every 45 days and process the requests it sends us.

Verification. We hold personal information in pseudonymous form, linked to identifiers such as mobile advertising identifiers and hashed email addresses rather than names. To access, correct or delete, give us the identifiers you want us to search for. We will check that the request comes from the person those identifiers relate to, for example by confirming control of the email address, and we ask only for information we need for that purpose. If we cannot verify a deletion request, we will still treat it as a request to opt out of sale and sharing.

Authorised agents. You can use an authorised agent to make a request. We will ask the agent for your signed permission and may ask you to confirm your identity directly with us.

Timing. We confirm receipt within 10 business days and respond within 45 days, which we may extend once by a further 45 days where reasonably necessary; we will tell you if we do. We act on opt-out requests within 15 business days.

Appeals

If we decline your request, you can appeal by emailing hello@path-iq.ai with the subject "Privacy appeal" within a reasonable time of our decision. We will respond in writing within the period your state's law requires, generally 45 to 60 days, and explain our decision. If your appeal is denied, you can contact your state Attorney General.

Nevada residents

Nevada residents can opt out of the sale of covered information using any of the methods above.

Request metrics

We publish the number of requests to know, delete and opt out that we received, complied with in whole or in part, and denied, and the median number of days we took to respond, for each calendar year by 1 July of the following year.

13. Additional information for specific countries

This section adds to the rest of this notice for individuals in the countries below. You can make any request in this section using our privacy request form or by emailing hello@path-iq.ai. Details of our local representatives and data protection officers are in section 2.

Australia

• Direct marketing: you can ask us at any time to stop using or disclosing your personal information for direct marketing, including audience segments. We will do so free of charge within a reasonable time.
• Source of your information: you can ask us where we obtained your personal information, and we will tell you unless it is impracticable or unreasonable to do so.
• Overseas disclosure: we disclose personal information to recipients in the countries described in section 10.
• Complaints: email hello@path-iq.ai. We will acknowledge your complaint, investigate it and respond in writing within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

We do not collect personal information from you directly. We receive it from the sources described in section 4. This notice tells you that we hold it, the purposes we use it for (section 5), who receives it (section 9), our name and address (sections 1 and 18), and your rights to access and correct it (section 11). Our privacy officer can be contacted at hello@path-iq.ai. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Japan

• Business operator: PathIQ Pte. Ltd., 1 Raffles Place, #34-04, One Raffles Place, Singapore 048616. The name of our representative is available on request from hello@path-iq.ai.
• Security measures: see section 14.
• Foreign country: we process personal data in Singapore, where it is protected by the Personal Data Protection Act 2012, and transfer it to the countries described in section 10.
• Personally referable information: where a customer intends to link identifiers we provide with personal data it holds, we confirm that the customer has obtained your consent, as the Act on the Protection of Personal Information requires.

Republic of Korea

• Destruction: when the retention period in section 8 ends, we destroy personal data without delay by permanently deleting electronic files using methods that prevent recovery.
• Chief Privacy Officer: see section 2.
• Processing entrusted to others: Amazon Web Services (cloud hosting) and Optacy (handling privacy requests).
• Overseas transfer:
  • Items transferred: the personal data described in section 3, other than business contact data.
  • Countries: Singapore, and the countries of the customers that license our audience segments, listed at the start of this notice.
  • Timing and method: continuously, over encrypted network connections, when we receive data from our sources and when we deliver audience segments.
  • Recipients: PathIQ Pte. Ltd. (hello@path-iq.ai), Amazon Web Services as our hosting provider, and our customers as described in section 9.
  • Purposes and retention: the purposes in section 5 and the retention periods in section 8.
  • How to refuse: withdraw consent through the app or website that collected your data, or contact us. If you refuse, we will not transfer your personal data or include it in audience segments.
• Remedies: you can also contact the Personal Information Protection Commission (pipc.go.kr), the KISA Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

Thailand

You have the rights set out in the Personal Data Protection Act B.E. 2562, including to access, obtain, correct, delete, restrict and object to the processing of your personal data and to withdraw consent. Our Thai representative and Data Protection Officer are listed in section 2. You can complain to the Personal Data Protection Committee.

Philippines

You have the rights set out in the Data Privacy Act of 2012, including to be informed, to access, object, correct, erase or block, and to data portability. Our Data Protection Officer is listed in section 2. You can complain to the National Privacy Commission (privacy.gov.ph).

India

This part applies to the processing of digital personal data of individuals in India under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. We store personal data relating to individuals in India in India.

Consent. We process this data on the basis of your consent, which is collected for us by the publishers, app developers and telecommunications operators that supply it. You can withdraw consent at any time, as easily as you gave it: through the privacy settings of the app, website or telecommunications service concerned, through a registered consent manager, or by contacting us. When you withdraw consent, we stop processing your personal data and delete it within a reasonable time, unless the law requires us to keep it.

Your rights. You can ask for a summary of the personal data we process about you and how we process it, and for the identities of the other data fiduciaries and processors we have shared it with; ask us to correct, complete, update or erase it; and nominate another person to exercise your rights if you die or become incapable of doing so.

Children. We do not knowingly process personal data of anyone under 18, and we do not track, monitor the behaviour of, or target advertising at children.

Grievances. Contact us at hello@path-iq.ai. We will respond within the period required by the Digital Personal Data Protection Rules, 2025. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Language. On request, we will provide this notice in any language listed in the Eighth Schedule to the Constitution of India.

Indonesia

Under Law No. 27 of 2022 on Personal Data Protection you can access, correct, delete, restrict and object to the processing of your personal data, object to decisions based solely on automated processing, and withdraw consent. We process personal data on the basis of consent obtained by our sources. The types of data we process are described in section 3, and our retention and processing periods in section 8. We store personal data relating to individuals in Indonesia in Indonesia. Before transferring personal data outside Indonesia, we assess the risks and make sure the destination provides an equal or higher level of protection, put binding safeguards in place, or obtain your consent. If a data breach affects you, we will notify you and the authority within 3 x 24 hours. Our Data Protection Officer is listed in section 2. You can complain to the Indonesian personal data protection authority.

Sri Lanka

Under the Personal Data Protection Act No. 9 of 2022 you can access your personal data, have it corrected or completed, withdraw consent, object to processing, including for direct marketing, ask us to erase it, and ask for a review of decisions based solely on automated processing. We transfer personal data outside Sri Lanka only where we have assessed that the recipient country provides adequate protection or where appropriate safeguards are in place. Our Data Protection Officer is listed in section 2. You can complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk).

Taiwan

Under the Personal Data Protection Act, because we collect personal data indirectly, we tell you: the sources of your personal data (section 4); our name (section 1); the purposes of collection (section 5); the categories of personal data (section 3); the period, area, recipients and manner of use (sections 8, 9 and 10, and automated processing to create audience segments); and your rights to make enquiries and review, obtain copies, supplement or correct your personal data, and request that we stop collecting, processing or using it, or delete it. When your personal data is first used for marketing, you can refuse further marketing use, and we will stop. You can complain to the Personal Data Protection Commission.

Hong Kong

You can ask to access and correct personal data we hold about you by emailing hello@path-iq.ai. We do not use hashed email addresses or phone numbers to send direct marketing communications, and we require any source that provides personal data to us for gain to have obtained the written consent required by Part 6A of the Personal Data (Privacy) Ordinance. You can complain to the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).

Brazil

Under the Lei Geral de Proteção de Dados (LGPD) you can ask us to confirm that we process your personal data; access, correct, anonymise, block or delete it; receive it in a portable format; find out which public and private entities we share it with; and withdraw consent. Our encarregado (Data Protection Officer) is listed in section 2. For transfers outside Brazil we use the standard contractual clauses approved by the Autoridade Nacional de Proteção de Dados. You can complain to the ANPD (gov.br/anpd).

Mexico

Primary purposes, which are necessary for our relationship with you: keeping records of your privacy choices, responding to your requests, and keeping our services secure. Secondary purposes, which you can refuse at any time without affecting the primary purposes: building audience segments, licensing them to our customers for advertising, and producing aggregated insights. We transfer personal data to our customers (advertisers, agencies and advertising platforms) for those secondary purposes, on the basis of the consent obtained by our sources.

You can exercise your ARCO rights (Acceso, Rectificación, Cancelación and Oposición), refuse the secondary purposes, revoke your consent and ask us to limit the use or disclosure of your personal data by emailing hello@path-iq.ai. Tell us your name or the identifiers concerned, an email address for our reply, and what you are asking for. We will respond within 20 business days. We will tell you about changes to this notice by publishing an updated version on this page (section 17). You can complain to the Secretaría Anticorrupción y Buen Gobierno.

Colombia

Under Law 1581 of 2012 you can know, update, correct and delete your personal data, ask for proof of your authorisation, and revoke it. We answer queries within 10 business days and claims within 15 business days. You can complain to the Superintendencia de Industria y Comercio (sic.gov.co).

Saudi Arabia

Under the Personal Data Protection Law you can be informed about the processing of your personal data, access it, obtain a copy, have it corrected or destroyed, and withdraw consent. We use personal data for advertising only with consent obtained by our sources, and you can opt out at any time. Our representative in the Kingdom is listed in section 2. You can complain to the Saudi Data and AI Authority (SDAIA).

United Arab Emirates

Under Federal Decree-Law No. 45 of 2021 you can access, correct, delete and restrict the processing of your personal data, and object at any time to its use for direct marketing and profiling. You can complain to the UAE Data Office.

Türkiye

Under Article 11 of Law No. 6698 (KVKK) you can learn whether your personal data is processed, request information about it, learn the purpose of processing and the recipients in Türkiye and abroad, request correction or deletion, object to results produced solely by automated analysis, and claim compensation. We collect your personal data electronically, by automated means, from the sources described in section 4. We process it on the basis of the explicit consent obtained by those sources and, for security and fraud prevention, our legitimate interests. We transfer it outside Türkiye, to Singapore and to our customers, under Article 9 of the KVKK using the standard contracts issued by the Personal Data Protection Board. We respond within 30 days. Our data controller representative in Türkiye is listed in section 2. You can complain to the Personal Data Protection Authority (kvkk.gov.tr).

14. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, hashing and pseudonymisation of identifiers, role-based access control, logging and monitoring, vendor due diligence, and staff training.

If a data breach occurs that is likely to result in significant harm or risk to individuals, we will notify the Personal Data Protection Commission of Singapore, other competent supervisory authorities, and affected individuals, within the timeframes those laws require.

15. Cookies and our website

Our website uses cookies and similar technologies. See our Cookie Policy for details and to manage your preferences. Data collected through our website is handled as described in this notice and is kept separate from our data products.

16. Complaints

Please contact hello@path-iq.ai first — we would rather resolve a concern directly. We acknowledge complaints within 30 days and investigate them without undue delay. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in the EEA, the data protection authority in the country where you live or work, or where the issue arose. Residents of the United States can appeal our decision on a request as described in section 12, and contact their state Attorney General.

17. Changes to this notice

We review this notice at least annually. Where we make a material change to how we process personal data, we will update the date above and, where required, take reasonable steps to bring the change to the attention of affected individuals. Previous versions are available on request.

18. Contact

PathIQ Pte. Ltd.
1 Raffles Place, #34-04, One Raffles Place, Singapore 048616
Privacy and rights requests: hello@path-iq.ai
US toll-free: 1-866-I-OPT-OUT (1-866-467-8688), service code 2522