Privacy policy

Axis Privacy Policy

Last updated: 20 October 2026

1. Who we are and what this policy covers

Axis Corp LTD ("Axis", "we", "us" or "our") operates an advertising exchange and a demand-side platform (together, our "Advertising Services"). Our exchange connects publishers, advertising buyers and other advertising technology businesses so they can trade advertising space. Our demand-side platform helps advertising buyers choose and buy that space.

You can contact us about privacy and data protection at:

Axis Corp LTD

Address: Suite 7057 128 Aldersgate Street, Barbican, London, England, EC1A 4AE

Email: dpo@axis-marketplace.com

This policy explains how we use personal data in connection with:

• our website, axis-marketplace.com, including its Contact Us section, enquiries and website analytics;

• our business relationships, account management, sales, support and communications; and

• our Advertising Services, including advertising auctions, requests and responses to bids, device matching, ad delivery, ad measurement, and security and fraud prevention on other websites and mobile apps.

In this policy, "personal data" means information that identifies you directly or can identify or distinguish you indirectly. Examples include an IP address, cookie ID, mobile advertising ID or a profile linked to a device. Replacing a name with an identifier does not necessarily make data anonymous.

Find the information relevant to you:

• Website visitors: Sections 3.1, 5.1 and 8.1 explain enquiries, website data and cookies.

• Our ad partners, vendors and other business contacts: Sections 2, 3.1 and 5.1 explain our business processing and responsibilities.

• People who encounter our advertising technology: Sections 3.2, 5.2 and 8.2 explain advertising data, purposes and technologies.

• Everyone: Sections 4, 6, 7 and 9 explain sources, sharing, transfers and retention. Sections 10 and 11 explain your choices and rights. You can go directly to Axis Privacy Choices or email dpo@axis-marketplace.com.

2. When Axis is a controller or a processor

2.1 Axis as a controller or a processor

Axis is a Controller when we decide why personal data is used and the key ways it is processed. This includes:

• managing this website;

• managing business contacts, enquiries, business partners and vendors; keeping required business records; and meeting our legal obligations.

• operating the Advertising Services where we decide how data is used to select or deliver ads, match identifiers, create or use advertising profiles, or measure ad performance; and protecting our systems and Advertising Services, detecting fraud and investigating errors.

An advertiser, publisher, demand-side platform, supply-side platform or other advertising partner (an "Ad Partner") may make its own decisions about how and why it uses data. Where Axis and an Ad Partner each make those decisions independently, we are separate controllers. Axis acts as a Processor only when an Ad Partner decides why and how personal data is processed and we act solely on that partner's documented instructions under a data processing agreement. Our role depends on what we actually do in each arrangement, as well as the terms agreed with the Ad Partner. 

3. Personal data we process

3.1 Website and business data

3.2 Advertising

The "bidstream" is information shared when advertising businesses request bids, respond to bids and exchange related auction messages. For example, when you open a page or app that offers advertising space, its advertising provider may send a bid request describing the available space, the device and the privacy permissions in place. Axis may receive this request even if no Axis-connected buyer wins the auction. The data we receive depends on the publisher, app, Ad Partner, technical setup and permissions. Axis may process:

Not every advertising request contains all these types of data. We aim to receive only what is needed for the permitted activity. We do not process names, personal email addresses or telephone numbers as part of bidstream processing.

We do not deliberately process sensitive data, such as health information, political opinions, religious beliefs, sexual orientation or biometric data used to identify someone, for ad targeting. We prohibit Ad Partners from supplying this data for targeting through our Advertising Services. We use contractual restrictions and controls that limit the data received to reduce this risk.

Our Advertising Services are not designed to target children. Ad Partners must identify advertising space on services directed at children and flag relevant age restrictions. We do not knowingly use children's data for personalised ads. If we learn that data has been used contrary to these restrictions, we will restrict or delete it.

4. Where personal data comes from

We receive personal data:

• From you: through Contact Us, account registration where available, email, contracts, meetings, support requests and privacy-choice or rights-request tools.

• From your browser or device: through website requests, logs, permitted cookies, pixels and similar technologies, and technical communications needed to deliver our services.

• From publishers and app operators: directly or through their technology providers, when advertising space is offered, an ad is displayed or someone interacts with it.

• From Ad Partners and bidstream participants: including supply-side platforms, exchanges, demand-side platforms, advertisers, agencies, advertising networks, providers that match identifiers, and consent-management platforms. This can include bid requests and responses, identifiers, audience groups, campaign events and privacy signals.

• From Ad Partners and other business contacts: including audiences and contact details supplied by Ad Partners.

• From public business sources and professional referrals: where relevant to a business relationship or communication.

5. Purposes and legal bases

The tables below explain why we use personal data as a controller and the legal grounds we rely on under the EU General Data Protection Regulation (EU GDPR) and UK GDPR. "Consent" means your permission for a specific activity. "Legitimate interests" means a justified business or security need that we assess against your rights and interests. 

5.1 Website and business processing

5.2 Advertising Services: TCF purposes

Axis participates in the IAB Europe Transparency & Consent Framework, with Vendor ID 1197. We comply with the TCF Policies when processing data within the Framework. The TCF helps websites, apps and advertising businesses communicate your privacy choices. You may see Axis listed as vendor 1197 in a publisher's consent settings. You can learn more in the IAB Europe TCF Policies.

How personalised advertising works: with the required consent, activity associated with a permitted identifier can contribute to an interest profile. For example, visits to travel-related pages may suggest an interest in travel, and that interest may help select an ad on another participating website or app. This does not mean Axis knows your name, and an inferred interest may be wrong. Selecting an ad is different from delivering it and measuring the response; the permissions and retention rules above apply to each activity separately.

We do not use the Advertising Services to make decisions about people that have legal or similarly significant effects, such as employment, credit eligibility or insurance decisions. Automated ad selection and the use of audiences may still involve "profiling"—using data to evaluate or predict interests or behaviour. The choices described in this policy apply to that processing.

6. Who receives personal data

We share data only as needed for the stated purpose, with appropriate contractual and technical controls. Recipients include:

• Ad Partners: publishers, app operators, supply-side platforms, exchanges, demand-side platforms, advertisers, agencies and advertising networks that offer, bid for, buy, deliver or measure an advertising opportunity. Depending on the transaction, they receive permitted identifiers, device and page or app information, privacy signals, audience information and advertising events. A bid request may be shared with several eligible bidders, even if they do not win. We limit recipients based on permissions, purpose and service settings.

• Identifier-matching and cookie-synchronisation participants: only where the required consent and permissions allow us to link identifiers.

• Fraud prevention, ad-security and verification providers: to detect invalid traffic, malicious ads, security incidents and technical errors.

• Infrastructure and business providers: hosting, cloud infrastructure, email, collaboration, customer relationship management, website analytics and consent-management services.

• Professional advisers and authorities: lawyers, auditors and other advisers bound by confidentiality duties, and regulators or public authorities where sharing is legally required or necessary to protect rights and address wrongdoing.

• Recipients involved in corporate transactions: prospective buyers, investors and advisers where needed for a genuine restructuring, financing or sale. We apply confidentiality protections and limit the data shared. Any successor must handle the information consistently with the privacy notice and legal requirements that govern the transfer.

6.1 Our Vendors

7. International transfers

Axis is based in the United Kingdom. Providing, hosting and supporting our services can involve accessing or processing personal data in the United Kingdom, European Union, United States, Singapore and Ukraine. Our hosting locations include New Jersey and Miami in the United States, Amsterdam in the Netherlands, and Singapore. Where EU GDPR or UK GDPR rules restrict a transfer, we use the safeguards below as appropriate to the organisation sending the data, the recipient and the destination:

• Adequacy: a European Commission decision recognising adequate protection for transfers governed by EU GDPR, or UK adequacy regulations for transfers governed by UK GDPR. A European Commission decision does not, by itself, authorise a transfer under UK rules.

• Certified US recipients: the EU–US Data Privacy Framework and, for eligible UK transfers, the UK Extension. We may rely on these only where the actual US recipient has an active certification covering the relevant data and processing.

• Contractual safeguards: the European Commission's Standard Contractual Clauses, using the terms appropriate to the parties' roles, for relevant EU GDPR transfers; and the UK International Data Transfer Agreement or UK Addendum to those clauses for relevant UK GDPR transfers. These agreements require recipients to protect the transferred data.

8. Cookies, pixels, identifiers and similar technologies

8.1 Website cookies

The table below lists cookies identified on the Axis website. A cookie's lifetime differs from how long we keep the information collected through it. Google Analytics uses identifiers rather than names, but those identifiers do not make the information anonymous.

We do not load Google Analytics or set or read its analytics cookies before you consent. You can reject analytics and still use Contact Us and other essential website functions. We do not use analytics identifiers for advertising. You can accept, reject or change optional-cookie choices through the website's CookieYes settings. Withdrawing consent stops future optional collection. Existing data is handled in line with your rights and the retention rules below. Deleting a browser cookie does not necessarily delete information Axis or Google already holds.

8.2 Advertising technologies on third-party websites and apps

Our Advertising Services may use cookies, pixels, cookie synchronisation, mobile advertising IDs and similar technologies with the required consent. A "pixel" sends a small request that can share identifiers, IP and device information, page or app details, and advertising events. "Cookie synchronisation" links Axis and partner IDs so a permitted advertising transaction can recognise the same browser. It may share identifiers with the participating partner.

We activate non-essential advertising storage or access, identifier matching and personalised advertising only when the required consent and permissions are in place. Any permitted use of page or app context, or strictly necessary processing, stays within our declared purposes and legal requirements.

The publisher or app operator also explains the technologies used on its website or app. A website cookie choice may not automatically change settings for every third-party app, browser or Ad Partner. Please also use the choices in Section 10.

9. How long we retain information

We keep identifiable information only for the purpose we have explained and within the limits below. Retention periods start when data is collected or at the event specified. A new transaction does not automatically restart the period for older data. If we need the same information for separate purposes, each copy or use is limited to its own purpose and deletion deadline.

If a specific legal duty, regulatory requirement or active dispute requires us to keep records longer, we separate only the relevant records, restrict their use and delete them when that requirement ends. 

10. Your privacy choices and advertising opt-outs

10.1 Axis choices

Visit Axis Privacy Choices to use our available privacy controls. You can also email dpo@axis-marketplace.com to exercise your rights. 

Withdrawing consent stops the future processing that depended on it; it does not make earlier, lawful processing unlawful. Where required, we delete or stop using the related data rather than continue using it until the stated retention period ends.

An opt-out may apply only to a particular browser, device, identifier or partner. Clearing cookies, using a new browser, resetting an advertising ID or changing devices may mean we cannot recognise an earlier choice.

What an advertising opt-out does: it limits the processing covered by your choice; it does not necessarily remove ads or stop all data processing. Necessary security, delivery and privacy-choice communications may continue within the limits explained in Section 5.2. 

Marketing emails: use the unsubscribe link in a marketing email or contact dpo@axis-marketplace.com. Opting out of marketing does not stop necessary messages about your account, a service you requested or a legal matter.

10.2 Choices with partners

To stop collection or use by an Ad Partner that acts as an independent controller, use that partner's privacy contact or opt-out link. Privacy settings on a publisher's website or app can also prevent it from sending data to Axis and other advertising recipients. Where a TCF consent interface is available, review both the purpose choices and the vendor choices, including Axis, vendor 1197. A choice directed only to Axis does not necessarily change permission for every other partner.

Other industry controls include Your Online Choices, the Digital Advertising Alliance's WebChoices and the Network Advertising Initiative's privacy choices. These apply only to participating companies. They usually limit interest-based advertising, rather than stopping all data collection, cookies or ads. Providing these links does not mean Axis is a member of those organisations or that their tools cover Axis. Some tools use a preference cookie, so clearing or blocking that cookie can affect whether a choice is remembered.

10.3 Mobile advertising IDs and location

Apple iOS/iPadOS: Open Settings → Privacy & Security → Tracking. Turn off Allow Apps to Request to Track, or disable tracking for an individual app. Older iOS versions may call the equivalent setting Limit Ad Tracking under advertising settings. Current iOS versions generally do not have a separate IDFA reset button; denying tracking permission restricts apps' access to IDFA. Apple's own personalised-advertising settings are separate from third-party app tracking settings.

Android: Open Settings → Privacy → Ads, or Settings → Google → All services → Ads, depending on your device and software version. Use Delete advertising ID, Reset advertising ID, Opt out of Ads Personalization or Opt out of interest-based ads, where available. Deleting or restricting the advertising ID limits access to it. Resetting it creates a replacement ID but does not delete records companies already hold. Also review any separate Ad privacy settings on your device.

Location: On iOS, open Settings → Privacy & Security → Location Services. On Android, open Settings → Location → App location permissions. Deny location access or turn off precise location for the relevant app. Also withdraw the separate precise-location opt-in through the publisher's consent settings, where available.

Menus vary by software version and device. You can also restrict cookies through your browser or use private browsing, but browser settings alone do not delete data held on servers. Refusing tracking may make ads less personalised, but it does not necessarily remove ads or stop strictly necessary communications and security processing.

11. Your data protection rights

Depending on the circumstances, EU GDPR and UK GDPR give you the following rights:

• Information and access: ask whether we use your personal data, get a copy and receive information about how we use it.

• Rectification: ask us to correct inaccurate personal data or complete incomplete data.

• Erasure: ask us to delete personal data where it is no longer needed, you withdraw consent and no other legal basis supports that use, the processing is unlawful, or another legal ground for deletion applies. Exceptions may apply where a specific legal duty or necessary legal claim requires us to keep it.

• Restriction: ask us to limit use while we assess accuracy, an objection or whether processing is lawful, or where you need information for a legal claim that we would otherwise delete.

• Portability: receive data you provided in a structured, commonly used, machine-readable format and ask us to send it to another controller where technically possible. This applies where processing is automated and based on consent or a contract with you.

• Objection: object, for reasons relating to your situation, to processing based on legitimate interests, including related profiling. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You can object to direct marketing and related profiling at any time, without giving a reason, and we will stop that use.

• Withdrawal of consent: withdraw consent at any time. This does not affect processing that was lawful before you withdrew it.

• Automated decisions: where a decision made solely by automated means has legal or similarly significant effects and the relevant rules apply, receive information about its logic and consequences, ask for human review, express your view and challenge the decision.

• Complaint: complain to the relevant data protection authority. You are welcome to contact us first so we can try to resolve the issue, but you do not have to do so.

11.1 How to submit a request

Email dpo@axis-marketplace.com or use Privacy Choices.

Tell us which right you want to exercise and whether your request concerns our website, a business relationship or an ad.

For advertising data, useful details may include the relevant IP address or mobile advertising ID, browser or device type, approximate date, and publisher or app. Please do not send passwords or unnecessary identity documents.

We may ask for additional information where reasonably needed to verify your identity or find the relevant records. Your name alone may not identify advertising records linked to an ID rather than a name. If we cannot reasonably identify your data, we will explain why and what additional information would help. We do not collect new identifying data solely to identify someone where data protection rules do not require us to do so. An authorised representative can act for you with appropriate evidence of permission.

We normally respond within one month of receiving a request. Where EU or UK rules allow extra time because a request is complex or you have made several requests, we may extend this by up to two additional months. We will explain the extension and the reasons within the first month. If information needed to verify your identity or clarify your request affects the response deadline under those rules, we will let you know.

Requests are generally free. Where the law allows, we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive. We will explain our reasons.

Where we act only as a processor, we will help the relevant controller respond and, where appropriate, forward your request to that controller.

11.2 Supervisory authorities and representatives

For UK matters, you can contact the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. In the European Economic Area, you can complain to the authority where you live, work or believe an infringement occurred. The European Data Protection Board provides an authority directory.

12. Security

We use technical and organisational safeguards suited to the risks. These include access restrictions, authentication, confidentiality duties, encryption where appropriate, monitoring, limiting the data we use and overseeing our providers. Only staff and providers who need data for a permitted purpose can access it. No online service can guarantee complete security. We investigate suspected personal data breaches and notify affected people and authorities when the relevant notification requirements are met.

13. Changes to this policy

We update this policy when our services, recipients, data processing or legal requirements change. The updated version will show a new revision date. Please review this policy for the latest information. Where a change materially affects how we use data already collected, we will provide additional notice where required and obtain fresh consent before starting any new processing that requires it. Updating this policy does not, by itself, give us permission for a new use of your data.

14. Contact

Axis Corp LTD Suite 7057 128 Aldersgate Street Barbican, London, England, EC1A 4AE Privacy and data protection: dpo@axis-marketplace.com