Last Updated: May 2026
EX.CO Technologies Ltd., together with our subsidiaries and affiliated companies (“we”, “us”, “Company” or “our”), is dedicated to protecting your privacy rights and making our practices regarding the processing of your Personal Data (as defined below) transparent and fair.
This privacy policy (“Privacy Policy”) was designed to explain to our Customers, Website Visitors and End Users (as defined below, and collectively, “you”) how and why we collect, store, share, use and process Personal Data. This Privacy Policy applies whenever you visit or use the online advertising platform (“Platform”) and our Website www.ex.co, including any other domains or subdomains owned and operated by us (collectively “Websites”), or otherwise access or interact with any other services or features we operate (collectively, the “Services”). This Privacy Policy together with the cookie policy referred to below, and any other document referred to herein, constitutes an integral part of our Terms of Use (“Terms”), all of which are incorporated herein by reference.
Our Website may link to third-party sites which are not governed by this Privacy Policy. Please be aware that we are not responsible for the privacy practices or the content of other sites. We encourage you to read the privacy statements provided by other sites as well.
Please note that certain provisions of this Privacy Policy may not be applicable to you, depending on your jurisdiction and the applicable laws.
We strongly urge you to read this Privacy Policy and ensure you fully understand and agree to it. By using the Services, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, please do not use our Services. You have the right to cease using the Services at any time, pursuant to this Privacy Policy and our Terms. You are not legally required to provide us with any Personal Data, but without it we may not be able to provide you with the best experience or full functionality of our Services.
If you have a visual disability, you may be able to use a screen reader or other text-to-speech or text-to-Braille tool to review the contents of this Privacy Policy.
Depending on your interaction with us, we may collect two types of data from you:
“Personal Data” (as defined under the GDPR) or “Personal Information” (as defined under various US Privacy Laws) refers to any information that can directly or indirectly identify an individual, or that could be used to identify an individual with reasonable effort. Examples of Personal Data include, but are not limited to, a person’s name, date of birth, contact details such as email address or phone number, and online identifiers such as IP addresses or user IDs.
“Non-Personal Data” refers to information that is aggregated, non-personal, non-identifiable data, which may be made available or gathered via your access to and use of the Platform. We are not aware of the identity of the user from which the Non-Personal Data is collected. Such Non-Personal Data may include aggregated usage information and technical information transmitted by your device, such as browser version, operating system type and version, mobile network information, device settings, and software data. We may maintain and use such information in de-identified form and will not attempt to re-identify the information, unless needed for the purpose of determining whether its de-identification processes satisfy the requirements of applicable law.
For the avoidance of doubt, any Non-Personal Data connected or linked to any Personal Data shall be deemed as Personal Data as long as such connection or linkage exists.
We do not knowingly collect or process any Personal Data constituting or revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning a person’s health, government identifiers, precise geolocation or data concerning a person’s sex life or sexual orientation (“Special Categories of Personal Data”).
This Privacy Policy applies to Company’s collection, use, and disclosure of the Personal Data of the following categories of individuals:
“Website Visitors” means individuals who visit our Website and who may voluntarily provide certain contact data (such as their email address) to receive communications from Company.
“Customers” means individuals, entities or organizations who register to use any product(s) or service(s) within Company’s Platform, including administrators of a Company account.
“End Users” means individuals who visit our Customers’ websites and whose Personal Data we process (on behalf of our Customers) in order to provide the Services pursuant to our agreements with such Customers.
We may collect and process the following types of Personal Data:
Contact Information. We ask for and collect our Customers’ contact data (such as name and email address) as well as our Website Visitors’ and End Users’ contact details when they submit web forms on our Website.
Log Files. Just as when you visit and interact with most websites and services delivered via the Internet, we may gather certain information from our Customers, Website Visitors and End Users and store it in log files. This information may include but is not limited to Internet Protocol (IP) addresses, system configuration information, URLs of referring pages, and local and language preferences. This also includes certain technical Personal Data that is recorded when you use our Services. This information may include but is not limited to WiFi information, operating system and device information, system configuration information, and other information about traffic to and from our or our Customers’ websites.
Cookies and Other Tracking Technologies. We may use cookies and other information-gathering technologies to collect information from Website Visitors. We also use an analytics technology commonly referred to as “Session replay” which helps us better understand user behavior and make improvements to our Services.
Customer Account Information. When you register for an account, we will collect your email address, name and other contact data. We may also ask you to enter your website domain in order to provide our Services. By voluntarily providing us with such data, you represent that you are the owner of such Personal Data or otherwise have the requisite consent to provide it to us. If you register to our Platform through a social network platform (for example Google), you will provide us access to any information you made available on that platform (depending on your privacy settings) and any additional information that you specifically consent to provide us with.
Payment Information. When Customers sign up for one of our paid Services, they must provide billing information. We do not store full credit card numbers or personal account numbers. The required information depends on the billing method chosen. For example, if you pay with a credit card, our third-party payment service providers will collect your card information and billing address.
Communication Information. When you communicate with us, for example through the “Contact Us” option on our Services or otherwise provide us with any feedback, we collect your full name, email address, phone number, the contents of those communications, and/or attachments you may send us, and/or answers to surveys or questionnaires that you may submit, and any other information you choose to provide us.
Information you provide directly to us. We may process additional Personal Data if you choose to provide us with it directly, for example, during your communication with us or other engagement with our Services.
| Purpose | Legal Basis |
|---|---|
| Provision of our Services; support. We use your Personal Data for consumer services purposes; to provide and operate the Services (including, without limitation, responding to your inquiries and authenticating your access to the Services); and to communicate with you and to keep you informed of the latest updates to our Services and special offers. Moreover, we use your Personal Data for customer relationship management purposes, and to support and troubleshoot the Services. We also use your Personal Data to provide you with support, materials and information. | The legal bases for such processing are the performance of our contractual commitments towards you; your consent; compliance with our legal obligations; and our legitimate interests. Our legitimate interests in this case are enforcing our policies, operating the Services, protection against fraud and misuse of our Services, supporting our customers and provision of our Services. |
| Improvement and personalization of our Services. We collect and analyze information about you and your usage of our Website and Services to enhance the usability, quality, effectiveness and functionality of our Website and Services.
We process this information to understand how visitors use the Websites and Services, as well as to measure the effectiveness of our features and content. We further use this data to track conversions from ads and understand the effectiveness of our promotional campaigns to people who have taken some action on the Website. In addition, data related to our Website helps us to better understand our business, analyze our operations, maintain, improve, design, and develop the Services and new products, conduct statistical analysis, test and improve our offers, and decide how to improve the Services based on the results obtained from this processing. In addition, data collected from End Users will also be used as part of, and for the purpose of, providing our Services to Customers, who serve as the initial Data Controllers (or Businesses, as defined under various US Privacy Laws). |
The legal basis for processing this information is our legitimate interests, which are providing and improving our Services. |
| Marketing, Advertising and Analytics. We may use your Personal Data directly or through trusted partners to provide marketing communications, personalized offers, and promotional materials relating to our Services, affiliates, or business partners, subject to applicable law. In addition, we may use your Personal Data provided by you and by the Tracking Technologies (as defined below) (which may collect Personal Data) in order to provide you with personalized and non-personalized advertising. Also, we may use your Personal Data to gather usage information for analytics, statistical and research purposes.
For additional information please also refer to the “Marketing” section below. |
The legal bases for processing this information are your consent (when required) and our legitimate interests. Our legitimate interests in this case are providing you with tailored services, content and advertisements that better correspond with your interests.
You may opt out of receiving our promotional or marketing emails (all or any part thereof) by clicking on the “unsubscribe” link in the emails that you receive from us or by contacting us at dpo@ex.co. Even if you unsubscribe, we may continue to send you service-related updates and notifications. |
| Integrity. We process information about you and your use of the Services to maintain integrity and security of the Services, prevent fraud or illegal activity, verify your identity and enforce our policies. | The legal bases for processing this data are compliance with our legal obligations and our legitimate interests. Our legitimate interests in this case are keeping the integrity of our Services, the safety of our end-users and the detection of fraudulent activity. |
| Payments. Payment information is collected by our payment service providers in order to process payments for purchases, fulfill requests for refunds, returns, or exchanges, and process the redemption of discounts. | The legal bases for processing this data are the performance of our contractual obligations and our legitimate interests. Our legitimate interests in this case are the provision of our Services and compliance with legal obligations to which we are subject. |
| Compliance with applicable laws. We may collect, retain, process and disclose your Personal Data to meet legal obligations and respond to lawful requests from authorities. | The legal bases for processing this data are compliance with our legal obligations and our legitimate interests. Our legitimate interests in this case are compliance with our legal obligations and assisting law enforcement agencies. |
| Dispute resolution and protection from and exercise of legal rights and claims. We may collect your Personal Data in order to investigate violation of our policies, enable us to resolve disputes in connection with your use of the Services and to establish and defend our legal claims. | The legal basis for processing this Information is our legitimate interests. Our legitimate interests in this case are to establish and defend our legal claims. |
Please note that the actual processing operation per each purpose of use and lawful basis detailed in the table above may differ. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure or destruction. The transfer of Personal Data to third-party countries as further detailed in the International Data Transfers Section is based on the same lawful basis as stipulated in the table above.
We may collect different categories of Personal Data and Non-Personal Data from you, depending on the nature of your interaction with the Services, as detailed above.
We may disclose your Personal Data to third parties that help us maintain and provide our Services. More information about the categories of such third-party recipients is described below:
| Category of Recipient | Data That Will Be Disclosed | Purpose of Disclosure |
|---|---|---|
| Affiliated companies and entities within our group | All types of Personal Data. | We may disclose your Personal Data to companies within our group (subsidiaries and other affiliated companies), as well as our employees, as necessary for administrative, management or other business-related purposes, to operate our Services, communicate with you, improve our Services, offer and provide our Services to you, etc. |
| Service providers | We may disclose your Personal Data to our service providers, contractors and third parties, such as payment processors, storage providers (such as AWS), marketing affiliates (who assist us with carrying out our marketing campaigns, such as email campaigns), our fraud detection tools, and our analytics providers who help us provide you with our Services. | |
| Legal and regulatory entities | We may disclose any type of Personal Data, in case we believe, in good faith, that such disclosure is necessary in order to enforce our policies (including our Company Terms), take precautions against liabilities, investigate and defend ourselves against any third-party claims or allegations, protect the security and integrity of the Services and protect the rights and property of Company. We may also disclose your Personal Data where requested by legal or regulatory authorities having control or jurisdiction over us or you, in response to a verified request relating to terror acts, criminal investigations or similar illegal activity, or any other activity that may expose us, you, or any other user to legal liability, and solely to the extent necessary to comply with such purpose. We may also disclose information to comply with applicable laws, regulations and rules, and if required to do so by court order. | |
| Mergers and acquisitions | All types of Personal Data. | We may disclose or transfer your Personal Data in connection with any business transaction, such as a merger, acquisition, transfer of any of our assets, investment, reorganization, bankruptcy, sale of some or all of our assets or similar event. Any party that acquires our assets as part of such transaction will continue to use your data in accordance with the terms of this Privacy Policy. |
| Payment processors | Third-party payment processors, for the purpose of facilitating your payments when using our Services. These third parties have access to your Personal Data, so they perform these tasks on our behalf. | |
| Professional advisers | In individual instances, we may disclose Personal Data to professional advisers acting as processors or controllers including lawyers, bankers, auditors, insurers, and accounting services, to the extent we are legally obliged to disclose or have a legitimate interest in disclosing your Personal Data. | |
We reserve the right to use, disclose or transfer (for business purposes or otherwise) aggregated and processed Non-Personal Data to third parties, including, inter alia, affiliates, for various purposes including commercial use. This Personal Data may be collected, processed and analyzed by us and transferred in a combined, collectively and aggregated manner (i.e., your information is immediately aggregated with other users) to third parties.
When disclosing Personal Data to third parties, they are required to secure the Personal Data they receive and to use that Personal Data only in compliance with all applicable data protection regulations (such service providers may use other Non-Personal Data for their own benefit).
When you access or interact with our Services we use (and authorize 3rd parties to use) pixels, cookies, web beacons and other similar technologies (“Tracking Technologies”). The use of Tracking Technologies is a standard industry-wide practice. Those allow us to automatically collect information about you, your device and your online behavior, in order to enhance your navigation in our Services, improve our Services’ performance, perform analytics and customize your experience. You can find more information about cookies at All About Cookies. To learn more, please read our Cookie Policy.
We acknowledge that different people have different privacy concerns and preferences. Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used.
Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Data. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask us to exercise the following rights:
You may request to exercise these rights by contacting us at: dpo@ex.co. We will handle these requests, complaints or queries in accordance with applicable laws, and provide you with a reply in a timely manner. Please note that we may require additional information and documents when processing your request, including certain Personal Data, in order to authenticate and validate your or any applicable authorized agent’s identity and to process your request. Such additional information may also be retained for legal purposes in accordance with this Policy.
In some jurisdictions, you have the right to appeal a rejection of your request. Please submit your appeal to: dpo@ex.co. If your appeal is denied, certain jurisdictions allow you to submit a complaint via the local attorney general or another competent authority responsible for handling such matters.
If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in your jurisdiction of residency, as applicable to you.
In addition, certain rights can also be easily executed independently:
EX.CO also participates in the IAB Europe Transparency & Consent Framework and complies with its policies and specifications. EX.CO’s IAB Europe assigned Vendor ID is: 444.
We will retain your Personal Data for as long as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our policies. Please note that except as required by applicable law, we will not be obligated to retain your data for any particular period, and we may delete it for any reason and at any time, without providing you with prior notice of our intention to do so. However, retention periods shall be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.
We work hard to protect the Personal Data we process from unauthorized access, alteration, disclosure, or destruction. We have implemented administrative, technical, and physical safeguards to help prevent unauthorized access, use, or disclosure of your Personal Data.
Your account Information is protected by a password for your privacy and security or by an SSO service such as Google or Facebook identity services. You need to help us prevent unauthorized access to your account by protecting your password appropriately and limiting access to your account by signing off after you have finished accessing your account. You will be solely responsible for keeping your password confidential and for all use of your password and your account, including any unauthorized use.
While we seek to protect your information to ensure that it is kept confidential, we cannot guarantee the security of any information. You should be aware that there is always some risk involved in transmitting information over the internet and that there is also some risk that others could find a way to thwart our security systems. As a result, while we strive to protect your Personal Data, we cannot ensure or warrant the security and privacy of your Personal Data or other content you transmit using the Platform, and you do so at your own risk. Thus, we encourage you to exercise discretion regarding the Personal Data you choose to disclose.
We operate globally, and any information that we collect, disclose or share, including (but not limited to) your Personal Data, can be stored and processed in the European Economic Area, United Kingdom and United States, for the purposes detailed in this Privacy Policy. To the extent that the GDPR or UK GDPR are applicable, we will only transfer or share your Personal Data to data recipients:
Our Services enable and host third-party content, products or services that are not owned or controlled by us, including sponsored content and advertisement (each or jointly “Third Party Content”). Third Party Content hosted on our Services is provided directly by its owners or operators and governed by their own terms and privacy policies. Although we do require each Third Party Content to ensure full compliance and transparency, we are not responsible for the privacy practices, security measures, or the content of such Third Party Content. Please be aware that Third Party Content and related services may collect Personal Data from you based on your consent, including through use of cookies, as further detailed above.
We may use Personal Data, such as your full name, email address, etc., collected by us or through our trusted third-party service providers for the purpose of providing users with promotional materials via different marketing techniques, such as direct emails, as well as products, services, websites and applications, which relate to: (i) other companies within our group, as applicable; or (ii) our business partners and affiliates, which we believe could interest you, subject to obtaining your explicit consent, when required by applicable law.
Users have the possibility at any time to decline receiving further marketing offers from us either by following the links inserted in the promotional emails (e.g., selecting the opt-out link) or by contacting our customer support. Please note that even if you unsubscribe from our marketing mailing list, we shall continue to send you service-related updates and notifications.
You may opt-out of receiving our promotional or marketing emails (all or any part thereof) by clicking on the “unsubscribe” link in the emails that you receive from us or by contacting us at dpo@ex.co.
Our Services are not intended for use by individuals under the age of majority, as defined by the applicable law in such individual’s jurisdiction of residence (“Minor(s)”). We do not knowingly process Minors’ information. In the event that we become aware that we have collected Personal Data from a Minor without verification of parental consent, we will delete that information upon discovery. Please contact us at dpo@ex.co if you have reason to believe that a Minor has shared any data with us.
This section addresses specific requirements under the applicable laws pertaining to data privacy, data security, and the protection of Personal Information in the United States (collectively, “US Privacy Laws”).
In the preceding twelve (12) months, we have collected the following categories of Personal Information:
| Category of Personal Information | Data Types |
|---|---|
| Identifiers | Full name, email address, postal address, social media identifier, IP address, account name |
| Personal Information Categories listed in the California Customer Records Statute | Name, image, address. |
| Internet or Other Electronic Network Activity Information | The referring page that linked to Company Websites, browsing history, interaction with Company Websites. |
| Geolocation Data | Country, State and city. |
| Professional or employment-related information | Company name, roles of relevant Customer employees. |
| Commercial Information | Records of products or Services purchased by us. |
In the preceding twelve (12) months, we have collected the above-mentioned categories of Personal Information from the following categories of sources:
We do not offer financial incentives to consumers for providing Personal Information.
We do not “Sell” your Personal Information; however, we may “Share” Personal Information about you, as these terms are defined under US Privacy Laws.
In the preceding twelve (12) months we may have disclosed or shared your Personal Information, as described below:
| Category of Recipient | Categories of Personal Information |
|---|---|
| Affiliated companies and entities within our group | Disclosure of all categories of Personal Information |
| Service Providers | |
| Auditors and advisors | |
| Business partners, such as customers and advertisers | Disclosure and sharing of unique identifiers, IP address, user activity data (interaction with Ads) |
| Legal and Regulatory agencies | Disclosure of all categories of Personal Information, subject to law enforcement or a competent authority request |
When we disclose Personal Information, we ensure that the recipient only has access to such information that is strictly necessary for us to provide the Services. These parties are required to secure the Personal Information they receive, and to use it for pre-agreed purposes only, while ensuring compliance with all applicable data protection regulations.
In addition to the practices detailed in this Privacy Policy, we also use and disclose the Personal Information we collect for the following commercial and business purposes:
If you are a California resident, you may only designate an authorized agent to make a request on your behalf if: (i) The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and (ii) you sign a written declaration that you authorize the authorized agent to act on your behalf. The request must: (i) provide sufficient information to allow us to reasonably verify you are the person about whom we collected Personal Information or an authorized agent. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you, and (ii) describe your request with sufficient details to allow us to properly understand, evaluate, and respond to it. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
California Privacy Rights. California Civil Code Section 1798.83 permits you, if you are a California resident, to request certain information regarding disclosure of Personal Information to third-parties for their direct marketing purposes. To make such a request, please contact us at dpo@ex.co. Please note that we are only required to respond to one request per customer each year.
Nevada law requires certain businesses to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of Personal Information that the business has collected or will collect about the consumer. Nevada law defines “sale” as the exchange of Personal Information for monetary consideration by the business to a third party for the third party to license or sell the Personal Information to other third parties. If you are a Nevada consumer from whom Company has collected Personal Information and you wish to submit a request relating to our compliance with Nevada law, please contact us at dpo@ex.co.
We reserve the right to change this Privacy Policy at any time. The most current version will always be posted and will be reflected in the “Last Updated” heading. As requested by the CCPA, we will review this Privacy Policy every twelve (12) months and amend it as necessary. We recommend you review this Privacy Policy periodically to ensure that you understand our most updated privacy practices. By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Privacy Policy. However, if this Privacy Policy is changed in a significant way, a notice will be posted.
This Privacy Policy has been drafted in the English language, which is the original and controlling version of this Privacy Policy. To the extent permitted by law, all translations of this Privacy Policy into other languages shall be solely for convenience and shall not control the meaning or application of this Privacy Policy. In the event of any discrepancy between the meanings of any translated versions of this Privacy Policy and the English language version, the meaning of the English language version shall prevail.
The Company has a designated representative in the European Union for data protection matters, pursuant to Article 27 of the GDPR, and in the United Kingdom. Inquiries regarding Company’s EU and UK privacy practices may be sent to:
EX.CO Technologies Limited
Attn: Data Protection Representative, 3 Waterhouse Square, 138-142 Holborn, London EC1N 2SW, United Kingdom.
If you have any questions, inquiries or concerns related to this Privacy Policy or the processing of your Personal Data, you may contact our Data Protection Officer, either at dpo@ex.co or by postal mail:
EX.CO Technologies Ltd.
Attn: Data Protection Officer, 5 Aluf Kalman Magen St., building A, 1st floor, Tel Aviv 6107077, Israel.