Garritz Marketing Cloud Privacy Notice

Mobility data and advertising identifiers · version 2026-10-25.v3

This notice is for people whose device appears in the mobility data that Garritz Advertising LLC licenses and processes. It is separate from our Data Protection Policy, which covers visitors to our websites. If you came here looking for how to stop this processing, go straight to opt out.

1. Controller and representative

The controller is Garritz Advertising LLC, 8 The Green, Suite 6322, Dover, DE 19901 (United States). Representative in the European Union (art. 27 GDPR): Garritz Online Media International GmbH, Feldbergblick 29, 65207 Wiesbaden (Germany), Geschäftsführer Julian Garritz Cruz; see its Impressum. Contact for either: privacy@garritz.com.

2. What we process

• A mobile advertising identifier (MAID) — the IDFA on Apple devices, the Advertising ID on Android. It is a number your device gives to apps, and you can reset or disable it in your device settings.
• Location signals tied to that identifier: coordinates with a timestamp, and the accuracy reported by the device.
• Attributes we derive from those signals: the places visited, an approximate home area at postal-area level or coarser, and inferred interest categories.

We do not hold your name, email address, phone number, account, or any official identifier, and we do not try to work out who you are. We do not process special categories of data under art. 9 GDPR.

3. Where the data comes from

We do not collect it from you. We license it from mobility data providers — principally Veraset — which in turn obtain it from mobile applications whose users granted those apps location permission. We are not the source and we have no relationship with the app you used.

4. What we use it for

• Aggregate studies of movement patterns for a sector, a city or a chain of stores.
• Measuring footfall: whether people who saw an advertising campaign later visited a physical location.
• Building audience segments of advertising identifiers that are then activated on advertising platforms.

5. Legal basis

For people in the European Economic Area, the United Kingdom and Switzerland we rely on legitimate interest (art. 6.1.f GDPR) in producing mobility analytics and measuring advertising, balanced against your rights through the safeguards in section 7. Consent for the original collection is obtained by the application that captured the signal, not by us. Elsewhere we rely on the equivalent basis in local law, including the LFPDPPP in Mexico.

You can object at any time, for any reason, and we will stop. See section 8.

6. Who we share it with

Segments built from this data are delivered to advertising platforms and partners on the instruction of our clients: Meta, TikTok, Index Exchange, Karlsgate and demand-side platforms. We also share aggregate results — counts and percentages, never individual records — with the client who commissioned a study. We do not sell raw location records.

7. Where the data lives

Per-device data from the European Economic Area, the United Kingdom and Switzerland is stored and queried only in the European Union (Frankfurt). Data from other territories is stored in the United States. Segments derived from European data leave the European Union only in aggregate, with a minimum group size of ten devices. International transfers rely on the European Commission's standard contractual clauses.

8. Your rights

You can object to the processing, ask for your data to be erased, ask what we hold about your identifier, and lodge a complaint with a supervisory authority — in Germany, the Hessian Commissioner for Data Protection and Freedom of Information.

The fastest route is the opt-out page: give us your advertising identifier and we add it to a permanent suppression list. From that moment it is excluded from every segment we publish, and it is removed from our stored data within one month. The suppression is permanent: if the same identifier arrives again from a provider, it is dropped on arrival.

You can also write to privacy@garritz.com. We answer within one month (GDPR), forty-five days (California) or twenty days (Mexico), whichever applies to you.

Two honest limits. Resetting your advertising identifier gives your device a new number, which we have no way of linking to the old one — so a reset after you opt out starts a fresh identifier we do not know about. And a segment already delivered to an advertising platform lives in that platform; we stop including you in the next update, but we cannot reach into their copy.

9. How long we keep it

Per-device mobility records are kept for up to twenty-four months and then deleted. Suppression entries are kept indefinitely, because forgetting them would undo your opt-out; they hold only a hashed identifier and the dates, nothing else.

10. How to find your advertising identifier

iPhone and iPad. Settings → Privacy & Security → Tracking. If "Allow Apps to Request to Track" is off, your device already returns no identifier to apps and there is nothing for us to receive.

Android. Settings → Google → All services → Ads. There you can see, reset or delete your advertising ID.

If you would rather not read the number off your device, deleting the identifier in those same settings stops new data at the source.