Is your DSP protecting your users' data? A Q&A with Remerge's Julie Kremp
The stakes are high for app businesses when it comes to safeguarding their users’ data - especially when sharing it with DSPs or other advertising partners. How companies collect, process and protect this data can impact customer trust, commercial relationships and even the performance of your marketing campaigns.
At Remerge, privacy and data protection are central to how we work with advertisers. Our Principal Privacy & Data Protection Manager, Julie Kremp, was recently nominated for the PICCASO Awards under the category for Bridging the Privacy and Security Gap. This nomination recognizes individuals and organizations for their work on privacy, information security, AI and compliance.
We checked in with Julie about the legal responsibilities that fall with advertisers and DSPs alike, how Remerge protects advertiser data, and what app businesses should look for when evaluating their advertising partners.
Hi, Julie! Why is user data privacy so important for advertiser apps?
Regulators can order companies to stop processing certain data or delete it altogether under Article 58 of GDPR. For an advertiser app, that could mean losing access to an audience, having to stop using certain targeting signals, or even suspending activity in a particular market.
Under Article 83(5) of GDPR, fines can reach €20 million or 4% of a company's global annual turnover, whichever is higher. For growing businesses, that percentage is particularly important because the potential penalty increases as the company grows.
There are also the requirements set by Apple and Google. An app needs to comply with both privacy regulations and the app stores' own policies, because failure to do so could result in your app being removed.
Beyond regulatory consequences, mishandling user data can damage customer trust, which leads to lower tracking opt-in rates, poorer app store reviews and reduced customer retention, all of which can negatively impact advertising performance.
How does Remerge stay compliant when privacy regulations are constantly evolving?
We treat privacy as an ongoing process rather than a one-off project. Regulations change, platform requirements evolve, and our own technology continues to develop, so our approach needs to adapt alongside them. We continuously monitor regulatory, vendor and platform developments, then translate those changes into requirements for our products, processes and contracts.
Our information security management system is aligned with international standards such as ISO 27001. We also have designated internal and external Data Protection Officers to ensure clear accountability. Every vendor and internal tool goes through privacy and security due diligence, where we identify potential risks and apply a structured framework to address them.
We can't control how regulations will change in the future, but we can control how quickly we identify those changes and respond. This enables us to understand the implications for our clients' campaigns before they become an issue.
What measures does Remerge take to keep advertiser and user data secure?
One of the most important principles is data separation. Data belonging to different advertisers is kept in separate silos and is never mixed. One client's data is never used to inform another client's campaigns.
We also follow the principle of data minimization. We work with pseudonymous advertising identifiers and technical event data rather than names or email addresses. As data moves through our systems, references to individuals are reduced, and pseudonyms are removed entirely from aggregated reporting to anonymize the data.
We don't work with special-category data, such as health information, or data relating to children under 13. If such data is received inadvertently, it's deleted promptly.
From a technical perspective, we use encryption in transit and at rest. Our employees only get role-based access controls to client data, requiring single sign-on with two-factor authentication for added security. Development and production environments are separated, and we maintain encrypted backups, continuous monitoring, incident response procedures and regular staff training.
Data retention is also limited by design. We retain data only while the account is active or for as long as the service requires, whichever is shorter, and delete it when the relationship ends.
We make our security measures available to clients so they can assess them against their own requirements.
Transparency has always been a priority for Remerge. How do we demonstrate this to clients?
We make important privacy and security documentation publicly available, including our data processing agreement, sub-processor list, and technical and organizational measures. These documents can be accessed through our website and Trust Center, even before a commercial relationship begins. This means prospective clients can complete much of their due diligence without having to contact us.
We're also clear about the responsibilities of each party. The advertiser acts as the data controller, while Remerge acts as the processor. We identify our sub-processors and their locations so clients can assess how their data is handled.
Beyond documentation, we answer security questionnaires, support client assessments and provide access to a designated Data Protection Officer.
For me, transparency means making this information accessible from the beginning, not only once a contract is being negotiated.
What privacy-related questions should advertisers be asking before partnering with a DSP?
- Is my data kept separate, or is it pooled with other advertisers' data to improve your models and their campaign results? Get the answer in writing.
- What types of personal data do you receive about our users from third parties, and why do you need it?
- How long do you retain our data, and what happens to it when our contract ends?
- Who are your sub-processors and where are they located?
- What are your commitments around notifying me of a data breach?
These questions help advertisers understand not just what a vendor promises, but how its privacy practices actually work.
What else should advertisers understand about privacy in today's ad tech industry?
There are three points I'd emphasize.
First, privacy and performance don't have to be a trade-off. Holding less data for shorter periods reduces costs and risks. Campaigns that depend on excessive data collection are often relying on weaker signals in the first place.
Second, consent quality is also a performance consideration, not just a legal one. If consent hasn't been collected or recorded properly, the resulting advertising inventory may not be usable. That can directly affect an advertiser's ability to reach its audience.
And third, privacy commitments need to be backed up by evidence. If a vendor makes strong claims about protecting data, advertisers should ask to see the documentation and processes behind those claims.
Where can advertisers learn more about Remerge's privacy policies and practices?
Our Trust Center provides information about our security controls, policies and self-assessments.
We also publish our service privacy policy, data processing agreements for EU and non-EU clients, sub-processor list, and technical and organizational measures on the Remerge website.
If there's anything our published documentation doesn't cover, our team is available to answer questions directly.
To find out more about how Remerge can help your app run high-performing, privacy-compliant retargeting campaigns, get in touch with our team today:
