As a data controller, you may receive requests from end users attempting to exercise their rights of erasure, access, portability, or correction with regard to personal data. To the extent data controllers have shared such information with TUNE and require erasure by TUNE to fulfill the end user’s rightful request, data controllers must communicate that obligation to TUNE, along with the information necessary for TUNE to execute the request.
To fulfill the rights of end users, admin employees can submit a data request to TUNE on behalf of an end user. This request can include:
- Blanking/truncating personal data
- Exporting all data we have stored for a user
- Deleting all data for a user, advertiser, or brand
Submitting a Request
The process for submitting a data request on behalf of your end users is as follows:
- Request the GDPR Data Request CSV template from support@tune.com
- Enter the relevant data provided by your end users into your request CSV
- Submit the completed CSV in an email to support@tune.com
Once we have received a data request, our support team will validate the CSV contents and confirm the action to be taken. Once validated, TUNE will make its best efforts to process this request in a reasonable amount of time.
Formatting Your CSV File
The CSV format includes a required header line as the first line and data lines following it. Read the following sections carefully to ensure you include your data in the appropriate format and request the appropriate time frame and transform for data processing.
CSV Header Fields
For the data request process, the header line is as follows:
date_begin,date_end,advertiser_id,device_id,device_id_md5,device_id_sha1,android_id,android_id_md5,android_id_sha1,mac_address,mac_address_md5,mac_address_sha1,google_aid,google_aid_md5,google_aid_sha1,ios_ifa,ios_ifa_md5,ios_ifa_sha1,ios_ifv,windows_aid,windows_aid_md5,windows_aid_sha1,platform_aid,platform_aid_md5,platform_aid_sha1,odin,device_ip,transform,publisher_id,event_type
Important: Your CSV file must include data for at least the “transform” header. A file containing information only in “transform” results in applying the provided changes across all personal data in your application.
CSV Data Fields
For the data request process, data fields must be formatted as described in the table below:
| Name | Description | Accepted Values | Example |
|---|---|---|---|
| date_begin | Start date (starts at midnight in the brand’s preferred timezone) | optional date string (YYYY-MM-DD) | 2018-02-01 |
| date_end | End date (ends at midnight in the brand’s preferred timezone) | optional date string (YYYY-MM-DD) | 2018-02-01 |
| advertiser_id | Advertiser ID to filter data by | optional numeric value | 1234567 |
| device_id | Legacy Android device identifier by which to filter data | optional alphanumeric value | 100000000001 |
| device_id_md5 | An MD5 hash of device_id | optional MD5 string | MTAwMDAwMDAwMDAx |
| device_id_sha1 | SHA1 hash of device_id | optional SHA1 string | 6176eed03b05347bb94b5b8335301745491c7723 |
| android_id | Legacy Android identifier by which to filter data | optional alphanumeric value | 100000000001 |
| android_id_md5 | An MD5 hash of android_id | optional MD5 string | MTAwMDAwMDAwMDAx |
| android_id_sha1 | SHA1 hash of android_id | optional SHA1 string | 6176eed03b05347bb94b5b8335301745491c7723 |
| mac_address | Device MAC address by which to filter data | optional MAC address string | 00:11:22:AA:BB:CC |
| mac_address_md5 | An MD5 hash of mac_address | optional MD5 string | MDA6MTE6MjI6QUE6QkI6Q0M= |
| mac_address_sha1 | SHA1 hash of mac_address | optional SHA1 string | d672c85988abce4b88fb3bafeaceb4011272be6c |
| google_aid | Google Advertising Identifier by which to filter data | optional GUID string | f840f25-becf-45bd-bd86-b31832de78cd |
| google_aid_md5 | An MD5 hash of google_aid | optional MD5 string | Zjg0MGYyNS1iZWNmLTQ1YmQtYmQ4Ni1iMzE4MzJkZTc4Y2Q= |
| google_aid_sha1 | SHA1 hash of google_aid | optional SHA1 string | 9315eb5c55afb720bc3c6d72b959a2eca8dade11 |
| ios_ifa | Apple Identifier for Advertising by which to filter data | optional GUID string | f840f25-becf-45bd-bd86-b31832de78cd |
| ios_ifa_md5 | An MD5 hash of ios_ifa | optional MD5 string | Zjg0MGYyNS1iZWNmLTQ1YmQtYmQ4Ni1iMzE4MzJkZTc4Y2Q= |
| ios_ifa_sha1 | SHA1 hash of ios_ifa | optional SHA1 string | 9315eb5c55afb720bc3c6d72b959a2eca8dade11 |
| ios_ifv | Apple Identifier for Vendors by which to filter data | optional GUID string | f840f25-becf-45bd-bd86-b31832de78cd |
| windows_aid | Windows Advertising Identifier by which to filter data | optional alphanumeric string | AAAAAABBBBCCCC111122222222222 |
| windows_aid_md5 | An MD5 hash of windows_aid | optional MD5 string | QUFBQUFBQkJCQkNDQ0MxMTExMjIyMjIyMjIyMjI= |
| windows_aid_sha1 | SHA1 hash of windows_aid | optional SHA1 string | f95dcbb0556c345ecaa771215ecd78e8c29b83bc |
| platform_aid | Amazon Fire Advertising Identifier by which to filter data | optional GUID string | df07c7dc-cea7-4a89-b328-810ff5acb15d |
| platform_aid_md5 | An MD5 hash of platform_aid | optional MD5 string | Zjg0MGYyNS1iZWNmLTQ1YmQtYmQ4Ni1iMzE4MzJkZTc4Y2Q= |
| platform_aid_sha1 | SHA1 hash of platform_aid | optional SHA1 string | 9315eb5c55afb720bc3c6d72b959a2eca8dade11 |
| odin | Open Device ID Number to filter data on | optional SHA1 string | 9315eb5c55afb720bc3c6d72b959a2eca8dade11 |
| device_ip | Device IP address to filter data on | optional IP address | 70.183.228.209 |
| transform | Type of right being exercised: “Portability”, “Access”, “Correction”, “Erasure” | required string | Erasure |
| publisher_id | Publisher ID to apply the request to | optional numeric value | 1002 |
| event_type | Event type to apply the request to: “clicks”, “conversions” | optional string | clicks |
Date Fields
The fields “date_begin” and “date_end” are used to determine the time frame for changes via the data request (in the brand’s preferred timezone). We use the following rules for accepting time frames:
- When only date_begin is specified, any data that occurs on or after the date_begin date is selected for blanking or extracting.
- When only date_end is specified, any data that occurs on or before the date_end date is selected for blanking or extracting.
- When both date_begin and date_end are specified, any data that occurs on or after the date_begin and on or before the date_end date is selected for blanking or extracting.
- When date_end is not specified or in the future, it is assumed to be now (the time at which the blanking/deleting/extracting/holding process is run).
- These date fields are used to filter the data down to a date range. When used in conjunction with advertiser_id, the data is further filtered to rows matching that advertiser. When used in conjunction with any ID/IP fields (google_aid, ios_ifa, windows_aid, platform_aid, device_ip), any ID/IP matches within the specified dates (and matching the specified advertiser_id, if provided) is used for processing (blanking/deleting/extracting/holding).
Transform Types
The “transform” field is used to determine the type of data processing request. We use the following descriptions of each transform:
- Portability: Request by a user, through a customer (brand), to export any data we have on them, (based on the dates and identifying IDs/IP address provided) for the purposes of transferring from one electronic processing system to another. Known as the “Right to Data Portability” (https://gdpr-info.eu/art-20-gdpr/).
- Access: Request by a user, through a customer (brand), to export any data we have on them, based on the dates and identifying IDs/IP addresses provided. Known as the “Right to Data Access” (https://gdpr-info.eu/art-15-gdpr/).
- Correction: Request by a user, through a customer (brand), to correct any personal data in our systems, based on the dates and identifying IDs/IP address provided. Note that the only info we store to be changed is the Device ID and IP address. If no dates or identifying information are provided, the request will process for the entirety of the brand’s data set. Known as the “Right to Rectification” (https://gdpr-info.eu/art-16-gdpr/).
- Erasure: Request by a user, through a customer (brand), to blank out any personal data from our systems, based on the dates and identifying IDs/IP addresses provided. If no dates or identifying information are provided, the request will process for the entirety of the brand’s data set. Known as the “Right to Erasure” (https://gdpr-info.eu/art-17-gdpr/).