Privacy Policy

Rockerbox Privacy Notice

Effective Date: July 31, 2026

This Rockerbox Privacy Notice consists of two parts. Part 1 (Website & Marketing) explains how Rockerbox collects and uses Personal Information when you visit our website or interact with our marketing communications. Part 2 (Solutions) explains how Rockerbox processes Personal Information through its marketing attribution and measurement platform on behalf of its customers.

Part 1 - Website & Marketing Privacy Notice

Rockerbox, Inc. ("Rockerbox", "we", "us" or "our") is a marketing attribution and measurement company. This part of the Rockerbox Privacy Notice explains how we collect, use and share Personal Information when you visit our website at https://www.rockerbox.com (the "Website") or interact with our marketing communications.

Quick Links

We recommend that you read this part in its entirety. However, to make it easier to find specific sections, we have divided it as follows:

• 1. Who is Rockerbox?
• 2. What data do we collect through our website?
• 3. How do we use the data we collect?
• 4. How and to whom do we disclose data?
• 5. How long do we keep Personal Information?
• 6. How is Personal Information secured?
• 7. How is Personal Information transferred internationally?
• 8. What are your rights?
• 9. Additional disclosures
• 10. Do we update this notice?
• 11. How can you contact Rockerbox?

1. Who is Rockerbox?

Rockerbox, Inc. is a marketing attribution and measurement company headquartered at 462 Broadway, New York, NY 10013, USA. Rockerbox, Inc. is a wholly owned subsidiary of DoubleVerify Holdings, Inc. (“DoubleVerify”), a leading software platform for digital media measurement, data and analytics. Our platform enables brands and advertisers to measure the efficiency of their marketing efforts by attributing consumer actions, such as purchases and sign-ups, to the marketing touchpoints that influenced them.

We treat any data that relates or is linked to an identified or identifiable individual as "Personal Information" regardless of that individual's location. This part covers Personal Information collected directly by Rockerbox when you visit the Website or engage with our marketing communications. For information about how Rockerbox processes Personal Information through its platform on behalf of customers, please refer to Part 2 of this notice.

2. What data do we collect through our website?

Rockerbox collects Personal Information in several ways when you visit the Website, as set out in the table below.

We do not intentionally collect Personal Information from visitors under the age of 13. If you are under 13, you are not permitted to submit Personal Information to us. If we learn that a child under 13 has submitted Personal Information, we will delete it as soon as possible. Please contact us at privacy@rockerbox.com if you believe we may hold Personal Information from a child under 13.

3. How do we use the data we collect?

Rockerbox uses the Personal Information collected through the Website for the following purposes:

• To respond to your inquiries, requests for information, or demo requests;
• To register and administer Customer accounts and provide access to the platform;
• To send you notices, updates and information about Rockerbox and its services, with your permission;
• To improve the content and administration of the Website and our services;
• To monitor and analyze trends, track usage and user movement on the Website, and develop and refine our products and functionality;
• To prevent fraud, unauthorized or illegal activity, and to promote safety and security; and
• To comply with legal obligations or respond to lawful requests from government entities, courts or regulatory authorities.

Where we use your Personal Information for marketing purposes, you will be given the opportunity to opt in to receive newsletters, white papers or specific marketing materials. Before we use your Personal Information for a new purpose that is incompatible with the purpose for which it was collected, we will seek your consent or otherwise ensure an appropriate legal basis applies. For more information, contact us at privacy@rockerbox.com.

The legal basis for processing Personal Information collected automatically through the Website is our legitimate interest in operating and improving a secure and functional website. The legal basis for processing Personal Information provided through contact forms or demo requests is our legitimate interest in responding to inquiries from potential customers. The legal basis for sending marketing communications is your consent.

4. How and to whom do we disclose data?

Rockerbox does not share your Personal Information with third parties other than as described in this notice or as required by applicable law:

• Sub-processors - we work with third-party agents and sub-processors (such as email marketing providers, database vendors and analytics tools) who process data on our behalf and only as directed by us.
• Affiliates - such as our parent company DoubleVerify Holdings, Inc., sister companies, or other companies under common control, to the extent necessary to operate, maintain and improve the Website and our services.
• Third Parties involved in a Corporate Transaction - in the event that Rockerbox or DoubleVerify is involved in a reorganization, merger, acquisition of assets, dissolution or other fundamental corporate change.

We may also be legally required to disclose your Personal Information if a government entity, tribunal, law enforcement or regulatory agency requires such disclosure, or as otherwise required under any applicable law, regulation or rule.

5. How long do we keep Personal Information?

Rockerbox retains Personal Information collected through the Website only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Personal Information provided through contact or demo request forms is retained for the duration of the relevant business relationship and for a reasonable period afterward. Automatically collected technical data is typically retained for no longer than 12 months. Marketing contact information is retained until you opt out or we determine it is no longer needed.

In limited circumstances it may become necessary to retain your Personal Information for an extended period, for example if required by a government entity, law enforcement or regulatory agency, or as otherwise required by applicable law.

6. How is Personal Information secured?

Rockerbox has implemented appropriate technical, physical and organizational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. While we follow generally accepted standards and best practices to protect Personal Information, no method of storage or transmission is 100% secure. Our security program includes SOC 2 Type II certification. We are constantly working to improve our safeguards.

7. How is Personal Information transferred internationally?

The Personal Information we collect through the Website may be transferred to and maintained on servers located outside your state, province, country or other jurisdiction. Rockerbox stores all Personal Information in the United States. We take measures to ensure that any recipient of your Personal Information offers an adequate level of protection, for instance by entering into Standard Contractual Clauses ("SCCs") or an alternative mechanism approved by the European Commission or other applicable regulator.

8. What are your rights?

Residents of the European Economic Area, the United Kingdom, Switzerland, California and other jurisdictions have rights under applicable privacy laws. To exercise these rights, contact us using the information in Section 11 below. We will not discriminate or retaliate against you for exercising your rights.

These rights include:

1. The right to access any Personal Information we hold about you.
2. The right to correct any inaccurate Personal Information we hold about you.
3. The right to request that Rockerbox delete any Personal Information we hold about you.
4. The right to restrict or object to the processing of your Personal Information.
5. To the extent your Personal Information is processed based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
6. The right to lodge a complaint with your local Data Protection Authority if you believe your Personal Information has been processed in violation of applicable law.
7. The right to receive a copy of your Personal Information in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where processing is carried out by automated means and is based on your consent or a contract.

Please allow up to thirty (30) days for us to respond to your request.

9. Additional disclosures

Rockerbox does not sell or share Personal Information collected through the Website in a way that would constitute a "sale" or "sharing" under California, Virginia, Nevada or similar laws.

Our Website may contain links to third-party websites. This notice applies only to information collected by Rockerbox and does not cover third-party websites, which have their own privacy policies and data collection practices. We are not responsible for the practices of third parties.

10. Do we update this notice?

We may update this notice from time to time to reflect changes in our practices, the Website or applicable legal requirements. Any changes will be posted as soon as they go into effect. We will update the effective date listed at the top of this Rockerbox Privacy Notice when changes are made.

11. How can you contact Rockerbox?

If you have any questions, concerns or comments about this part of the Rockerbox Privacy Notice, please contact our Privacy Team at:

Privacy Officer / Data Protection Officer (Privacy Team) Contact Information

Rockerbox, Inc. (a DoubleVerify company)

462 Broadway

New York, NY 10013

privacy@rockerbox.com

Nothing in this notice limits your rights under applicable laws, including your ability to file a complaint with your local Data Protection Authority or other agency with jurisdiction over privacy related matters.

Part 2 - Solutions Privacy Notice

Quick Links

We recommend that you read this part in its entirety. However, to make it easier to find specific sections, we have divided it as follows:

• 1. Who is Rockerbox?
• 2. What is our role, goals and legal basis of Processing?
• 3. What data do we collect through the Platform and for what purposes?
• 4. How do we use the data we collect?
• 5. How and to whom do we disclose data?
• 6. How long do we keep Personal Information?
• 7. How is Personal Information secured?
• 8. How is Personal Information transferred internationally?
• 9. What are your rights?
• 10. Does Rockerbox use Artificial Intelligence?
• 11. Additional disclosures
• 12. Do we update this notice?
• 13. How can you contact Rockerbox?

1. Who is Rockerbox?

Rockerbox, Inc. is a marketing attribution and measurement company headquartered at 462 Broadway, New York, NY 10013, USA. Rockerbox, Inc. is a wholly owned subsidiary of DoubleVerify Holdings, Inc. (“DoubleVerify”), a leading software platform for digital media measurement, data and analytics. Our Platform enables brands and advertisers ("Customers") to measure the efficiency of their marketing efforts by attributing consumer actions, such as purchases and sign-ups, to the marketing touchpoints that influenced them across channels.

We treat any data that relates or is linked to an identified or identifiable individual as "Personal Information" regardless of that individual's location. This part explains how we process Personal Information through the Platform on behalf of our Customers, and what rights you may have in connection with that processing. Individuals whose data may be processed through the Platform are referred to in this part as "End Users" or "you."

2. What is our role and legal basis of processing?

Rockerbox acts as a data processor for Personal Information processed through the Platform, meaning we collect and process End User data solely on the documented instructions of our Customers, who serve as the data controllers. The Customer whose website, app, or marketing channel you have interacted with determines how your Personal Information is used and is responsible for establishing the applicable lawful basis for that processing. If you have questions about how a specific Customer handles your data, we recommend reviewing that Customer's privacy notice. The terms governing our processing on behalf of Customers are set out in our Data Processing Agreement ("DPA").

Under the CCPA and similar US state laws, Rockerbox operates as a "service provider" or "contractor" on behalf of its Customers, who serve as the "business." Rockerbox processes Personal Information in compliance with applicable data protection laws, including the GDPR and applicable US state privacy laws, in its capacity as a data processor. In the event of a personal data breach affecting Personal Information processed on behalf of a Customer, Rockerbox will notify the relevant Customer without undue delay and in accordance with its obligations under applicable law and the applicable DPA.

3. What data do we collect and for what purposes?

Rockerbox only collects information that is necessary to carry out the purposes of the Platform. The categories of data we collect are set out in the table below.

The lawful basis for all Personal Information processed through the Platform is determined by the relevant Customer as controller. Rockerbox processes Personal Information only to the extent permitted by the basis established by the Customer.

The Platform is not intended to process Personal Information of children. We do not knowingly collect Personal Information from individuals under the age of 13. If you are a parent or guardian and believe your child's Personal Information may have been processed through the Platform, please contact us using the information in Section 13 of this part.

4. How do we use the data we collect?

Rockerbox uses the information collected through the Platform to:

• Match touchpoint signals (such as an ad click or website visit) to conversion events (such as a purchase or sign-up) to generate multi-touch attribution reports for our Customers;
• Generate reporting on the performance of marketing campaigns across channels, including digital, social, in-app, direct mail and connected TV;
• Provide dashboards and insights that allow our Customers to make informed decisions about their marketing spend;
• Operate, maintain, secure and improve the Platform; and
• Comply with legal obligations or respond to lawful requests from government entities, courts or regulatory authorities.

We do not use your Personal Information to build profiles for third-party advertising, to create audience segments for ad targeting, or to track your online activities across websites and apps over time for purposes unrelated to the marketing measurement services we provide to our Customers.

5. How and to whom do we disclose data?

Rockerbox does not disclose Personal Information to third parties, except as strictly necessary to operate, maintain and improve the Platform. To the extent we voluntarily share any Personal Information, we ensure it is protected by the recipients in a manner consistent with our own policies and standards.

We may share your Personal Information with:

• Sub-processors - companies we have contracted to provide services to support the Platform, such as cloud storage and infrastructure, data processing, email delivery, address normalization, analytics, and security services. A current list of our sub-processors is available at https://trust.doubleverify.com/] and can also be requested by contacting us using the information in Section 13.
• Affiliates - such as our parent company DoubleVerify Holdings, Inc., or other companies under common control with Rockerbox, to the extent necessary to operate, maintain and improve the Platform.
• Third Parties engaged by our Customers - to support our Customers' marketing operations, we may integrate the Platform with other tools and services engaged by our Customers to deliver enhanced reporting capabilities. Under no circumstances do we receive data from these integrations that would enable us to identify End Users beyond what is necessary for the Platform.
• Third Parties involved in a Corporate Transaction - in the event that Rockerbox or DoubleVerify is involved in a reorganization, merger, acquisition of assets, dissolution or other fundamental corporate change.

We may be legally required to disclose your Personal Information:

1. If a government entity, tribunal, law enforcement or regulatory agency requires such disclosure;
2. As otherwise required under any applicable law, regulation, or rule; or
3. If we believe, in good faith, that such disclosure is necessary to protect or defend our rights or the rights of others, to assist in an investigation or to prevent illegal activity.

For the avoidance of doubt, Rockerbox does not sell or share Personal Information in a way that would constitute a "sale" or "sharing" under the CCPA or similar laws.

6. How long do we keep Personal Information?

Rockerbox retains Personal Information processed through the Platform only for as long as instructed by the relevant Customer as data controller, as set out in the applicable DPA. Upon expiry or termination of the applicable agreement, or upon the Customer's written instruction, Rockerbox will securely delete or return Personal Information in accordance with the DPA.

Where a Customer has not specified a retention period, Rockerbox applies its standard technical defaults, deleting all Personal Information on a rolling basis. Rockerbox may retain Personal Information beyond those periods where required by applicable law or a lawful order from a government entity, law enforcement or regulatory agency, and only to the minimum extent required.

7. How is Personal Information secured?

Rockerbox has implemented appropriate technical, physical and organizational measures designed to protect Personal Information against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access, as well as all other forms of unlawful processing. While we follow generally accepted standards and best practices to protect Personal Information, no method of storage or transmission is 100% secure. However, we are constantly working to improve our safeguards.

8. How is Personal Information transferred internationally?

Please be aware that the Personal Information we collect may be transferred to and maintained on servers or databases located outside your state, province, country, or other jurisdiction. Rockerbox ultimately stores all Personal Information in the United States. We may also have personnel in other locations who may be required to access your Personal Information to support the Platform.

We take measures to ensure that your Personal Information is stored safely and that any recipient of your Personal Information offers an adequate level of protection and security, for instance, by entering into the appropriate back-to-back agreements and, if required, Standard Contractual Clauses ("SCCs") or an alternative mechanism for the transfer of data as approved by the European Commission or other applicable regulator.

9. What are your rights?

Depending on your jurisdiction, you may have rights with respect to your Personal Information under applicable privacy laws, including rights to access, correct, delete, restrict or object to processing, and to lodge a complaint with your local Data Protection Authority. We will not discriminate or retaliate against you for exercising your rights.

Because Rockerbox processes Personal Information on behalf of its Customers as data controllers, most rights requests should be directed to the relevant Customer, whose privacy notice will explain how to submit a request. Where possible, we will refer requests received directly to the appropriate Customer.

To the extent Rockerbox can fulfill a request directly, for example, where we can identify and match your data in our systems, please submit your request using the contact information in Section 13 below. Please allow up to thirty (30) days for us to respond.

To exercise your right to withdraw consent (where consent is the applicable lawful basis established by the Customer), please use the consent management tool provided by the Customer whose website or service you interacted with. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

10. Does Rockerbox use Artificial Intelligence?

Rockerbox uses Artificial Intelligence ("AI") in various capacities and ways throughout the organization to support and improve the Platform. While we make use of AI technologies, we do not engage in "automated decision making" as defined by applicable privacy laws and regulations.

11. Additional disclosures

Certain privacy laws and regulations, such as the CCPA, require businesses to disclose whether they sell Personal Information. Rockerbox does not disclose Personal Information in a way that would constitute a "sale" or "sharing" under California, Virginia, Nevada or similar laws.

12. Do we update this notice?

We may update this part from time to time to reflect changes in the Platform, our practices, policies or applicable legal requirements. Any changes will be posted as soon as they go into effect. We will update the effective date listed at the top of this Rockerbox Privacy Notice when changes are made. Please note that any translation of this Rockerbox Privacy Notice is intended solely to facilitate your access to this information.The English version is the only official version and any translation inaccuracies or discrepancies are not binding and have no legal effect for compliance or enforcement purposes.

13. How can you contact Rockerbox?

If you have any questions, concerns or comments about this part of the Rockerbox Privacy Notice, or you believe your Personal Information has been used in a way that is not consistent with this notice or your choices, you can contact our Privacy Team at:

Privacy Officer / Data Protection Officer (Privacy Team) Contact Information

Rockerbox, Inc. (a DoubleVerify company)

462 Broadway

New York, NY 10013

privacy@rockerbox.com

Nothing in this Rockerbox Privacy Notice limits or attempts to limit your rights under applicable laws, including your ability, depending on your country of residence, to file a complaint with your local Data Protection Authority or other agency with jurisdiction over privacy related matters.