This Data Processing Agreement is entered into between Azerion Technology B.V. (“Processor”) and Seller (“Controller”) as defined by the MSA, each a “Party” and together the “Parties”.

WHEREAS:

1. Parties have concluded an agreement for the provision of – among other –data processing services by Processor to Controller, pursuant to which Processor will carry out certain processing of personal data on behalf and on instruction of Controller; and

2. In view of each Parties’ obligations under EU Data Protection Law (as defined below) Parties wish to lay down their respective rights and obligations with regard to the data processing of personal data in this data processor agreement.

HAVE AGREED AS FOLLOWS:

Article 1. Definitions

1. Unless stated otherwise in this Data Processing Agreement, capitalised terms in the Data Processing Agreement have the meaning as defined in the MSA.

2. “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processor”, “Processing”, and “Recipient” all have the meaning under EU Data Protection Law.

3. “Controller Personal Data” means the Personal Data processed by Processor on Controller’s behalf pursuant to this Data Processing Agreement.

4. “EU Data Protection Law” means all applicable EU data protection and privacy laws, including prior to 25 May 2018, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“DP Directive”) and local implementing laws and regulations, and on and after 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”) and any other European Union or EU Member State laws made under or pursuant to the DP or GDPR, in each case as such laws may be amended or superseded from time to time.
5. “Master Services Agreement” or “MSA” means the underlying agreement for the provision of services pursuant to which Processor will carry out certain processing of personal data on behalf and on instruction of Controller, including the Seller Terms and Conditions. For the avoidance of doubt, the actual underlying agreement may be entitled differently than ‘Master Services Agreement’, and consist of several connected agreements, order forms, and/or general terms and conditions.

6. “Data Processing Agreement” means this agreement.

7. “Sub-Processor” means another processor than Processor, engaged by Processor.

Sub-Processors explicitly do not include any third parties that receive Personal Data or that are deployed by Processor at the explicit request of Controller.

8. “Effective Date” means the effective date of the MSA.

Article 2. Processing of Controller Personal Data by Processor

1. Controller hereby instructs Processor to Process the Controller Personal Data on behalf of Controller for the purposes of performing the MSA. The instructions of Controller are described in more detail in this Processing Agreement and, in certain cases, additionally in the MSA. Controller can provide supplementary instructions or changed instructions in writing.

2. The provisions of this Data Processing Agreement apply to all Processing of Controller Personal Data on behalf of Controller by Processor.

3. Controller is the Controller of the Controller Personal Data under EU Data Protection Law, and Processor the Processor. Controller has and keeps independent control over determining the purposes and means of the Processing of Controller Personal Data.

4. Before conclusion of this Data Processing Agreement, Processor will provide Controller with sufficient information about both the Services that Processor will provide and the Processing of Controller Personal Data by Processor on behalf of Controller. The information provided should enable the Controller to make an informed decision and determination of the purposes and means with regard to the Processing of Personal Data in connection with the Services. The information about the Processing of Controller Personal Data is provided in Schedule 1. Controller affirms that when Controller instructs Processor, on the basis of this Data Processing Agreement, to process the Controller Personal Data on its behalf, that the information provided to it has indeed been sufficient for it to be able to make said informed decision and determination of purposes and means.

5. Processor has no independent control over the Controller Personal Data and shall process the Controller Personal Data solely on the documented instructions of the Controller. More specifically, Processor shall not Process the Controller Personal Data for its own purposes or for those of third parties, nor shall it make them available to third parties other than as instructed by the Controller pursuant to this Data Processing Agreement or the MSA.

6. In case Ad Inventory is directed to children or personal data from children (or minor) as defined under EU Data Protection Law is processed, Controller shall either (i) provide the respective indication within Processor’s platform or (ii) inform the Processor via end user data protection signals it provides before activating the Services on Ad Inventory or any other industry-wide recognized and used technical solution. Accordingly, the Controller shall assess whether an Ad Inventory is children-directed or not, based on the criteria and considerations determined by case law, self-regulatory authorities and documentation published by supervisory authorities. For the avoidance of doubt, to the extent required by EU Data Protection Law and any supplementary guidance issued by a supervisory authority, Controller shall also not pass to Processor any Personal Data related to children as defined under such regulations. Without prejudice to any other right or remedy, Processor may immediately suspend Controller’s access to the Services or any portion thereof if Processor believes that Controller has failed to comply with this article.In the event that the Controller does not knowingly process personal data of children, but it became aware of(e.g. by a direct contact from a parent) that a data subject whose personal data was processed was children, the Controller shall promptly contact the Processor with all relevant identifiers for Processor to be able to delete such personal data.

Article 3. Engaging Sub-Processors

1. Processor is authorised to engage Sub-Processors for carrying out specific Processing activities on behalf of the Controller under this Data Processing Agreement and Controller hereby gives it revocable general authorisation to engage such Sub- Processors, provided that Processor duly notifies the Controller of all Sub-Processors it intends to add or replace, whereby the Controller has the opportunity to object to such changes. If Processor cannot reasonably be asked to not make such changes, Processor may terminate the MSA without incurring any liability in connection therewith.
2. When engaging a Sub-Processor, Processor will ensure that the same data protection obligations as set out in this Data Processing Agreement and the MSA are imposed on that Sub-Processor, in particular providing sufficient guarantees to implement

appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of EU Data Protection Law. For the avoidance of doubt, Processor is required to impose similar provisions on any Sub-Processors, but is not required to impose the obligations of this Data Processing Agreement verbatim or back-to-back.

3. Where the Sub-Processor fails to fulfil its data protection obligations, Processor remains fully liable to the Controller for the performance of the Sub-Processor’s obligations, to the extent that Processor itself would be liable under the MSA.

Article 4. Security

4.1 Processor shall implement appropriate technical and organizational security measures. These measures, taking into account the state of the art and the costs associated with the implementation and execution of the measures and the risks that the Processing of the Controller Personal Data and its nature entail, ensure adequate protection and are detailed in Schedule 2.

Article 5. Deletion and destruction of Controller Personal Data

1. On the expiration of the MSA or on the expiration of the applicable term for saving data (to be determined by Controller), Processor will, at the option of Controller: (i) delete all the Controller Personal Data from its systems (automated or otherwise) or the systems it uses to store data and data carriers, or (ii) return the Controller Personal Data, in both cases without keeping any copies of the Controller Personal Data.
2. Processor may derogate from the provisions in the above paragraphs insofar law requires storage of the Controller Personal Data, or as this is necessary in order to prove compliance with its obligations to Controller.

Article 6. Assistance

1. Processor will, taking into account the nature of the Processing and the information available to Processor, assists Controller in ensuring compliance with the obligations of Controller under EU Data Protection Law vis-à-vis Data Subject such as the right to be provided with information about the Processing, the right of access, the right to rectification, the right to erasure, the right to a Restriction of Processing, the right to data portability, or the right to object to automated individual decision making if any.

2. In the event a Data Subject directs any of the above requests to Processor, Processor shall refer the Data Subject to the Controller and otherwise not respond itself to the request, except if required by EU Data Protection Law.

3. Processor will, taking into account the nature of the Processing and the information available to Processor, assists Controller in carrying out any data protection impact assessment or prior consultation as required by EU Data Protection Law.

4. Processor can recover its costs, including out-of-pocket costs for assistance from outside advisors and Sub-Processors, incurred in assisting the Controller.

Article 7. Personnel

7.1 Processor shall ensure that the personnel involved in the processing of the Controller Personal Data are aware of the obligations of Processor laid down in this Data Processing Agreement and have committed themselves to confidentiality or are a statutory obligation of confidentiality, for example on the basis of an employment relationship.

Article 8. Information and audit rights

1. Processor will provide Controller with all information necessary to demonstrate compliance with Processor’s obligations under this Data Processing Agreement. Processor may fulfil this obligation by means of an annual report.

2. Processor will allow for and contribute to audits, including inspections, conducted by Controller or another auditor mandated by Controller, provided such an audit or inspection can in principle only be done once a year. In that regard, the Controller has the right, following advance and reasonable notice, to arrange to investigate the establishment(s) and/or systems of the Processor. Any mandated auditor should have demonstrable experience in performing such audits or inspections. The investigation shall not extend beyond what is necessary for the purpose as described in this paragraph and does not include systems owned by third-parties or Sub-Processors.

3. Each Party shall bear its own costs associated with the investigation as referred to in paragraph 2 of this Clause and Controller will bear the costs of the independent auditor if the investigation shows that Processor has substantially complied with its obligations pursuant to this Data Processing Agreement. By way of derogation from the foregoing, Processor shall bear the costs of the independent auditor, if the investigation shows that Processor has breached its obligation(s) pursuant to this Data Processing Agreement, provided that the breach is considerable enough to justify these costs.

4. Processor will immediately inform Controller if, in its opinion, an instruction in connection with the investigation referred to in paragraph 2 of this Clause infringes EU Data Protection Law, for example if with such audit or inspection Controller or its mandated auditor would gain access to Personal Data other than Personal Data processed on behalf of Controller.

5. Parties agree to handle any information related to inspections and requests for information, confidential to the extent legally permitted.

6. Processor can recover its costs, including out-of-pocket costs for assistance from outside advisors and Sub-Processors, incurred in assisting the Controller.

Article 9. Data Breach reporting obligations and incident management

1. In the event of a Personal Data Breach, Processor shall immediately, but in any event within 72 hours after Processor learns of the Data Breach, inform the Controller, further to which the Controller will – if necessary – immediately inform the relevant Supervisory Authority and/or Data Subjects.

2. Processor will report a Data Breach in writing and use the contact details as mentioned in Schedule 2.

3. Processor will include in the report of the Data Breach, to the extent available and if reasonably possible, the information listed in Schedule 2. Where certain information is not yet available, Processor will report the information it has available, and straightaway gather – if reasonably possible – all additional information and provide it to the Controller.

Article 10. Liability

The limitations of liability in the MSA apply in all cases.

Article 11. Miscellaneous

1. This Data Processing Agreement is an appendix to and forms part of the MSA. This Data Processing Agreement shall be effective as of the Effective Date and shall remain into effect for the same period as the MSA remains into effect. If and insofar the MSA is legally terminated, this Data Processing Agreement shall without any liability whatsoever be terminated by operation of law without any notice of termination to the other Party being required.

2. In the event of differences between the provisions of this Data Processing Agreement and the MSA and/or its annexes, the provisions of this Data Processing Agreement shall take precedence, unless explicitly agreed otherwise in the MSA and/or its annexes.

3. Should any provision of this Data Processing Agreement be invalid or unenforceable, then the remainder of this Data Processing Agreement shall remain valid and in force. The invalid or unenforceable provision shall be either: (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, or (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

4. Changes and additions to this Data Processing Agreement are valid only if and insofar as approved in writing by both Parties.

5. Dutch law governs this Data Processing Agreement, with the exclusion of its conflict of laws rules. All disputes arising out of this Data Processing Agreement shall be settled by the competent court in the district where Processor is registered.

Schedule 1

Controller Personal Data to be processed in the context of the MSA 

Controller Contact: As provided under MSA

Processor Contact: dpo@azerion.com

(All terms not defined herein are as defined in the MSA.)

1. Service:

Automated selling of Ad Inventory, and managed services by Processor of the same, for

Controller’s Sites (digital properties). 

2. Subject and duration of processing:

Controller instructs Processor to process the types of data listed below for the purpose of

enabling the automated selling of ad inventory for Controller’s digital properties.

Data itself is processed in principle for up to 90 days. The processing as a whole is for the duration of the MSA (see MSA).

3. Nature and purposes of processing:

Controller would like to offer for sale, via an automated process, the Ad Inventory for its Sites (digital properties). In connection with such offer and sale, a limited amount of data needs to be collected, stored and transmitted by Processor on behalf of Controller to the parties indicated below under “Data Sharing”.

4. Types of personal data and categories of data subjects:

The following types of (personal) data are processed:

1. Date and time of each event
2. IP address (can be last proxy in the request)
3. Country and region (approximate, based on IP geo database)
4. User agent (browser) of visitor
5. Device (ad) ID, if available
6. Domain visited
7. Page visited

Controller’s instruction to Processor may also be indicated (in more detail) in the MSA, a purchase order, during the onboarding process, in the Controller dashboard, or by Controller parameterizing data capture on its Sites.

Controller can also additionally instruct Processor to process third-party data on its behalf, as elected by Controller within the applicable Service.

This data is processed of visitors and users of Controller’s digital properties (Sites). As a result of the data processing, the visitors and users are presented with ads.

5. Data Sharing:

1. Controller instructs Processor to disclose the Controller Personal Data to advertisers, agencies, networks, technical providers or other parties, that bid on or viewed Controllers’ Ad Inventory in an auction or to which Controller has sold Ad Inventory through the Service.
2. Controller instructs Processor to disclose the Controller Personal Data to third parties whose services Controller has elected to use through the applicable Service(s), as

indicated on the purchase order or in the dashboard; and

3. as may otherwise be elected by the Controller within the applicable Service.

6. Data transfers:

Processor can transfer Personal Data to third countries or organization

Schedule 2

Security measures and data breach communication protocol

1. Controller and Processor Contact:

See Schedule 1.

2. Security Measures:

Processor has taken a number of technical and organization protection measures:

1. Access control
2. Identity management
3. Logging (event visibility)
4. Configuration integrity

3. Minimum details for Processor to provide in the event of a Personal Data Breach:

1. the nature of the breach;
2. the date and time on which the incident occurred and was discovered;
3. the (number of) Data Subjects impacted by the incident;
4. the categories of personal data involved in the incident; and
5. any security measures – such as encryption at rest – that may prevent further unlawful processing of the Personal Data.
6. the name and contact details of Processor’s data protection officer or other relevant contact from whom more information can be obtained;
7. the (suspected) cause of the breach;
8. the consequences of the breach already known and to be expected;
9. the recommended measures for remedying or mitigating the consequences

This US Data Processing Addendum is entered into between Azerion Technology B.V. (“Processor”) and Seller (“Controller”) as defined by the MSA, each a “Party” and together the “Parties” and forms part of the Data Processing Agreement (“DPA”).

1. Definitions

1.1. “Restricted Processing Signal” means any flag or signal indicating that a Consumer has opted out of the Sale, Sharing, or Processing for purposes of Targeted Advertising of their Personal Data, including without limitation those flags or signals sent through the IAB CCPA Compliance Framework, Global Privacy Platform, or other signaling system agreed to by the Parties.

1.2. “Restricted Purposes” means advertising-related Processing that qualifies as a Business Purpose, including Processing for purposes of auditing; security and integrity; debugging; short term, transient uses; analytics; providing advertising or marketing services that do not include Cross-Contextual Behavioral Advertising, Targeted Advertising, or profiling; internal research; and efforts to improve quality and safety. Restricted Purposes includes first-party advertising, contextual advertising, frequency capping, measurement, fraud detection and prevention, and ensuring and measuring viewability, each only to the extent such activity (i) is permissible for a Processor to perform under the applicable State Privacy Laws; and (ii) does not result in a Sale or Sharing of Personal Data or constitute Processing of Personal Data for Targeted Advertising purposes.

1.3. “State Privacy Laws” means the California Consumer Privacy Act of 2018, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring of 2022, the Indiana Consumer Data Protection Act, the Iowa Act Relating to Consumer Data Protection of 2023, the Montana Consumer Data Privacy Act, the Tennessee Information Protection Act, the Utah Consumer Privacy Act of 2022, the Virginia Consumer Data Protection Act, the Children’s Online Privacy Protection Act (“COPPA”), as well as any other applicable laws under the laws of United States of America, in each case as amended and including any regulations promulgated thereunder.

1.4. “Business”, “Business Purpose”, “Consumer”, “Controller”, “Cross-Context Behavioral Advertising” “Data Breach”, “Personal Data”, “Personal Information,” “Process(-ing)” “Processor,” “Sell”, “Share” “Service Provider”, and “Targeted Advertising” shall have the meanings ascribed to them in State Privacy Laws.

2. Roles 

2.1. With respect to the Processing of Personal Data/Personal Information by Parties under DPA and this Addendum, Parties agree that Improve Digital is a Service Provider/Processor and Seller is a Business/Controller. In this regard, to the extent it is a Service Provider/Processor, Improve Digital shall process Personal Data/Personal Information as listed by and for the purposes provided by Schedule 1 of the DPA.

3. Obligations of Parties

3.1. Parties shall comply with State Privacy Laws applicable to the Processing of Personal Data/Personal Information carried out by themselves under this Addendum.

3.2. In particular, to the extent acting as a party that discloses Personal Data/Personal Information; each Party will (a) provide all notices and obtain any consents required by State Privacy Laws necessary to permit each Party to Process Personal Data/Personal Information in accordance with this Addendum; and to the extent providing Personal Data/Personal Information originally collected by another Business/Controller, (i) contractually and operationally oblige such Business/Controller to provide all notices and obtain any consents required by State Privacy Laws necessary to permit each Party to Process Personal Data/Personal Information in accordance with this Addendum and (ii) take reasonable steps to ensure compliance with such contractual obligations.

3.3. In case Ad Inventory is directed to children as defined under the documentation (such as FAQs, statements and reports) of Federal Trade Commission of the US (“FTC”), State Privacy Laws and based on the case law of the FTC (i.e. the review of ad inventories by the FTC in cases, to determine whether they are child-directed or not), Seller shall either (i) provide the respective indication within Improve Digital’s platform or (ii) inform the Improve Digital via COPPA flags or any other industry-wide recognized and used technical solution it will provide while activating the Services on Ad Inventory. For the avoidance of doubt, to the extent required by State Privacy Laws, Seller shall also not pass to Improve Digital any Personal Data/Personal Information related to children as defined under such regulations. Without prejudice to any other right or remedy, Improve Digital may immediately suspend Seller’s access to the Services or any portion thereof if Improve Digital believes that Seller has failed to comply with this article. In the event it is found out that the Seller collected personal data of children without obtaining valid parental consent (as defined under COPPA), Seller shall promptly notify the Improve Digital so that Improve Digital can adopt necessary measures. Seller hereby acknowledges and agrees that it shall, as soon as feasible, revise its data collection practices and implement any additional obligations introduced when S.1418 & H.R.7890 – Children and Teens’ Online Privacy Protection Act (also known as COPPA 2.0) is in force. If deemed necessary, Parties shall promptly amend this Addendum when COPPA 2.0 is in force. Seller shall adopt necessary and comply with COPPA 2.0 obligations before this Addendum is amended. 

3.3. As a Service Provider/Processor, Improve Digital shall;

3.3.1. In the presence of a Restricted Processing Signal provided by Seller under this Addendum, only process Personal Data/Personal Information for Restricted Purposes; 

3.3.2. Assist Seller in responding to Consumer requests made pursuant to State Privacy Laws, provided that Seller must provide to Improve Digital all information necessary for it to provide such assistance or respond to a Consumer request when required by State Privacy Laws;

3.3.3. Contribute to data protection impact assessments where required by State Privacy Laws;

3.3.4. Offer reasonable notice and assistance to Seller in the event Seller experiences a Data Breach, including to help Seller satisfy its Data Breach notification obligations under State Privacy Laws;

3.3.5. Implement reasonable security procedures and practices appropriate to the nature of the Personal Data and designed to protect such Personal Data from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with State Privacy Laws;

3.3.6. Ensure it has in place a written agreement with any further Service Providers it may engage with under this Addendum that obliges those Service Providers to comply with terms at least as strict as the terms set out in this clause 3.3 and to the extent required by State Privacy Laws, provide Seller notice of such engagement with further Service Providers and an opportunity to object;

3.3.7. Delete, return, or de-identify in accordance with State Privacy Laws Personal Data provided to Improve Digital by Seller, unless retention of the Personal Data is required by applicable law following the termination of the DPA and this Addendum.

3.3.8. Notify Seller if it makes a determination that it can no longer meet its obligations under State Privacy Laws; and

3.3.9. Provide any other information or attestation the Parties agree is reasonably necessary for Seller to verify that Improve Digital’s Processing is consistent with Seller’s obligations under State Privacy Laws.

4. Miscellaneous

4.1. If there is any inconsistency or conflict between this Addendum and the DPA, then this Addendum will overrule, regardless of whether any language in the DPA purports to state that the DPA is the controlling document. The provisions of this Addendum may not be amended, except by an agreement to specifically amend this Addendum in writing signed by the Parties.

4.2. This Addendum will survive any expiration or termination of the DPA.