Last Updated August 03, 2022
SmartyAds uses commercially reasonable efforts to provide participating advertisers, publishers and/or SSP/DSP platforms with a safe, transparent, and fair marketplace. Your use of Smartyads's advertising marketplace (known as Ad Exchange), Demand Side Platform or Supply Side Platform (hereinafter the " SmartyAds Ad Marketplace ") is governed by Your contract with SmartyAds, which requires compliance with this SmartyAds EU Data Processing Addendum (hereinafter the " DPA ") as it may be updated by SmartyAds from time to time. In case You are participating on the supply side (either publisher or SSP), please refer to the Publisher's part of this DPA; in case your participation refers to the demand side (an advertiser or DSP) please refer to the "Demand Partner Data Processing Addendum". The obligations set forth herein are the minimum standards for You wishing to participate in the SmartyAds Ad Marketplace.
SmartyAds may update this DPA at any time and without prior notice. All amendments will be posted to this website located at www.smartyads.com (hereinafter the " Site ") and will be effective when posted without any notice to You. By using the SmartyAds's Advertising Marketplace following such posting, You agree to any updated version of this DPA.
With respect to ensuring compliance with the foregoing, please note that SmartyAds reserves the right to suspend or remove sites, applications and/or advertisers/publishers, DSP and/or SSP platforms from the SmartyAds Ad Marketplace if it reasonably suspects or determines, in its sole discretion, that any of this SmartyAds EU Data Processing Addendum rules/policies have been violated.
This Publisher Data Processing Addendum (hereinafter the " DPA ") is entered into by and between SmartyAds Inc., a Delaware corporation located at 31 W 34th St Suite 8035 New York NY 10001-3009 (hereinafter the " SmartyAds ") and you (hereinafter the " Publisher " or " You "), supplements and forms part of SmartyAds Publisher's Agreement (hereinafter the " Principal Agreement ") or other written or electronic agreement, between SmartyAds and Publisher (or SSP or any other supply side partner) to reflect the parties' agreement with regard to the processing of personal data. This DPA is effective as of the date of SmartyAds Publisher's Agreement entered into (" Effective Date ").
The terms used in this DPA shall have the meanings set forth in this DPA. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Principal Agreement. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an addendum to the Principal Agreement.
IT IS AGREED:
" Controller " means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data;
" Processor " means a natural or legal person, public authority, agency or other body which processes the Personal Data on behalf of the Controller;
" Sub-processor " means any person appointed by or on behalf of SmartyAds to process the Personal Data on behalf of SmartyAds in connection with the Principal Agreement;
" Demand Partners " means SmartyAds' media buying clients, including but not limited to advertisers, demand side platforms, ad exchanges, agencies and ad networks;
" European Data Protection Law " means as applicable to a party in its Processing of Data: (i) Regulation 2016/679 (the European General Data Protection Regulation ("GDPR"); (ii) the EU e-Privacy Directive (Directive 2002/58/EC) ("e-Privacy Directive"); (iii) all national implementations of (i) and (ii); (iv) the Swiss Federal Data Protection Act of 19 June 1992 and its corresponding ordinances; and (v) in respect of the United Kingdom, the Data Protection Act 2018 and any applicable national legislation that replaces or converts the GDPR and e-Privacy Directive in domestic law or that relates to data and privacy and is enacted as a consequence of the United Kingdom leaving the European Union; in each case, as may be amended, superseded or replaced from time to time;
" Europe " means, for the purposes of this DPA, the European Economic Area (EEA), the United Kingdom, Iceland, Lichtenstein, Norway and Switzerland;
" Personal Data " means any information which are related to an identified or identifiable natural person to the extent that such information is protected as "personal data" under applicable European Data Protection Law;
" Privacy Requirements " means: (i) European Data Protection Law, as applicable to Publisher, SmartyAds, its Demand Partners, and their respective processing of Data under this DPA; and (ii) any applicable self-regulatory codes, rules or guidelines, including without limitation, the rules, codes and guidelines of the European Interactive Digital Advertising Alliance (EDAA), the Network Advertising Initiative (NAI), and IAB Transparency and Consent Framework (TCF) (in each case, as amended, superseded or replaced);
" Publisher Property " means the websites, mobile applications and/or other digital media properties owned or operated by the Publisher and accessible through the SmartyAds Services or via which the Personal Data used in connection with the SmartyAds Services is collected;
" SmartyAds Services " means SmartyAds' online advertising services, products, and features;
" SmartyAds Privacy Policy " means the SmartyAds privacy policy available at https://smartyads.com/privacy-policy (as updated or amended from time to time);
" Standard Contractual Clauses " means the standard contractual clauses for controllers (2004) as approved by the European Commission pursuant to the European Commission's decision C(2004) 5271 of 27 December 2004;
" New SCCs " means: the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council;
" Security Incident " means any event which resulted in, or which is successful had resulted in, the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Data (as defined in Section 2 herein) while in the control of the Demand Partner, its affiliates, agents, subcontractors, processors or sub-processors etc.
The terms " Commission ", " Member State ", " Personal Data Breach ", " Supervisory Authority ", " Data subject ", " personal data ", " processing " (and " process ") and " special categories of personal data " shall have the meanings given in Applicable Privacy Law.
Any other terms not stated herein shall have the meanings given to them in European Data Protection Law.
The parties agree that, unless otherwise agreed between the parties in connection with the SmartyAds Services, SmartyAds may receive from Publisher data (including Personal Data) about or related to end users of the Publisher Properties as more particularly described in Annex B of this DPA (collectively, " Data "). The parties agree that SmartyAds (and its Demand Partners) may process the Data for the purposes contemplated by the Principal Agreement.
The parties also agree that at the moment of the registration and/or signing of the Principal Agreement Publisher may provide data (including Personal Data) about or related to its personnel as more particularly described in Annex B of this DPA (hereinafter the " Publisher's Personnel Data ").
(a) Publisher agrees that it shall and shall ensure that its affiliates, agents, subcontractors, processors, sub-processors, buyers, partners, customers, clients, or any other third party using its SmartyAds Services (hereinafter the " Publisher's Third Parties ") only process and collect the Data solely for the purposes expressly permitted under the Principal Agreement and in a manner that complies with this DPA, the Applicable Privacy Laws, the Principal Agreement and where applicable, the Industry Rules (collectively and individually, the " Prescribed Purposes ").
(b) The parties acknowledge that Publisher is a controller of the Data and that SmartyAds will process the Data as a data processor, and strictly for the Prescribed Purposes. In no event will the parties process the Data jointly as joint controllers. The parties also acknowledge that only for the purposes of the processing of the Publisher's Personnel Data, SmartyAds will be considered as the Controller, and Publisher will act as the Controller SmartyAds hereby agrees that it will process and collect the Publisher's Personnel Data only in a manner that complies with the "Prescribed Purposes". The parties hereby agree that for the purposes of the processing of the Publisher's Personnel Data, the legal basis will be the Principal Agreement between the parties.
(c) Compliance with law: Each party shall be individually and separately responsible for complying with the obligations that apply to it under Applicable Privacy Law as per the designated roles. Without limitation to the foregoing, each party shall maintain a publicly accessible privacy policy on its website that satisfies the requirements of Applicable Privacy Law.
(d) Consent Signals: Publisher shall and shall ensure that the Publisher's Third Parties provide all "consent", "no consent" and "opt-out" signals to SmartyAds (or any of its clients or other sub-processors enabled by SmartyAds through the SmartyAds Services) in compliance with Applicable Privacy Laws and where applicable, the Industry Rules.
(e) Deletion: Publisher will not, and will not permit any third party, to retain the Data for longer than the period during which Publisher has a lawful basis to retain the Data for the Prescribed Purposes and in compliance with the Applicable Privacy Law.
Publisher hereby expressly agrees that both SmartyAds and any of its Demand Partners do not have direct relationship with any data subject visiting the Publisher Properties or viewing ads delivered to the Publisher Properties through the SmartyAds Services. Thus, in each case where consent is the lawful basis for processing the Personal Data pursuant to the Privacy Requirements, Publisher agrees that it shall be responsible for obtaining all necessary consents from the relevant data subjects on behalf of applicable Demand Partners (acting as the Data Controller) to lawfully permit SmartyAds and all applicable Demand Partners to collect, process and share Data via the SmartyAds Services for Prescribed Purposes and in connection with the performance of the SmartyAds Services. Publisher represents and warrants that it shall, at all times maintain and make operational on Publisher Properties a mechanism for obtaining and recording such consent and that enables such consent to be withdrawn, in accordance with applicable Privacy Requirements.
The parties hereby agree that for the purposes of the processing of the Publisher's Personnel Data, the legal basis will be the Principal Agreement between the parties.
Publisher agrees that it is responsible for ensuring that all data subjects are appropriately notified about the data collection and use practices on the Publisher Properties through the SmartyAds Services. Publisher represents and warrants that it shall prominently post, maintain and comply with a publicly available privacy notice regarding all Publisher Properties from which the Data is collected that satisfies the requirements of the Privacy Requirements and this DPA.
The before-mentioned notice shall at a minimum include the following information:
(I) a statement that data may be collected for advertising purposes;
(ii) a description of the type of the Personal Data collected by Publisher and/or its affiliates and the purposes of processing thereof, including for delivering ads across the Publisher Properties over time;
(iii) a description of the categories of individuals who will have access to the Personal Data;
(iv) the identity of the Controller(s) of the Data;
(v) a visible link to or description of how to access a relevant choice mechanism; and/or
(vi) all other information required to comply with Privacy Requirements.
Publisher shall not include or launch any Publisher Property on any of the SmartyAds Services if such Publisher Property is directed at or likely to be accessed by any data subject that is deemed to be a child under applicable Privacy Requirements of the country in which this child resides. Publisher shall flag within the SmartyAds Services or inform SmartyAds in writing prior to launching any of such Publisher Properties on any of the SmartyAds Services and/or pass to SmartyAds or its Demand Partners any Personal Data of any data subject that is deemed a child under applicable European Data Protection Law.
If Publisher is unable to comply with its consent and notice obligations under the Agreement (including this DPA) in respect of the Data, Publisher shall promptly notify SmartyAds.
The parties shall, on request, provide each other with all reasonable and timely assistance (at their own expense) and co-operation to enable the other party to comply with its obligations under the Privacy Requirements, including in order to enable the other party to respond to:
(I) any request from a data subject to exercise any of its rights under European Data Protection Law (including its rights of access, correction, objection, erasure and data portability, as applicable) in relation to the Data;
(ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data (hereinafter the "Correspondence").
Each party shall promptly inform the other if it receives any Correspondence directly from a data subject in relation to the Data. Subject to obligations of confidentiality and policies on disclosure of information, where a party has a concern that the other party has not complied with this DPA, the parties agree to share information in order to ascertain the cause of such non-compliance and take reasonable steps to correct.
Publisher shall notify SmartyAds without undue delay upon Publisher or any sub-processors becoming aware of a Personal Data Breach affecting Personal Data, providing SmartyAds with sufficient information to inform its sub-processors/Demand Partner; Publisher shall also inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
Such notification shall as a minimum:
(I) describe the nature of the Personal Data Breach, the categories and numbers of Data Subjects concerned, and the categories and numbers of Personal Data records concerned;
(ii) communicate the name and contact details of the Publisher's data protection officer or other relevant contact from whom more information may be obtained;
Publisher shall co-operate with SmartyAds and take such reasonable commercial steps as are directed by SmartyAds to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
(a) The Standard Contractual Clauses and Section 10 (b) of this DPA shall only apply where SmartyAds and Publisher entered into this DPA on or prior to September 27, 2021, and will apply through December 27, 2022, after which date the New SCCs and Section 10(c) will apply and the Standard Contractual Clauses will no longer apply. Where SmartyAds and Publisher enter into this DPA on or after September 27, 2021, the New SCCs and Section 10(c) shall apply. SmartyAds agrees to abide by and process Data in accordance with the Standard Contractual Clauses or the New SCCs, whichever apply as set forth in this Section 10(a) (collectively referred to as "Applicable SCCs"). The parties agree that the Applicable SCCs are hereby incorporated into and form an integral part of this DPA. The terms of the Standard Contractual Clauses and New SCCs (as applicable) will apply where and to the extent (i) the applicable transfer of Data is not subject to the laws of a jurisdiction recognized as providing an adequate level of protection for Personal Data (as described in applicable European Data Protection Law); or (ii) SmartyAds and the applicable transfer of Data is not covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection or appropriate safeguards for Personal Data.
(b) For the purposes of the Standard Contractual Clauses the parties agree:
(i) SmartyAds shall be deemed the "data importer" and Publisher shall be deemed the "data exporter"; (ii)Annex A of this DPA shall replace Appendix 1 of the Standard Contractual Clauses; and (iii) Annex B of this DPA shall replace Appendix 2 of the Standard Contractual Clauses;
(c) For the purposes of the New SCCs the parties agree:
(i) SmartyAds shall be deemed the "data importer" and Publisher shall be deemed the "data exporter"; (ii) Module 2 (Transfer controller to processor) will apply to the processing of the data submitted based on the Principal Agreement (Annex A 1); ; Module 1 (Transfer Controller to Controller) will apply to the processing of the Publisher's Personnel Data (Annex A 2) (iii) in Clause 7, the optional docking clause will apply; (iv) in Clause 17, Option 1 will apply, and the New SCCs will be governed by laws of Germany; (v) in Clause 18(b), disputes shall be resolved by the applicable courts located in Germany; (vi) Annex A (1) to this DPA shall replace Annex I of the New SCCs; and (vii) Annex B to this DPA shall replace Annex II of the New SCCs. It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses or New SCCs (as applicable). Accordingly, if and to the extent the Standard Contractual Clauses or the New SCCs conflict with any provision of the Agreement, including this DPA, the Standard Contractual Clauses or New SCCs (as applicable) shall prevail to the extent of such conflict.
Publisher shall inform SmartyAds the contact details of an individual authorized to respond to enquiries regarding the Data. Publishers hereby guarantees to deal with any and all enquiries regarding the Data promptly. The individual within SmartyAds authorized to respond from time to time to enquiries regarding the Data can be contacted via: dpo@smartyads.com
In the event that there is a change in the Privacy Requirements that apply to the processing of Data, that would, in the reasonable opinion of a party, require changes to the SmartyAds Services, the means by which the SmartyAds Services are provided or used and/or terms and conditions of this DPA, that party reserves the right (acting reasonably) to request such changes; provided that, to the extent possible, the party requesting the change will provide at least thirty (30) days prior written notice (where email will be sufficient) of such changes and agrees to discuss such changes in good faith. If the requested changes will cause a material harm to any party (which includes for the avoidance of doubt, causing a party to be in breach of European Protection Law) or materially alter any party's provision or use (as applicable) of the SmartyAds Services, such party may terminate the Agreement for the affected SmartyAds Services upon written notice without liability for such termination.
The parties hereby covenant and guarantee to implement appropriate technical and organizational security measures to protect the copy of the Data in their possession or control (i) from accidental or unlawful destruction, and (ii) loss, alteration, non-authorized disclosure or access to the Data.
(a) Subcontracting: Publisher may appoint third parties to process Data for the purposes expressly permitted under this DPA, provided that such third parties: (a) agree in writing to process Data in accordance with Publisher's documented instructions; (b) implement appropriate technical and organizational security measures that are at least as protective as those described in Annex C (where applicable) to protect the Data against a Security Incident; and (c) otherwise provide sufficient guarantees that they will process the Data in a manner that will meet the requirements of Applicable Privacy Law and this DPA.
(b) Security: Publisher shall implement appropriate technical and organizational security measures that are at least as protective as those described in Annex C (where applicable) to protect the Data from Security Incidents ("Security Measures"). Such Security Measures shall at a minimum comply with the requirements of Applicable Privacy Laws. In the event that Publisher suffers a Security Incident, it shall notify SmartyAds without undue delay and both parties shall cooperate in good faith to agree and action such measures as may be necessary to mitigate or remedy the effects of the Security Incident.
(c) International transfers: Where European Data Protection Law applies to the Data, Publisher shall not process any such Data (nor permit any Data to be processed) in a territory outside of Europe (whether directly or via onward transfer) unless it has taken such measures as are necessary to ensure the transfer is in compliance with European Data Protection Law (including such measures as may be communicated by SmartyAds to Publisher from time to time) and this DPA.
(d) Transfer arrangements: To the extent that SmartyAds adopts a data export mechanism not described in this DPA (including any new version of or successor to the Model Clauses pursuant to applicable European Data Protection Law) for the transfer of Data (" Alternative Transfer Mechanism "), such Alternative Transfer Mechanism shall apply instead of any mechanism described in this DPA. Notwithstanding anything to the contrary, an Alternative Transfer Mechanism shall only apply to the extent that it complies with Applicable Privacy Law applicable to the country where the processing activities take place. Publisher agrees to execute any document and take any appropriate action as reasonably necessary to give effect to such Alternative Transfer Mechanism.
(e) Cooperation and data subject rights: In the event that either party receives (i) any request from a data subject to exercise any of its rights under Applicable Privacy Law (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, inquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data (collectively, the " Correspondence ") then, where such Correspondence relates to processing conducted by the other party, it shall promptly inform the other party and the parties shall cooperate in good faith as necessary to respond to such Correspondence and fulfil their respective obligations under Applicable Privacy Law.
(f) Change in Law: Notwithstanding anything to the contrary in the Principal Agreement or this DPA, in the event of a change in Applicable Privacy Law or a determination or order from a supervisory authority or competent court affecting this DPA or any processing activities under this DPA, SmartyAds may, in its sole discretion, amend this DPA as reasonably necessary to ensure continued compliance with Applicable Privacy Law or compliance with any such orders.
(g) Survival: This DPA shall survive termination or expiry of the Principal Agreement. Upon termination or expiry of the Principal Agreement, Publisher may continue to process the Data provided that such processing complies with the requirements of this DPA and Applicable Privacy Law.
(h) Miscellaneous: This DPA shall be governed by and construed in all respects in accordance with the governing law and jurisdiction provisions set out in the Principal Agreement, unless required otherwise by Applicable Privacy Laws. With effect from the effective date of the Principal Agreement, this DPA shall be deemed a part of and incorporated into the Principal Agreement so that references in the Principal Agreement to the "Agreement" shall be interpreted to include this DPA. Except for the changes made by this DPA, the Principal Agreement shall remain unchanged and in full force and effect. In the event of any conflict or inconsistency between this DPA and any other term or terms of the Principal Agreement, this DPA shall prevail in respect of the subject (i.e. the protection of personal data).
Defined terms are as set out in the Publisher Data Processing Addendum agreed between the parties.
Categories of Data Subjects whose Personal Data is transferred:
§ End users of the Publisher Properties or end users viewing ads delivered to the Publisher Properties;
§ Publisher Personnel;
Categories of Personal Data transferred:
End users:
§ Identifiers: Identifier for Advertising (IFA; IDFA; GAID); User ID; Buyer ID; Device ID, IP address
§ Demographic information: location, year of birth, gender
Publisher Personnel:
§ Contact details (first name, last name, email, country (region), address, telephone, Skype)
§ Bank details
§ Tax number
Recipients:
Sub-contractors, supervisory authority
Sensitive data transferred (if applicable):
None.
Frequency of the transfer:
End Users – Continuous
Publisher Personnel – Only at the moment of registration and when required to update the information.
Nature of the Processing: The provision of the SmartyAds Services.
Purpose(s) of the data transfer and further processing:
End Users: For the Prescribed Purposes (as defined in this DPA)
Publisher Personnel: For business relationship and account management purposes.
Period for which Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:
Personal Data will be retained in accordance with the SmartyAds Privacy Policy
Contact points for data protection enquiries:
Data Importer: See Annex A
Data Exporter: See Annex A
Competent Supervisory Authority
The competent supervisory authority, in accordance with Clause 13 of the EU SCCs will be, for Data protected by the EU GDPR, the EU supervisory authority determined to be appropriate in the event that a relevant situation arises, and for Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner ("FDPIC"). With respect to UK Data, the competent supervisory authority is the Information Commissioners Office (the " ICO ").
| Type of measure | Terms |
|---|---|
|
Measures for ensuring confidentiality |
SmartyAds has implemented measures to ensure the integrity, availability and security of personal information, including vulnerability scans |
|
Measures for ensuring ongoing availability and adaptability of services |
SmartyAds maintains personal data availability through a variety of technical, physical, and administrative measures. Examples of these measures include: secured and monitored operational sites; processes and policies for topics such as incident response and review, and vendor review |
|
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident |
Further measures include regular backups and disaster recovery plans |
|
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing |
At least once a year, security measures relevant to the processing of personal data are reviewed and tested for alignment with industry good practices |
|
Measures for user identification and authorisation |
SmartyAds has in place procedures that comply with applicable law to authenticate requests from data subjects who have submitted rights request SmartyAds has operational and technical controls in place to ensure that access to systems that process personal data is only granted to authorized personnel with a "need to know" |
|
Measures for the protection of Data during storage |
SmartyAds does not process any sensitive personal information, personal data processing is limited in scope and cannot be directly identified with a natural person by SmartyAds Data is only stored for as long as necessary for legitimate business purposes |
|
Measures for ensuring physical security of locations at which personal data are processed |
Facilities involved in the processing of data are accessible only by authorized personnel. Technical controls in place to secure processing facilities include access controls, firewalls and anti-malware. Personal data can only be accessed by personnel who have a need-to-know and whose access to such information is required in order to deliver services under the Principle Agreement SmartyAds provides personnel who access personal data with appropriate information security and data protection training |
|
Measures for certification/assurance of processes and products |
SmartyAds participates in industry certification and self-regulatory program IAB TCF 2.2. |
|
Measures for allowing data portability and ensuring erasure |
SmartyAds has implemented and maintains procedures to ensure data portability and erasure that comply with data protection laws. |
This Demand Partner Data Processing Addendum (hereinafter the " DPA ") is entered into by and between SmartyAds Inc., a Delaware corporation located at 31 W 34th St Suite 8035 New York NY 10001-3009 (hereinafter the "SmartyAds") and you (hereinafter the " Demand Partner " or " You "), supplements and forms part of the Principal Agreement or any other written or electronic agreement referencing to this DPA between SmartyAds and Advertiser (or DSP or any other demand side partner) to reflect the parties' agreement with regard to the processing of personal data. SmartyAds and Demand Partner have entered into a master contract, or other such governing contract, together with one or more connected statements of work, purchase orders, contracts and/or agreements (collectively the "Principal Agreement"), under which Demand Partner may purchase digital advertising inventory via SmartyAds's services (the " SmartyAds Services "). This DPA is effective as of the date of the Principal Agreement entered into (hereinafter the " Effective Date "). Capitalized terms used in this DPA shall have the meanings given to them in the main body of the Principal Agreement unless otherwise defined in this DPA. SmartyAds is a provider of a technology platform which engages in the provision of auction of purchases of digital advertising inventory. Demand Partner is an advertiser, agency, demand-side platform or ad network which uses SmartyAds's technology platform or similar technology to engage in the buying of digital advertising inventory. The parties have entered into this DPA to ensure that in sharing such personal data pursuant to the Principal Agreement, they both comply with Applicable Privacy Law, with full respect for the fundamental data protection rights of the data subjects whose personal data will be processed.
IT IS AGREED:
" Controller " means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data
" Processor " means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
" Sub-processor " means any person appointed by or on behalf of Demand Partner to process Personal Data on behalf of Demand Partner in connection with the Principal Agreement; and
" Applicable Privacy Law " means any and all applicable privacy and data protection laws including, where applicable, European Data Protection Law (as may be amended or superseded from time to time);
" European Data Protection Law " means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the " EU GDPR "); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (collectively the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii); in each case as may be amended or superseded from time to time;
" Europe " means, for the purposes of this DPA, the European Economic Area (EEA), the United Kingdom and Switzerland;
" Industry Rules " means the Transparency and Consent Framework developed by the IAB Europe, its policies, its global vendor list and specifications and/or any other mutually agreed upon industry protocols;
" Model Clauses " means the Standard Contractual Clauses;
" Standard Contractual Clauses " means the standard contractual clauses for controllers (2004) as approved by the European Commission pursuant to the European Commission's decision C(2004) 5271 of 27 December 2004;
" New SCCs " means: the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council;
" Security Incident " means any event which resulted in, or which is successful had resulted in, the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Data (as defined in Section 2 herein) while in the control of the Demand Partner, its affiliates, agents, subcontractors, processors or sub-processors etc;
" Standard Contractual Clauses " means: (i) the standard contractual clauses and its appendices in European Commission Implementing Decision (EU) 2021/91 of 4 June 2021 relating to transfers of personal data to third countries pursuant to Regulation (EU) 2017/679 and any successor clauses issued from time to time by the European Commission, any applicable data protection authority, or other body with competent authority and jurisdiction, in each case, in relation thereto (the " EU SCCs ") and (ii) standard data protection clauses specified in regulations made by the Secretary of State under section 17C(b) of the 2018 Data Protection Act and for the time being in force in the United Kingdom (the " UK SCCs ");
The terms " Commission ", " Member State ", " Personal Data Breach ", " Supervisory Authority ", " Data subject ", " personal data ", " processing " (and " process ") and " special categories of personal data " shall have the meanings given in Applicable Privacy Law.
The parties agree that unless otherwise agreed between the parties, based on the Principal Agreement signed between the parties SmartyAds will submit to Demand Partner the SmartyAds Services and/or Demand Partner may otherwise collect or receive certain data, including (but not limited to) in bid requests submitted to Demand Partner. Demand Partner acknowledges that such data (as described in the Principal Agreement) may contain personal data, as more particularly described in Annex A (collectively, the " Data ").
The parties also agree that at the moment of the registration and/or signing of the Principal Agreement Demand Partner may provide data (including Personal Data) about or related to its personnel as more particularly described in Annex B of this DPA (hereinafter the " Demand Partner's Personnel Data ").
a. Demand Partner agrees that it shall and shall ensure that its affiliates, agents, subcontractors, processors, sub-processors, buyers, partners, customers, clients, or any other third party using its SmartyAds Services (hereinafter the " Demand Third Parties ") only process and collect the Data solely for the purposes expressly permitted under the Principal Agreement and in a manner that complies with this DPA, the Applicable Privacy Laws, the Principal Agreement and where applicable, the Industry Rules (collectively and individually, the " Prescribed Purposes ").
b. The parties acknowledge that Demand Partner is a controller of the Data and that SmartyAds will process the Data as a data processor, and strictly for the Prescribed Purposes. In no event will the parties process the Data jointly as joint controllers. The parties also acknowledge that only for the purposes of the processing of the Demand Partner's Personnel Data, SmartyAds will be considered as the Controller, and Demand Partner will act as the Controller. SmartyAds hereby agrees that it will process and collect the Demand Partner's Personnel Data only in a manner that complies with the "Prescribed Purposes". The parties hereby agree that for the purposes of the processing of the Demand Partner's Personnel Data, the legal basis will be the Principal Agreement between the parties.
c. Compliance with law: Each party shall be individually and separately responsible for complying with the obligations that apply to it under Applicable Privacy Law as per the designated roles. Without limitation to the foregoing, each party shall maintain a publicly accessible privacy policy on its website that satisfies the requirements of Applicable Privacy Law.
d. Consent Signals: Demand Partner shall and shall ensure that the Demand Third Parties honor all "consent", "no consent" and "opt-out" signals received from SmartyAds (or any of its publisher clients or other sub-processors enabled by SmartyAds through the SmartyAds Services) in compliance with Applicable Privacy Laws and where applicable, the Industry Rules.
e. Deletion: Demand Partner will not, and will not permit any third party, to retain the Data for longer than the period during which the Demand Partner has a lawful basis to retain the Data for the Prescribed Purposes and in compliance with the Applicable Privacy Law.
Demand Partner shall notify SmartyAds without undue delay upon Demand Partner or any subcontractors becoming aware of a Personal Data Breach affecting Personal Data, providing SmartyAds with sufficient information to inform its sub-processors; Demand Partner shall also inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
Such notification shall as a minimum:
(i) describe the nature of the Personal Data Breach, the categories and numbers of Data Subjects concerned, and the categories and numbers of Personal Data records concerned;
(ii) communicate the name and contact details of the Demand Partner's data protection officer or other relevant contact from whom more information may be obtained;
Demand Partner shall co-operate with SmartyAds and take such reasonable commercial steps as are directed by SmartyAds to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
(a) The Standard Contractual Clauses and Section 5(b) of this DPA shall only apply where SmartyAds and Demand Partner entered into this DPA on or prior to September 27, 2021, and will apply through December 27, 2022, after which date the New SCCs and Section 5(c) will apply and the Standard Contractual Clauses will no longer apply. Where SmartyAds and Demand Partner enter into this DPA on or after September 27, 2021, the New SCCs and Section 5(c) shall apply. SmartyAds agrees to abide by and process Data in accordance with the Standard Contractual Clauses or the New SCCs, whichever apply as set forth in this Section 5(a) (collectively referred to as "Applicable SCCs"). The parties agree that the Applicable SCCs are hereby incorporated into and form an integral part of this DPA. The terms of the Standard Contractual Clauses and New SCCs (as applicable) will apply where and to the extent (i) the applicable transfer of Data is not subject to the laws of a jurisdiction recognized as providing an adequate level of protection for Personal Data (as described in applicable European Data Protection Law); or (ii) SmartyAds and the applicable transfer of Data is not covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection or appropriate safeguards for Personal Data.
(b) For the purposes of the Standard Contractual Clauses the parties agree, (i) SmartyAds shall be deemed the "data exporter" and Demand Partner shall be deemed the "data importer"; (ii) Annex A of this DPA shall replace Appendix 1 of the Standard Contractual Clauses; and (iii) Annex B of this DPA shall replace Appendix 2 of the Standard Contractual Clauses;
(c) For the purposes of the New SCCs the parties agree, (i) SmartyAds shall be deemed the "data exporter" and Demand Partner shall be deemed the "data importer"; (ii) Module 4 (Transfer processor to controller) will apply to the processing of the data submitted based on the Principal Agreement (Annex A 1); Module 1 (Transfer Controller to Controller) will apply to the processing of the Demand Partner's Personnel Data (Annex A 2); (iii) in Clause 7, the optional docking clause will apply; (iv) in Clause 17, Option 1 will apply, and the New SCCs will be governed by laws of Germany; (v) in Clause 18(b), disputes shall be resolved by the applicable courts located in Germany; (vi) Annex A to this DPA shall replace Annex I of the New SCCs; and (vii) Annex B to this DPA shall replace Annex II of the New SCCs. It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses or New SCCs (as applicable). Accordingly, if and to the extent the Standard Contractual Clauses or the New SCCs conflict with any provision of the Agreement, including this DPA, the Standard Contractual Clauses or New SCCs (as applicable) shall prevail to the extent of such conflict.
(a) Subcontracting: Demand Partner may appoint third parties to process Data for the purposes expressly permitted under this DPA, provided that such third parties: (a) agree in writing to process Data in accordance with Demand Partner's documented instructions; (b) implement appropriate technical and organizational security measures that are at least as protective as those described in Annex C (where applicable) to protect the Data against a Security Incident; and (c) otherwise provide sufficient guarantees that they will process the Data in a manner that will meet the requirements of Applicable Privacy Law and this DPA.
(b) Security: Demand Partner shall implement appropriate technical and organizational security measures that are at least as protective as those described in Annex C (where applicable) to protect the Data from Security Incidents ("Security Measures"). Such Security Measures shall at a minimum comply with the requirements of Applicable Privacy Laws. In the event that Demand Partner suffers a Security Incident, it shall notify SmartyAds without undue delay and both parties shall cooperate in good faith to agree and action such measures as may be necessary to mitigate or remedy the effects of the Security Incident.
(c) International transfers: Where European Data Protection Law applies to the Data, the Demand Partner shall not process any such Data (nor permit any Data to be processed) in a territory outside of Europe (whether directly or via onward transfer) unless it has taken such measures as are necessary to ensure the transfer is in compliance with European Data Protection Law (including such measures as may be communicated by SmartyAds to Demand Partner from time to time) and this DPA.
(d) Transfer arrangements: To the extent that SmartyAds adopts a data export mechanism not described in this DPA (including any new version of or successor to the Model Clauses pursuant to applicable European Data Protection Law) for the transfer of Data (" Alternative Transfer Mechanism "), such Alternative Transfer Mechanism shall apply instead of any mechanism described in this DPA. Notwithstanding anything to the contrary, an Alternative Transfer Mechanism shall only apply to the extent that it complies with Applicable Privacy Law applicable to the country where the processing activities take place. Demand Partner agrees to execute any document and take any appropriate action as reasonably necessary to give effect to such Alternative Transfer Mechanism.
(e) Cooperation and data subject rights: In the event that either party receives: (i) any request from a data subject to exercise any of its rights under Applicable Privacy Law (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, inquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data (collectively, the " Correspondence ") then, where such Correspondence relates to processing conducted by the other party, it shall promptly inform the other party and the parties shall cooperate in good faith as necessary to respond to such Correspondence and fulfil their respective obligations under Applicable Privacy Law.
(f) Change in Law: Notwithstanding anything to the contrary in the Principal Agreement or this DPA, in the event of a change in Applicable Privacy Law or a determination or order from a supervisory authority or competent court affecting this DPA or any processing activities under this DPA, SmartyAds may, in its sole discretion, amend this DPA as reasonably necessary to ensure continued compliance with Applicable Privacy Law or compliance with any such orders.
(g) Survival: This DPA shall survive termination or expiry of the Principal Agreement. Upon termination or expiry of the Principal Agreement, Demand Partner may continue to process the Data provided that such processing complies with the requirements of this DPA and Applicable Privacy Law.
(h) Miscellaneous: This DPA shall be governed by and construed in all respects in accordance with the governing law and jurisdiction provisions set out in the Principal Agreement, unless required otherwise by Applicable Privacy Laws. With effect from the effective date of the Principal Agreement, this DPA shall be deemed a part of and incorporated into the Principal Agreement so that references in the Principal Agreement to the "Agreement" shall be interpreted to include this DPA. Except for the changes made by this DPA, the Principal Agreement shall remain unchanged and in full force and effect. In the event of any conflict or inconsistency between this DPA and any other term or terms of the Principal Agreement, this DPA shall prevail in respect of the subject (i.e. the protection of personal data).
Defined terms are as set out in the Demand Partner Data Processing Addendum agreed between the parties
Categories of Data Subjects whose Personal Data is transferred:
§ End users, submitted to Demand Partner via the SmartyAds Services
§ Demand Partner's Personnel
Categories of Personal Data transferred:
End users:
§ Identifiers: Identifier for Advertising (IFA; IDFA; GAID); User ID; Buyer ID; Device ID, IP address
§ Demographic information: location, year of birth, gender
Demand Partner's Personnel:
§ Contact details (first name, last name, email, country (region), address, telephone and Skype)
Recipients: sub-contractors, supervisory authority
Sensitive data transferred (if applicable): None.
Frequency of the transfer:
End Users – Continuous
Demand Partner's Personnel – Only at the moment of registration and when required to update the information.
Nature of the Processing: Personal data transferred will be processed in accordance with the Principal Agreement (including this DPA) and may be subject to the following processing activities:
1. Storage and other processing necessary to provide the SmartyAds Services to the Data Importer
2. Disclosures in accordance with the Principal Agreement and/or as required by applicable laws
Purpose(s) of the data transfer and further processing:
End Users: To enable Data Importer to process the Data solely for purposes expressly permitted under the Principal Agreement and in a manner that complies with the European Data Protection Law (the "Prescribed Purposes")
Demand Partner's Personnel: For business relationship and account management purposes.
Period for which Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:
Data Importer will not, and will not permit any third party, to retain the Data for longer than the period during which the Data Importer has a lawful basis to retain the Data for the Prescribed Purposes and in compliance with the European Data Protection Law.
Contact points for data protection enquiries:
Data Exporter: See Annex A
Data Importer: See Annex A/Principal Agreement
Competent Supervisory Authority
The competent supervisory authority, in accordance with Clause 13 of the EU SCCs will be, for Data protected by the EU GDPR, the EU supervisory authority determined to be appropriate in the event that a relevant situation arises, and for Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner ("FDPIC"). With respect to UK Data, the competent supervisory authority is the Information Commissioners Office (the " ICO ").
The technical and organizational security measures implemented by Demand Partner to ensure an appropriate level of security taking into account the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons, are as follows:
| Type of measure | Terms |
|---|---|
| Measures for ensuring confidentiality | Demand Partner has implemented measures to ensure the integrity, availability and security of personal information, including vulnerability scans. |
|
Measures for ensuring ongoing availability and adaptability of services |
Demand Partner maintains personal data availability and resilience through a variety of technical, physical, and administrative measures. Examples of these measures include: secured and monitored operational sites; processes and policies for topics such as incident response and review, and vendor review |
|
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident |
Further measures include regular backups and disaster recovery plans |
|
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational security measures in order to ensure the security of the processing |
At least once annually, security measures relevant to the processing of personal data are reviewed and tested for alignment with industry good practices |
|
Measures for user identification and authorization |
Demand Partner has in place procedures that comply with applicable law to authenticate requests from data subjects who have submitted rights request. Demand Partner has operational and technical controls in place to ensure that access to systems that process personal data is only granted to authorized employees with a "need to know". |
|
Measures for the protection of Data during storage |
As per the Principal Agreement, personal data processed in connection with the services will not contain any sensitive personal information, and will be limited in scope and cannot be directly identified with a natural person by Demand Partner. Data is only stored for as long as necessary for legitimate business purposes. |
|
Measures for ensuring physical security of locations at which personal data are processed |
Facilities involved in the processing of personal data are accessible only by authorized personnel. Technical controls in place to secure processing facilities include access controls, two-factor authentication, firewalls, and anti-malware. Personal data can only be accessed by personnel who have a need-to-know and whose access to such information is required in order to deliver advertising services under the Agreement. Demand Partner provides personnel who access personal data with appropriate information security and data protection training. |
|
Measures for certification/assurance of processes and products |
Demand Partner participates in industry certification and self-regulatory programs such as IAB TCF 2.2 |
|
Measures for ensuring accountability |
Demand Partner has implemented a privacy program that is appropriate to the scope and nature of personal data processed that includes at least a personal data breach policy and appointment of a data protection officer (DPO). The foregoing measures are regularly reviewed (at least once a year) and updated to ensure alignment with applicable law and industry standards. |
|
Measures for allowing data portability and ensuring erasure |
Demand Partner has implemented and maintains procedures to ensure data portability and erasure that comply with data protection laws. |
