These Terms and Conditions (“Terms”) are a legally binding and enforceable agreement between AdAction Interactive LLC (“AdAction”) and you (“Advertiser”), whereby Advertiser may obtain access to AdAction’s network of third-party publishers and other media partners, including rewarded and performance-based distribution channels (collectively, “Publishers”), and related technology and software, to market customized advertisements and links provided by Advertiser and/or AdAction (“Ads” as further defined below). AdAction, as well as the services provided by AdAction in connection therewith (“Services”), are subject to an Insertion Order (“IO”) incorporated herein by reference (the IO, together with these Terms, the “Agreement”). In any instance where Advertiser is an Agency entering into the Agreement on behalf of a client, any reference to “Advertiser” shall refer jointly to the Agency as well as the applicable underlying client.

1.   AdAction Services

AdAction provides a performance-based and rewarded user acquisition platform that enables Advertiser to promote its applications, products, or services to end users through AdAction’s network of third-party publishers and media partners (“Publishers”), primarily within mobile applications and related digital environments.

Through the AdAction platform, Advertiser campaigns are made available to end users via Publisher integrations, including offer wall placements and other rewarded, user-initiated, action-based experiences. End users may complete defined actions (“Actions”), such as installing an application, registering for a service, or completing specified in-app events, in order to qualify for rewards offered by the Publisher. AdAction does not guarantee any minimum number of impressions, clicks, Actions, conversions, or user outcomes. All user activity is subject to validation, tracking, and fraud prevention controls.

1. Reward Model and Incentivized Traffic

Advertiser acknowledges that certain traffic sources within the AdAction network may include incentivized user experiences, where end users are offered rewards by Publishers in exchange for completing defined actions. Advertiser agrees that incentivized traffic may exhibit different engagement characteristics than non-incentivized traffic and that such differences shall not, in and of themselves, constitute invalid or fraudulent traffic where campaign requirements are otherwise satisfied.

2.   Account

Upon the execution of the Agreement, Advertiser may register on the AdAction website and create a unique, password-protected account (“Account”). Advertiser will be responsible for safeguarding and maintaining the confidentiality of its Account and associated password. Advertiser shall remain fully and solely responsible for any and all actions taken under Advertiser’s Account, whether authorized by Advertiser or not. Advertiser must immediately notify AdAction of any unauthorized use of Advertiser’s Account. Advertiser is responsible for keeping its Account information current, complete and accurate, and Advertiser acknowledges and agrees that AdAction will have no responsibility or liability, directly or indirectly, for failure to deliver notices as a result of inaccurate Account information.

3.   Ads

Advertiser shall ensure that all promoted apps, services, and user flows comply with applicable platform policies, including Apple App Store and Google Play requirements. Advertiser shall develop all aspects of the Advertiser Ads, other than where the parties agree that AdAction shall assist in the development of Ads. The parties understand and agree that Advertiser is the sole owner of any and all intellectual property rights associated with any Advertiser Ads; other than those portions that AdAction prepares on Advertiser’s behalf (such portions hereinafter referred to as, the “AdAction Ads” and together with the Advertiser Ads, the “Ads”). The parties understand and agree that AdAction is the sole owner of any and all intellectual property rights associated with the AdAction Ads, other than Advertiser’s trademarks, logos, copyrights and other pre-existing Advertiser intellectual property incorporated in the AdAction Ads. Under no circumstances shall AdAction be authorized to use the Ads other than in connection with Advertiser’s Ad Campaigns as set forth in the IO(s).

AdAction reserves the right, in its sole discretion and without liability, to: change any of its Ad Guidelines set forth herein at any time; and to reject, omit, exclude or terminate any Ad for any reason at any time, with subsequent notice to the Advertiser, whether or not such Ad was previously acknowledged, accepted or published by AdAction. Such reasons for rejection, omission or exclusion of Ads include, but are not limited to, where AdAction deems, in its sole discretion, that the Ads, including the applicable products and/or services promoted by such Ads (“Advertiser Products”), and any website or app linked to from such Ads, are in violation of any applicable law, rule, regulation or other judicial or administrative order or where the content thereof may tend to bring disparagement, ridicule or scorn upon AdAction or any of its Publishers. Advertiser reserves the right to reject, omit, exclude, terminate or request a change to the Ads at any time and AdAction shall, subject to the provisions set forth herein, comply with such request as soon as practical but in no event later than three (3) business days after its receipt thereof. Advertiser may cancel or suspend an Ad Campaign, or an Ad associated with such Ad Campaign, effective within forty-eight (48) hours of AdAction’s receipt of Advertiser’s cancellation notice in writing.

Advertiser guarantees that all advertisement material, links, descriptions, landing pages or related content associated to the Ads provided to AdAction and shown to end users during fulfillment of AdAction Services will only ever contain Ad Campaigns agreed upon in the applicable IO. Advertiser is forbidden from changing the landing page, content, available offer or any other significant part of the Ad Campaign listed on the applicable IO. If Advertiser is found to be engaging in such practices, or making material changes to Ad Campaigns without sufficient prior written notice to AdAction, AdAction can, in its sole discretion, find Advertiser to be in material breach of the applicable IO and these Terms and seek reasonable damages.

Advertiser shall not design or provide Ads, landing pages, or Ad Campaigns that are misleading, deceptive, or inconsistent with the actual user experience, including any mismatch between advertised actions and required completion steps. Advertiser further guarantees that all advertisements, websites, Ad Campaigns, links, landing pages and/or related material or content comply with all applicable laws and regulations (including all laws respecting intellectual property rights) and, in any event, shall not include the following (“Ad Guidelines”):

1. Pornographic material, including any material appealing to the prurient interests;
2. Racial, ethnic, political, hate-mongering or otherwise objectionable content;
3. Investment, money-making opportunities or advice not permitted under law;
4. Gratuitous violence or profanity;
5. Material that defames, misrepresents, abuses, or threatens physical harm to others;
6. Promotion of illegal substances or activities such as illegal online gambling, how to build a bomb, counterfeiting money, etc;
7. Software pirating;
8. Obscenity and any spoofing, redirecting, or trafficking from adult-related websites in an effort to gain traffic;
9. Infringement or violations of the patents, copyrights, trademarks, rights of publicity, rights of privacy, moral rights, music performance or other music-related rights, or any other right of any third party; and
10. Any illegal activity whatsoever.

4.   Placement

The positioning, placement, frequency and other editorial decisions related to Ads shall be made by AdAction and/or its Publishers, as applicable, in their respective sole discretion. The applicable IO may set forth the particular place(s) where Ads may appear and/or be distributed. Advertiser agrees that in a case where no points of placement or distributions are set forth in the applicable IO or, in cases where “Run of Network” or similar designation is specified in the applicable IO, the Ads may appear at any point of placement and/or distribution that AdAction and/or its Publishers may determine, in their respective sole discretion.

5.   Tracking Technology

Unless otherwise stated in writing by AdAction, each Ad used by AdAction in connection with an Ad Campaign must include, in unaltered form, the special transaction tracking links, postback integrations, or other attribution mechanisms (collectively, “Tracking Technology”). Advertiser agrees to implement and maintain all Tracking Technology in accordance with AdAction’s technical specifications and industry best practices, including proper configuration of MMP attribution settings, postbacks, and event mapping where applicable. Advertiser shall not modify, interfere with, disable, or otherwise circumvent any Tracking Technology or related systems used to measure impressions, clicks, installs, or other Actions.

Advertiser acknowledges that accurate tracking and attribution depend on proper implementation of Tracking Technology and external factors including user device settings, platform restrictions, and third-party technologies. Where an MMP is used, Advertiser agrees that attribution and reporting shall be based on mutually agreed-upon attribution settings (including attribution windows and event definitions) established prior to campaign launch.

In the event of discrepancies between AdAction reporting and Advertiser or MMP reporting, the parties shall work in good faith to reconcile such differences. Unless otherwise stated in the applicable IO, Advertiser’s designated MMP reporting shall be the source of record for billable Actions. If Advertiser fails to properly implement, maintain, or make available agreed Tracking Technology, materially changes agreed attribution settings without notice, or otherwise causes a material tracking failure, the parties shall work in good faith to determine the affected billable Actions using available reliable data, including AdAction reporting, historical performance data, or applicable third-party data. AdAction shall not be responsible for discrepancies caused by external factors or Advertiser-side configurations.

6.   Platform and User Experience Compliance

Advertiser agrees that all Ad Campaigns, Ads, and related user experiences must comply with applicable platform policies, including but not limited to Apple App Store Review Guidelines and Google Play Developer Policies.

Advertiser further acknowledges that user-facing disclosures regarding rewards, eligibility requirements, and tracking dependencies are implemented at the Publisher level and are necessary for compliance and transparency.

7.   Sponsored Content, Content-Based sites and Content-Based Advertising

AdAction offers Advertisers the opportunity to advertise on our owned and operated content marketing sites, where the Advertiser’s product is relevant to the audience and topic of the site. AdAction will place Advertiser’s creative (if provided) and provided tracking links. AdAction will determine in its sole discretion the appropriate placement of such ad. Per these Terms, Advertiser will be responsible for all valid conversions, as defined by the applicable IO.

If Advertiser purchases sponsored content placements, the price and content shall be determined between parties and outlined on the applicable IO. AdAction reserves all rights of final approval and refusal for any content to be placed on any AdAction site, or related property. Advertiser may not present the content on any AdAction site or property to any other party in any way that is misleading as to the sponsored nature of the content.

All advertising, sponsored content or otherwise, must follow the requirements of Section 3 of these Terms. All claims made must be verifiable, truthful and accurate. AdAction reserves the right to remove any content at any time with no warning to Advertiser.

8.   Payments

The fees for Actions shall be set forth in the applicable IO(s). Subject to Section 9 below, payment of fees for Valid Actions shall be unconditional and shall be paid regardless of whether Advertiser actually collected funds from its applicable advertisers (if applicable). Unless otherwise stated in the applicable IO, Advertiser’s designated MMP reporting shall be the source of record for billable Actions.

AdAction will use commercially reasonable efforts to comply with campaign budgets communicated by Advertiser. Advertiser shall remain responsible for Valid Actions delivered up to one hundred ten percent (110%) of the applicable campaign budget. Actions delivered in excess of 110% of the applicable campaign budget shall require Advertiser’s approval to be billable.

AdAction will invoice Advertiser periodically in accordance with its standard billing practices or as otherwise set forth in the applicable IO.  Unless otherwise set forth in the applicable IO, payment will be due to AdAction within thirty (30) days of the date of invoice. If payment is not made in a timely manner, AdAction may, at its option, immediately terminate the Agreement and/or any applicable IO(s). Interest will accrue on any past due amounts at the rate equal to the lesser of one and one-half percent (1.5%) per month or the maximum amount permitted by law. In addition, Advertiser shall be liable to AdAction for all attorneys’ fees and other costs of collection incurred in collecting such unpaid amounts. Advertiser agrees and acknowledges that it shall be fully responsible for any and all taxes, whether state or local, and related fees, costs and penalties incurred by AdAction and/or any of its Publishers.

Prior to initiating the applicable Ad Campaign, as deemed necessary by AdAction, Advertiser may be required to pay AdAction advance payment set forth in the IO. Any fees payable to AdAction according to the IO shall be deducted from the Advance Payment. After the Advance Payment is fully exhausted, and as a condition for continuing the Ad Campaign, the Advertiser shall pay AdAction additional Advance Payment. In the event of cancellation of an IO, AdAction shall refund any unused balance of the Advance Payment to Advertiser within thirty (30) days after cancellation.

Subject to Section 9 below, AdAction reserves the right to invoice Advertiser for Actions AdAction believes to be Valid Actions.

9.   Leads and CPA-Based Ad Campaigns

In connection with Leads and CPA-based Ad Campaigns, Advertiser will pay AdAction for all Valid Actions generated. Advertiser may dispute Actions that it reasonably believes are invalid or fraudulent by providing written notice no later than thirty (30) days following the end of the calendar month in which the applicable Actions occurred, together with reasonable supporting information sufficient to identify the disputed Actions and the basis for rejection. Except in the case of manifest error or fraud that could not reasonably have been identified during such period, Actions not disputed within that period shall be deemed Valid Actions and final for billing purposes. A “Valid Action” means an Action for which:

1. the Ad Campaign requirements were satisfied by an individual, real person and not by a robot, spider, computer script, or other automated, artificial, or fraudulent method;
2. the Ad Campaign requirements were not fulfilled using fake or stolen payment credentials or other fraudulent means;
3. the Ad Campaign requirements were not satisfied through IP-based, location-based, or other material fraud;
4. in the case of CPA-based campaigns involving a sale, the applicable sale is not fraudulent, cancelled, charged back, or otherwise nullified; and
5. in the case of Leads-based campaigns, an individual person submitted information meeting Advertiser’s criteria set forth in the applicable IO.

Advertiser shall use commercially reasonable fraud detection and prevention measures. As a condition to denying payment for a disputed Action, Advertiser shall provide AdAction with reasonable supporting evidence sufficient to evaluate the claim. The parties shall work in good faith to resolve timely submitted disputes.

The data associated with any and all Lead/CPA-based Actions (“Action Data”) that are not both accepted and paid for by Advertiser shall be deemed the Confidential Information of AdAction, subject to any and all restrictions set forth herein (“Unaccepted Action Data”). Upon Advertiser’s acceptance of a Lead/CPA-based Action (and payment to AdAction therefore in accordance with payment terms set forth herein and in the applicable IO), AdAction shall grant to Advertiser joint ownership and the full right to use such Action Data. Where Advertiser does not accept Leads/CPA-based Actions, where Advertiser fails to make payments for same in accordance with the payment terms herein and in the applicable IO and/or where such Leads/CPA-based Actions are later determined not to be Valid Actions, Advertiser shall have no rights in and to such Action Data, and such Action Data shall be considered and treated as Unaccepted Action Data. Without limiting the generality of the confidentiality obligations set forth herein, Advertiser agrees that it:

1. will not transfer, export, display, forward or otherwise share information contained in the Unaccepted Action Data to/with any third party;
2. will not use the information contained in the Unaccepted Action Data on its own behalf in any manner not expressly authorized by AdAction;
3. will not use the information contained in the Unaccepted Action Data to create any interactive on-line, CD-ROM or other derivative product;
4. will not publicly display the information contained in the Unaccepted Action Data on the Internet; and
5. will notify AdAction as soon as it learns of any actual or suspected unauthorized use of or access to the information contained in the Unaccepted Action Data and provide reasonable assistance to AdAction in the investigation and prosecution of any such unauthorized use or disclosure.

Advertiser acknowledges that reward issuance to end users may occur independently of Advertiser validation timelines and agrees that such reward issuance does not alter Advertiser’s obligation to pay for Valid Actions as defined herein.

10. Reports

Advertiser shall provide AdAction with reasonably requested reporting and supporting information concerning Actions that Advertiser timely disputes under Section 9, including available information regarding invalid Actions, fraud, cancellations, chargebacks, and refunds.

11. Term/Termination

The Agreement shall continue for the term set forth in any underlying IO. Either party may terminate the Agreement upon thirty (30) days’ prior written notice. Unless otherwise stated in the applicable IO, either party may cancel or suspend an individual Ad Campaign or IO upon forty-eight (48) hours’ written notice. AdAction may immediately suspend Services or terminate an affected Ad Campaign or IO for nonpayment, unlawful or fraudulent activity, material security or platform risk, or a material breach that reasonably requires immediate action. Upon termination or expiration of the Agreement for any reason:

1. Advertiser will pay AdAction all amounts then due and owing as of the termination date within thirty (30) days as set forth in Section 8 above;
2. any and all licenses and rights granted to either party in connection with the Agreement shall immediately cease and terminate; and
3. any and all Confidential Information or proprietary information of either party that is in the other party’s possession or control must be immediately returned or destroyed. Notwithstanding any termination of the Agreement, any provisions of the Agreement that may reasonably be expected to survive termination of the Agreement, shall survive and remain in effect in accordance with their terms.

12. Warranty/Limitation of Liability

THE SERVICES, ADACTION ADS, AD GUIDELINES, ACTIONS, AND TRACKING TECHNOLOGY PROVIDED BY ADACTION UNDER THE AGREEMENT OR ANY APPLICABLE IO ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN SECTION 13 AND TO THE FULLEST EXTENT PERMITTED BY LAW, ADACTION DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. ADACTION DOES NOT WARRANT OR GUARANTEE ANY MINIMUM NUMBER OF IMPRESSIONS, CLICKS, ACTIONS, CONVERSION RATES, RESPONSE RATES, CAMPAIGN RESULTS, OR THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE. ADACTION SHALL NOT BE RESPONSIBLE FOR THE ACTS OR OMISSIONS OF ADVERTISER, PUBLISHERS, OR OTHER THIRD PARTIES, OR FOR CONTENT, PRODUCTS, SERVICES, WEBSITES, APPLICATIONS, OR OTHER DIGITAL PROPERTIES CONTROLLED BY THEM.

EXCEPT FOR A PARTY’S PAYMENT OBLIGATIONS, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS OR REVENUE, ARISING OUT OF OR RELATING TO THE AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXCEPT FOR ADVERTISER’S OBLIGATION TO PAY UNDISPUTED AMOUNTS PROPERLY DUE UNDER THE AGREEMENT, EACH PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT, INCLUDING LIABILITY ARISING FROM ITS INDEMNIFICATION OBLIGATIONS, SHALL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY ADVERTISER TO ADACTION UNDER THE APPLICABLE IO DURING THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. NOTHING IN THIS SECTION LIMITS LIABILITY TO THE EXTENT A LIMITATION IS PROHIBITED BY APPLICABLE LAW.

13. Representation and Warranties

Advertiser represents and warrants that:

1. the Advertiser Ads, Advertiser Products, Advertiser websites or apps linked to from the Advertiser Ads, and Advertiser’s performance under the Agreement will comply with all laws, rules, regulations, platform requirements, and applicable self-regulatory standards applicable to Advertiser, the applicable Ads, Advertiser Products, and Advertiser’s performance under the Agreement (collectively, “Laws”);
2. it owns or has all rights necessary to permit AdAction and its Publishers to use the Advertiser Ads and all materials, trademarks, claims, instructions, and other content supplied by Advertiser as contemplated by the Agreement;
3. the Advertiser Ads, Advertiser Products, Advertiser-provided materials, and Advertiser websites or apps linked to from the Advertiser Ads will not infringe, misappropriate, or otherwise violate the rights of any third party;
4. Advertiser has a reasonable basis and appropriate substantiation for all claims supplied or approved by Advertiser for use in the Ads;
5. Advertiser shall fulfill all commitments made in Advertiser Ads and all commitments supplied or approved by Advertiser for inclusion in AdAction Ads;
6. if the Advertiser’s Ad links to an app that offers an option to purchase subscriptions or offers in-app services, goods, content or functionality for purchase, Advertiser shall clearly notify end-users that such payment is required in accordance with industry standard practices, and comply with all applicable “in-app” purchase rules and policies set forth by the applicable distribution platform(s) and/or app store(s), including but not limited to, the Google Play Store, the Apple App Store, and other similar distribution platforms or app stores;
7. Advertiser shall ensure that no Ad is targeted or directed to end-users under the age of eighteen (18). Without limiting the foregoing, or limiting Advertiser’s obligations under COPPA, Advertiser shall not share with AdAction any personal information collected from or about children under the age of 13;
8. prior to loading any program onto an individual’s device including, without limitation, programs commonly referred to as adware and/or spyware, but excluding cookies (provided that cookies are disclosed in Advertiser’s privacy policy and end-users are instructed on how to disable such cookies), Advertiser shall provide clear and conspicuous notice to, and shall obtain the express consent of, such individual to install such program;
9. the Ads, Advertiser Products, any Advertiser website or app linked to from the Ads do not:
   
   1. contain any misrepresentations or content that is false, deceptive, misleading, unethical, libelous, or defamatory;
   2. contain content that is violent, obscene, offensive, including content that contains nudity or implied nudity or content that is morally or ethically offensive or sexually suggestive;
   3. promote or support illegal gambling or gambling activities not permitted under applicable law; or
   4. contain any “worm,” “virus” or other device that could impair or injure any person or entity;
10. Advertiser is not, nor is Advertiser acting on behalf of any person or entity that is, prohibited from engaging in transactions with U.S. citizens, nationals or entities under applicable U.S. law and regulation including, but not limited to, regulations issued by the U.S. Office of Foreign Assets Control (“OFAC”);
11. Advertiser is not, nor is Advertiser acting on behalf of any person or entity that is, a Specially Designated National (“SDN”), as OFAC may so designate from time to time.

AdAction represents and warrants that:

1. it has the power and authority to enter into and perform its obligations under the Agreement;
2. it will perform the Services in material compliance with Laws applicable to AdAction’s performance of the Services;
3. to AdAction’s knowledge, materials created solely by AdAction and provided as part of the Services, excluding Advertiser-provided materials incorporated therein, will not infringe the intellectual property rights of any third party.

Advertiser represents and warrants that Advertiser has provided all disclosures to and obtained consent from users as may be required under applicable law or regulations for the collection, use and transfer of data as contemplated hereby. Advertiser will comply with all applicable laws and regulations, including data privacy and security laws and rules applicable to the personal information of the users that is being accessed, collected, used, or shared by Advertiser with AdAction. Advertiser shall post on any website or app involved in the Programs a privacy policy that complies with applicable Data Protection Laws and provides legally adequate disclosure regarding the collection, use, disclosure, and transfer of Personal Data in connection with the Services.

14. Indemnification

Advertiser shall indemnify, defend, and hold harmless AdAction, its Affiliates, Publishers, and each of their respective officers, directors, employees, and agents from and against any third-party claim, loss, damage, liability, cost, or expense (including reasonable attorneys’ fees) arising out of or relating to: (a) Advertiser Ads, Advertiser Products, Advertiser websites or apps, or materials, claims, instructions, or content supplied by Advertiser; (b) an allegation that any of the foregoing infringes or violates a third party’s rights; (c) Advertiser’s violation of applicable Law; (d) Advertiser’s breach of its representations or warranties under the Agreement; or (e) Advertiser’s collection, use, disclosure, or transfer of Personal Data, including any failure to provide required notices or obtain required rights or consents.

AdAction shall indemnify, defend, and hold harmless Advertiser and its Affiliates and each of their respective officers, directors, employees, and agents from and against any third-party claim, loss, damage, liability, cost, or expense (including reasonable attorneys’ fees) arising out of or relating to: (i) AdAction Ads or other materials created solely by AdAction, except to the extent the claim arises from Advertiser-provided materials, claims, instructions, trademarks, or other content; (ii) AdAction’s material violation of applicable Law in performing the Services; (iii) AdAction’s breach of its express representations or warranties under the Agreement; or (iv) AdAction’s gross negligence or willful misconduct.

Upon the assertion of any claim or the commencement of any suit or proceeding against an indemnitee by any third party that may give rise to liability of an indemnitor hereunder, the indemnitee shall promptly notify the indemnitor of the existence of such claim and the indemnitor shall defend and/or settle the claim at its own expense and with counsel of its own selection. Indemnitee shall at all times have the right to fully participate in the defense of any claim and in any settlement which it reasonably believes would have an adverse effect on its business. The indemnitee shall make available to the indemnitor all books and records relating to the claim, and the parties to this Agreement agree to render to each other such assistance as may reasonably be requested in order to ensure a proper and adequate defense. An indemnitee shall not make any settlement of any claims which might give rise to liability of an indemnitor hereunder without the prior written consent of the indemnitor. An indemnitor shall not make any settlement of any claims which give rise to or impose any liability or obligations on the indemnitee without the prior written consent of the indemnitee, such consent not to be unreasonably withheld. Nothing in this Agreement shall be construed to prevent indemnitee from retaining counsel of its choice, at the expense of the indemnitee, to represent indemnitee’s interests and participate in the defense of any such claims covered under this section.

15. Confidentiality

For purposes of the Agreement, “Confidential Information” shall mean all data and information, of a confidential nature or otherwise, disclosed during the term of the Agreement by one party (“Disclosing Party”) to the other party (“Receiving Party”), as well as information that the Receiving Party knows or should know that the Disclosing Party regards as confidential including, but not limited to:

1. a party’s business plans, strategies, know how, marketing plans, suppliers, sources of materials, finances, business relationships, personally identifiable end-user information, pricing, technology, employees, trade secrets and other non-public or proprietary information whether written, oral, recorded on tapes or in any other media or format;
2. the material terms of the Agreement and/or any associated IO(s);
3. with respect to AdAction, the Unaccepted Action Data and suppression lists; and
4. any information marked or designated by the Disclosing Party as confidential. The Receiving Party agrees to hold all Confidential Information in trust and confidence and, except as may be authorized by the Disclosing Party in writing, shall not use such Confidential Information for any purpose other than as expressly set forth in the Agreement or disclose any Confidential Information to any person, company or entity, except to those of its employees and professional advisers: who need to know such information in order for the Receiving Party to perform its obligations hereunder; and who have entered into a confidentiality agreement with the Receiving Party with terms at least as restrictive as those set forth herein.

Confidential Information shall not include information that the Receiving Party can demonstrate: (i) is generally available to or known to the public through no wrongful act of the Receiving Party; (ii) was lawfully known to the Receiving Party without restriction prior to disclosure by the Disclosing Party; (iii) is received from a third party without breach of any confidentiality obligation; or (iv) is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information.

If the Receiving Party is required by applicable law, regulation, subpoena, court order, or other legal process to disclose Confidential Information, it may make such disclosure; provided that, to the extent legally permitted, it gives the Disclosing Party prompt written notice and reasonable assistance in seeking confidential treatment or other protective relief. The obligations of this Section 15 shall survive termination or expiration of the Agreement.

16. Non-Circumvention

Advertiser recognizes that AdAction has proprietary relationships with Publishers introduced to Advertiser by AdAction in connection with the Services. During the term of the Agreement and for six (6) months thereafter, Advertiser shall not knowingly circumvent AdAction to directly solicit, purchase, contract for, or obtain substantially similar services from such an introduced Publisher for the purpose of avoiding AdAction’s involvement or fees. This restriction does not apply to a relationship that Advertiser can demonstrate: (i) existed before AdAction’s introduction; or (ii) was independently developed without use of AdAction’s Confidential Information or circumvention of AdAction. In the event of a breach or threatened breach, AdAction may seek injunctive relief and any other remedies available at law or in equity, subject to the limitations of liability in Section 12.

17. Force Majeure

Other than with respect to payment obligations arising hereunder, neither party will be liable, or be considered to be in breach of this Agreement, on account of such party’s delay or failure to perform as required under the terms of the Agreement as a result of any causes or conditions that are beyond such party’s reasonable control and that such party is unable to overcome through the exercise of commercially reasonable diligence (a “Force Majeure Event”). If any such Force Majeure Event occurs including, without limitation, acts of God, fires, explosions, telecommunications, Internet or network failure, results of vandalism or computer hacking, storm or other natural occurrences, national emergencies, acts of terrorism, insurrections, riots, wars, strikes or other labor difficulties, or any act or omission of any other person or entity, the affected party will give the other party notice and will use commercially reasonable efforts to minimize the impact of any such event.

18. Miscellaneous

Assignment: Neither party may assign, transfer or delegate any of its rights or obligations under the Agreement or any IO without the prior written consent of the other party, and any attempts to do so shall be null and void; provided, however, that either party may assign the Agreement, any IO or any portion hereof/thereof, to:

1. an acquirer of all or substantially all of such party’s equity, business or assets;
2. a successor in interest whether by merger, reorganization or otherwise; or
3. any entity controlling or under common control with such party.

Governing Law and Venue: The Agreement shall be governed by and construed in accordance with the laws of the State of Colorado, without regard to conflict-of-laws principles that would require the application of the laws of another jurisdiction. Any action or proceeding arising out of or relating to the Agreement shall be brought exclusively in the state or federal courts located in the State of Colorado, and each party irrevocably submits to the jurisdiction and venue of such courts.

Entire Agreement; Order of Precedence: The Agreement, including all applicable IOs and the Data Processing Addendum, constitutes the entire agreement between the parties concerning its subject matter and supersedes all prior or contemporaneous agreements, proposals, communications, and understandings concerning such subject matter. In the event of a conflict, the applicable IO shall control over these Terms, and the Data Processing Addendum shall control with respect to data protection obligations. Except as expressly provided herein, the Agreement may be amended only by a writing agreed to by authorized representatives of both parties.

No Additional Terms: If AdAction is required to click through, digitally accept, or otherwise acknowledge additional online terms, policies, or guidelines solely as a technical condition of accessing Advertiser’s systems or services, such online terms will not amend or supersede the Agreement unless expressly agreed in writing by an authorized representative of AdAction.

Relationship of the Parties: The parties are independent contractors. Nothing in the Agreement creates any partnership, agency, employment, franchise, fiduciary, or joint venture relationship between the parties. Neither party has authority to bind the other or incur any obligation on the other’s behalf.

Non-Waiver/Severability: No waiver of any breach of any provision of the Agreement shall constitute a waiver of any prior, concurrent or subsequent breach of the same or any other provisions hereof, and no waiver shall be effective unless made in writing and signed by an authorized representative of the waiving party. If any provision contained in the Agreement is determined to be invalid, illegal or unenforceable in any respect under any applicable law, then such provision will be severed and replaced with a new provision that most closely reflects the real intention of the parties, and the remaining provisions of the Agreement will remain in full force and effect.

Exhibit A

Data Processing Addendum

Capitalized terms used in this Data Processing Addendum (“Addendum”) shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Advertiser Terms and Conditions and any applicable Insertion Order(s) (collectively, the “Agreement”). Except as modified below, the terms of the Agreement shall remain in full force and effect. The following obligations shall apply only to the extent required by Data Protection Laws with regard to the relevant Advertiser Personal Data, if applicable.

1.  Definitions

“Advertiser Personal Data” means Personal Data Processed by AdAction on behalf of Advertiser to perform the Services under the Agreement.

“Affiliate” means an entity that owns or controls, is owned or controlled by, or is under common control or ownership with either Advertiser or AdAction, respectively, where control means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract, or otherwise.

“Controller” means an entity that determines the purposes and means of the Processing of Personal Data.

“Data Protection Laws” means the data privacy and security laws and regulations of any jurisdiction applicable to the Processing of Advertiser Personal Data, including, in each case to the extent applicable, European Data Protection Laws and United States Data Protection Laws.

“Data Subject” means the identified or identifiable natural person who is the subject of Personal Data.

“European Data Protection Laws” means, in each case to the extent applicable: (a) the EU General Data Protection Regulation 2016/679 (“GDPR”); (b) the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), the Data Protection Act 2018, and other applicable laws relating to data protection, the processing of personal data, privacy, or electronic communications in force from time to time in the United Kingdom (collectively, “UK Data Protection Laws”); (c) the Swiss Federal Act on Data Protection (“Swiss FADP”); and (d) other applicable laws, rules, or regulations relating to the protection of Personal Data in the European Economic Area, United Kingdom, or Switzerland.

“Personal Data” means information that constitutes “personal information,” “personal data,” “personally identifiable information,” or a similar term under Data Protection Laws.

“Process” means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, alignment, combination, restriction, erasure, destruction, or disclosure by transmission, dissemination, or otherwise making available.

“Processor” means an entity that Processes Personal Data on behalf of a Controller.

“Security Incident” means a breach of AdAction’s security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Advertiser Personal Data in AdAction’s possession, custody, or control. “Security Incident” does not include unsuccessful attempts or activities that do not compromise the security of Advertiser Personal Data, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.

“Standard Contractual Clauses” means, as applicable, Module Two (Transfer controller to processor) or Module Three (Transfer processor to processor) of the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as supplemented or modified by Appendix 3.

“Subprocessor” means any Processor appointed by AdAction to Process Advertiser Personal Data on behalf of Advertiser or any Advertiser Affiliate under the Agreement.

“Supervisory Authority” means an independent competent public authority established or recognized under Data Protection Laws.

“United States Data Protection Laws” means all U.S. federal and state privacy, data protection, and data security laws applicable to the Processing of Personal Data under the Agreement, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (collectively, “CCPA”), in each case as amended, replaced, or superseded from time to time.

2.  Roles of the Parties; Compliance

To the extent AdAction Processes Advertiser Personal Data solely on behalf of Advertiser to provide the Services, Advertiser is a Controller (or, where applicable, a Processor acting on behalf of a third-party Controller) and AdAction is a Processor (or subprocessor, as applicable). To the extent each party independently determines the purposes and means of Processing Personal Data in connection with tracking, attribution, fraud prevention, measurement, security, compliance, or its own business and legal obligations, the parties act as independent Controllers with respect to such Processing. Personal Data Processed by AdAction as an independent Controller is not “Advertiser Personal Data” solely by reason of being Processed in connection with the Services. Each party will comply with the obligations applicable to it in its respective role under Data Protection Laws.

3.  Details of Processing

The parties acknowledge and agree that the nature and purpose of the Processing of Advertiser Personal Data, the types of Advertiser Personal Data Processed, the categories of Data Subjects, and other details regarding the Processing of Advertiser Personal Data are as set forth in Appendix 1.

4.  Processing of Advertiser Personal Data

AdAction shall not Process Advertiser Personal Data other than on Advertiser’s documented instructions unless Processing is required by Data Protection Laws to which AdAction is subject, in which case AdAction shall, to the extent permitted by Data Protection Laws, inform Advertiser of that legal requirement before Processing Advertiser Personal Data. For the avoidance of doubt, the Agreement shall constitute documented instructions for purposes of this Addendum. Advertiser hereby instructs AdAction to Process Advertiser Personal Data: (a) to provide the Services to Advertiser; (b) to perform its obligations and exercise its rights under the Agreement and this Addendum; and (c) as necessary to prevent or address technical problems with the Services. Advertiser’s instructions for the Processing of Advertiser Personal Data shall comply with Data Protection Laws. Advertiser shall be responsible for: (i) giving adequate notice and making all appropriate disclosures to Data Subjects regarding Advertiser’s use and disclosure and AdAction’s Processing of Advertiser Personal Data; and (ii) obtaining all necessary rights and, where applicable, all appropriate and valid consents to disclose such Advertiser Personal Data to AdAction and permit its Processing for purposes of performing AdAction’s obligations under the Agreement or as otherwise required by Data Protection Laws. Advertiser shall notify AdAction of any changes in, or revocation of, permission to use, disclose, or otherwise Process Advertiser Personal Data that would impact AdAction’s ability to comply with the Agreement, this Addendum, or Data Protection Laws.

5.  Processing Subject to the CCPA

As used in this Section, the terms “Sell,” “Share,” “Business Purpose,” and “Commercial Purpose” shall have the meanings given in the CCPA, and “Personal Information” shall mean any personal information (as defined in the CCPA) contained in Advertiser Personal Data. AdAction will not: (a) Sell or Share any Personal Information; (b) retain, use, or disclose any Personal Information (i) for any purpose other than for the Business Purposes specified in the Agreement, including for any Commercial Purpose other than the Business Purposes specified in the Agreement, or as otherwise permitted by the CCPA, or (ii) outside of the direct business relationship between Advertiser and AdAction; or (c) combine Personal Information received from, or on behalf of, Advertiser with Personal Data received from or on behalf of any third party, or collected from AdAction’s own interaction with Data Subjects, except as permitted by the CCPA. AdAction certifies that it understands and will comply with the foregoing restrictions. The parties acknowledge that Personal Information disclosed by Advertiser to AdAction is provided only for the limited and specified purposes set forth in Appendix 1. AdAction will comply with applicable obligations under the CCPA and provide the same level of privacy protection to Personal Information as required by the CCPA. Advertiser may take reasonable and appropriate steps to help ensure that AdAction uses Personal Information in a manner consistent with Advertiser’s obligations under the CCPA by exercising its audit rights under Section 13. AdAction will notify Advertiser if it determines that it can no longer meet its obligations under the CCPA. If AdAction notifies Advertiser of unauthorized use of Personal Information, Advertiser may take reasonable and appropriate steps to stop and remediate such unauthorized use, including limiting the Personal Information shared with AdAction, terminating the portion of the Agreement relevant to such unauthorized use, or taking other steps mutually agreed by the parties in writing.

6.  Confidentiality

AdAction shall take reasonable steps to ensure that individuals who Process Advertiser Personal Data are subject to obligations of confidentiality or are under an appropriate statutory obligation of confidentiality.

7.  Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, AdAction shall, in relation to Advertiser Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with the security standards in Appendix 2 (the “Security Measures”). Advertiser agrees that, without limitation of AdAction’s foregoing obligations, Advertiser is responsible for its use of the Services, including: (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of Advertiser Personal Data; and (b) securing any account authentication credentials, systems, and devices Advertiser uses to access or connect to the Services, where applicable. Without limiting AdAction’s obligations hereunder, Advertiser is responsible for reviewing information made available by AdAction relating to data security and making an independent determination as to whether the Services meet Advertiser’s requirements and legal obligations under Data Protection Laws.

8.  Subprocessing

Advertiser provides AdAction with general authorization to engage Subprocessors as reasonably necessary to provide the Services. AdAction will require each Subprocessor that Processes Advertiser Personal Data to be bound by written data protection obligations that are no less protective, in all material respects, than the obligations applicable to AdAction under this Addendum, and AdAction will remain responsible for the performance of its Subprocessors to the extent required by Data Protection Laws. AdAction will notify Advertiser of intended additions or replacements of material Subprocessors that Process Advertiser Personal Data. Advertiser may object on reasonable data-protection grounds within ten (10) days after receiving such notice. The parties will work in good faith to address a timely objection. If the parties cannot reasonably resolve the objection, Advertiser may terminate only the affected portion of the Services that requires use of the objected-to Subprocessor. Upon Advertiser’s reasonable written request, AdAction will provide information regarding material Subprocessors used to Process Advertiser Personal Data.

9.  Data Subject Rights

If a Data Subject exercises any rights under Data Protection Laws in relation to Advertiser Personal Data, AdAction will advise the Data Subject to submit the request to Advertiser, and Advertiser will be responsible for responding to the request. Taking into account the nature of the Processing and the functionality of the Services, AdAction will use reasonable commercial efforts to assist Advertiser in fulfilling its obligations as Controller following Advertiser’s written request, provided that AdAction may charge Advertiser on a time-and-materials basis if such assistance is onerous, complex, frequent, or time consuming.

10.  Security Incidents

AdAction will notify Advertiser without undue delay after becoming aware of a confirmed Security Incident. AdAction will take reasonable steps to identify the cause, minimize harm, and prevent recurrence, and will provide information reasonably available to AdAction that Advertiser may require to comply with applicable notification obligations. Advertiser is responsible for maintaining current notification contact information. AdAction’s notification of or response to a Security Incident will not be construed as an acknowledgement of fault or liability.

11.  Data Protection Impact Assessment and Prior Consultation

If Advertiser considers that the Processing of Advertiser Personal Data requires a privacy or data protection impact assessment or assistance with prior consultation with a Supervisory Authority, AdAction shall, following Advertiser’s written request and taking into account the nature of AdAction’s Processing and the information available to AdAction, use reasonable commercial efforts to provide relevant information and assistance. AdAction may charge Advertiser on a time-and-materials basis if such assistance is onerous, complex, frequent, or time consuming.

12.  Deletion or Return of Advertiser Personal Data

Unless otherwise required by applicable law, following termination or expiration of the Agreement, AdAction shall, at Advertiser’s option, delete or return all Advertiser Personal Data and copies thereof.

13.  Relevant Records and Audit Rights

Upon reasonable written request, AdAction will make available information reasonably necessary to demonstrate compliance with this Addendum. Advertiser will first use available documentation, questionnaires, summaries, and other reasonable compliance materials to assess AdAction’s compliance. No more than once in any twelve (12)-month period, unless required by Data Protection Laws, a Supervisory Authority, or following a confirmed Security Incident materially affecting Advertiser Personal Data, Advertiser may conduct an audit through an independent auditor that is not a competitor of AdAction if the available materials are reasonably insufficient to demonstrate compliance. Any audit will: (i) occur during normal business hours on at least twenty (20) days’ advance written notice where practicable; (ii) be conducted so as not to unreasonably interfere with AdAction’s operations; (iii) comply with AdAction’s confidentiality, safety, and security requirements; (iv) not provide access to other customers’ data or Confidential Information; and (v) not include penetration testing, vulnerability scanning, or other intrusive security testing without AdAction’s prior written consent. Advertiser will bear its own audit costs. To the extent an audit or related assistance is unusually burdensome or requires more than twenty (20) hours of AdAction personnel time, AdAction may charge reasonable time-and-materials fees for the excess assistance.

14.  International Data Transfer

If Advertiser transfers to AdAction any Advertiser Personal Data that is subject to European Data Protection Laws and the transfer is not subject to an alternative adequate transfer mechanism or otherwise exempt from cross-border transfer restrictions, then Advertiser, on behalf of itself and each applicable Advertiser Affiliate as “data exporter,” and AdAction, on behalf of itself and each applicable AdAction Affiliate as “data importer,” agree that the applicable Standard Contractual Clauses shall apply to and govern such transfer and are incorporated herein by reference, as supplemented by Appendix 3. If the Standard Contractual Clauses cease to be recognized as a lawful basis for the relevant transfer, the parties will cooperate in good faith to implement another lawful transfer mechanism to the extent required by Data Protection Laws. The Standard Contractual Clauses will apply only for so long as required to legitimize the relevant transfer.

15.  General Terms

Any obligation imposed on AdAction under this Addendum in relation to the Processing of Advertiser Personal Data shall survive termination or expiration of the Agreement and automatically expire upon AdAction’s deletion or return of all Advertiser Personal Data, except to the extent otherwise required by applicable law. If any provision of this Addendum is invalid or unenforceable, the remainder will remain valid and in force, and the invalid or unenforceable provision will be amended or construed as necessary to preserve its intent as closely as possible. With respect to the subject matter of this Addendum, this Addendum will prevail over conflicting provisions of the Agreement regarding data protection obligations. Any liabilities arising under this Addendum are subject to the limitations of liability in the Agreement. This Addendum will be governed by the governing law and jurisdiction provisions in the Agreement unless Data Protection Laws require otherwise.

Appendix 1 to Data Processing Addendum

Details of Processing of Advertiser Personal Data

1.  Subject matter and duration of the Processing of Advertiser Personal Data

The subject matter and duration of the Processing are as described in the Agreement and this Addendum.

2.  Nature and purpose of the Processing of Advertiser Personal Data

The nature of the Processing consists of activities reasonably required to facilitate or support the provision of the Services as described in the Agreement and this Addendum. The purposes of the Processing may include the following business purposes:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable specifications and standards;
• Helping to ensure security and integrity, to the extent the use of Advertiser Personal Data is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality;
• Performing the Services as described in the Agreement and carrying out the instructions set forth in Sections 4 and 5, including processing transactions, processing payments to publishers, providing analytic services, or providing similar services on behalf of Advertiser;
• Providing advertising and marketing services, except for cross-context behavioral advertising, to Data Subjects, provided that for such advertising and marketing AdAction shall not combine Advertiser Personal Data of opted-out Data Subjects received from or on behalf of Advertiser with Personal Data received from or on behalf of another person or collected from AdAction’s own interaction with the Data Subject, except as permitted by applicable Data Protection Laws;
• Undertaking internal research for technological development and demonstration; and
• Undertaking activities to verify or maintain the quality or safety of the Services and to improve, upgrade, or enhance the Services.

3.  Categories of Data Subjects

The categories of Data Subjects are those contemplated by or related to the Processing described in the Agreement and may include Advertiser’s authorized account users and its end customers.

4.  Categories of Advertiser Personal Data

The categories of Advertiser Personal Data Processed may include business contact and account information; device and advertising identifiers; IP address; click, impression, attribution, transaction, and conversion identifiers; campaign and event data; app or device information; in-app event or purchase information; and hashed identifiers where applicable, in each case only to the extent provided or made available in connection with the Services.

5.  Sensitive data included in Advertiser Personal Data

Not intended. Advertiser shall not provide AdAction with sensitive personal data or special-category data unless expressly agreed in writing by AdAction and necessary for the Services.

6.  Frequency of Advertiser’s transfer of Advertiser Personal Data to AdAction

If applicable, on a continuous basis for the term of the Agreement.

7.  Retention period or criteria used to determine the retention period

For the duration of the Agreement and thereafter only for so long as reasonably necessary to provide the Services, comply with applicable legal obligations, resolve disputes, enforce agreements, or as otherwise permitted or required by Data Protection Laws, subject to Section 12 of this Addendum.

8.  Transfers to Subprocessors

The subject matter, nature, and duration of Processing by Subprocessors will be limited to the Processing reasonably necessary for the Subprocessor to provide its contracted services in support of the Services and will not exceed the duration permitted under the Agreement and this Addendum.

Appendix 2 to Data Processing Addendum

Security Measures

1.  Information Security Program. Implement, maintain, and comply with information security policies and procedures designed to protect the confidentiality, integrity, and availability of Advertiser Personal Data and systems that store or otherwise Process it, aligned with an industry-recognized control framework where appropriate to AdAction’s operations and risk profile, periodically reviewed and updated, and reasonably designed to address applicable Data Protection Laws.

2.  Risk Assessment. Maintain risk assessment procedures for periodic review and assessment of risks to the organization, monitoring and maintaining compliance with applicable security policies and procedures, and reporting material information-security risks to appropriate personnel.

3.  Personnel Training. Train personnel to maintain the confidentiality, integrity, and availability of Advertiser Personal Data, consistent with the Agreement and Data Protection Laws.

4.  Vendor Management. Before engaging Subprocessors and other subcontractors that will Process Advertiser Personal Data, conduct reasonable due diligence designed to assess their ability to protect the confidentiality, integrity, and availability of Advertiser Personal Data.

5.  Access Controls. Limit access to Advertiser Personal Data to authorized personnel and third parties and maintain logical access controls designed to restrict access based on legitimate business need, including use of unique identifiers and appropriate access-management procedures.

6.  Secure User Authentication. Maintain authentication controls reasonably designed to protect access to systems Processing Advertiser Personal Data, including password controls and, where appropriate based on risk, multi-factor authentication or equivalent safeguards.

7.  Incident Detection and Response. Maintain policies and procedures designed to detect and respond to actual or reasonably suspected Security Incidents and encourage prompt reporting of such incidents.

8.  Vulnerability Management. Maintain reasonable processes designed to detect, assess, prioritize, and remediate security vulnerabilities and protect against malicious code and other material security threats.

9.  Physical Security. Take reasonable measures to protect facilities and infrastructure used to Process Advertiser Personal Data against unauthorized physical access. AdAction may rely on the physical and environmental controls of its hosting and cloud infrastructure providers for systems hosted by those providers.

10.  Business Continuity and Disaster Recovery. Maintain business continuity and disaster recovery policies and procedures reasonably designed to support continued service and recovery from foreseeable emergency situations or disasters.

Appendix 3 to Data Processing Addendum

Standard Contractual Clauses

1.  Application of Modules. If Advertiser is acting as a Controller with respect to Advertiser Personal Data, Module Two (Transfer controller to processor) of the Standard Contractual Clauses shall apply. If Advertiser is acting as a Processor to a third-party Controller with respect to Advertiser Personal Data, Module Three (Transfer processor to processor) shall apply.

2.  Selections. For purposes of the Standard Contractual Clauses: (a) Option 2 in Clause 9(a) applies, and the time period for prior notice of intended Subprocessor changes is the notice period set forth in Section 8 of this Addendum; (b) the optional language in Clause 11(a) does not apply; (c) in Clause 17, Option 1 applies and the governing law will be the law of Ireland; and (d) under Clause 18(b), disputes will be resolved before the courts of Ireland.

3.  Annexes. The name, address, contact details, activities relevant to the transfer, and role of the parties set forth in the Agreement and this Addendum will be used to complete Annex I.A. The information in Appendix 1 will be used to complete Annex I.B. The competent Supervisory Authority for Annex I.C will be determined in accordance with Clause 13. Appendix 2 will be used to complete Annex II.

4.  Supplemental Business-Related Clauses. In accordance with Clause 2 of the Standard Contractual Clauses, the parties supplement the Standard Contractual Clauses with the following business-related provisions, which will not be interpreted or applied to contradict the Standard Contractual Clauses or prejudice the fundamental rights or freedoms of Data Subjects.

Instructions. The instructions described in Clause 8.1 are set forth in Section 4 of this Addendum.

Protection of Confidentiality. If a Data Subject requests a copy of the Standard Contractual Clauses or this Addendum under Clause 8.3, the parties may make redactions reasonably necessary to protect business secrets, Confidential Information, and Personal Data, to the extent permitted by applicable law.

Deletion or Return. Deletion or return of Advertiser Personal Data under the Standard Contractual Clauses will be governed by Section 12 of this Addendum. Certification of deletion under Clause 8.5 or Clause 16(d) will be provided upon written request where required.

Onward Transfers. AdAction will comply with the onward-transfer requirements of the applicable Standard Contractual Clauses and Data Protection Laws.

Audits and Certifications. Information requests and audits under Clause 8.9 will be fulfilled in accordance with Section 13 of this Addendum, to the extent consistent with the Standard Contractual Clauses.

Liability. The relevant terms of the Agreement governing indemnification and limitation of liability will apply to the fullest extent permitted under the Standard Contractual Clauses and applicable Data Protection Laws.

Termination. The relevant terms of the Agreement governing termination will apply to a termination under Clauses 14(f) or 16, subject to any mandatory rights or obligations under the Standard Contractual Clauses.

5.  Transfers from the United Kingdom. If Advertiser transfers Advertiser Personal Data to AdAction that is subject to UK Data Protection Laws and a restricted transfer mechanism is required, the parties agree that the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office (“UK Addendum”) is incorporated by reference and will apply to the relevant transfer. The information in the Agreement and this Addendum will be used to complete the applicable tables of the UK Addendum. In the event of conflict, the UK Addendum will control with respect to the relevant restricted transfer.

6.  Transfers from Switzerland. If Advertiser transfers Advertiser Personal Data to AdAction that is subject to the Swiss FADP and the Standard Contractual Clauses are used as the transfer mechanism, the Standard Contractual Clauses will apply with the modifications necessary to comply with the Swiss FADP, including that references to the GDPR will be understood to include the Swiss FADP to the extent applicable; references to “EU,” “Union,” and “Member State” will be interpreted to include Switzerland where required; the competent supervisory authority will be the Swiss Federal Data Protection and Information Commissioner where required; and Data Subjects in Switzerland may exercise rights under the Swiss FADP. These modifications will apply only to the extent necessary for the relevant transfer under the Swiss FADP.