ADVERTISER TERMS AND CONDITIONS
These Terms and Conditions (“Terms”) are a legally binding and enforceable agreement between AdAction Interactive LLC (“AdAction”) and you (“Advertiser”), whereby Advertiser may obtain access to the AdAction network of registered third party affiliates (“Affi liates”) and publishers (“Publishers”), and related technology and software (“AdAction Ad Server”), to market customized advertisements and links provided by Advertiser and/or AdAction (“Ads” as further defined below). AdAction, as well as the services provided by AdAction in connection therewith (“Services”), are subject to an Insertion Order (“IO”) incorporated herein by reference (the IO, together with these Terms, the “Agreement”). In any instance where Advertiser is an agency entering into the Agreement on behalf of a client, any reference to “Advertiser” shall refer jointly to agency as well as the applicable underlying client.
1. AdAction Services
Advertiser agrees to accept and pay for, and AdAction agrees to provide, the Services identified and set forth in the Agreement. In connection with the Services, AdAction shall undertake marketing campaigns with Advertiser (each an “Ad Campaign”) whereby AdAction will distribute Advertiser’s proprietary advertising materials including, without limitation, banners, buttons, text-links, clicks, co-registrations, e-mail, graphic files and similar online media (collectively, “Advertiser Ads”) and/or, where applicable, AdAction Ads (as defined below) through AdAction either:
Upon the execution of the Agreement, Advertiser may register on the AdAction website and create a unique, password-protected account (“Account”). Advertiser will be responsible for safeguarding and maintaining the confidentiality of its Account and associated password. Advertiser shall remain fully and solely responsibility for any and all actions taken under Advertiser’s Account, whether authorized by Advertiser or not. Advertiser must immediately notify AdAction of any unauthorized use of Advertiser’s Account. Advertiser is responsible for keeping its Account information current, complete and accurate, and Advertiser acknowledges and agrees that AdAction will have no responsibility or liability, directly or indirectly, for failure to deliver notices as a result of inaccurate Account information.
Advertiser shall develop all aspects of the Advertiser Ads, other than where the parties agree that AdAction shall assist in the development of Ads. The parties understand and agree that Advertiser is the sole owner of any and all intellectual property rights associated with any Advertiser Ads; other than those portions that AdAction prepares on Advertiser’s behalf (such portions hereinafter referred to as, the “AdAction Ads” and together with the Advertiser Ads, the “Ads”). The parties understand and agree that AdAction is the sole owner of any and all intellectual property rights associated with the AdAction Ads, other than Advertiser’s trademarks, logos, copyrights and other pre-existing Advertiser intellectual property incorporated in the AdAction Ads. Under no circumstances shall AdAction be authorized to use the Ads other than in connection with Advertiser’s Ad Campaigns as set forth in the IO(s).
AdAction reserves the right, in its sole discretion and without liability, to: change any of its Ad Guidelines set forth herein at any time; and to reject, omit, exclude or terminate any Ad for any reason at any time, with subsequent notice to the Advertiser, whether or not such Ad was previously acknowledged, accepted or published by AdAction. Such reasons for rejection, omission or exclusion of Ads include, but are not limited to, where AdAction deems, in its sole discretion, that the Ads, including the applicable products and/or services promoted by such Ads (“Advertiser Products”), and any website or app linked to from such Ads, are in violation of any applicable law, rule, regulation or other judicial or administrative order or where the content thereof may tend to bring disparagement, ridicule or scorn upon AdAction or any of its Publishers and/or Affiliates. Advertiser reserves the right to reject, omit, exclude, terminate or request a change to the Ads at any time and AdAction shall, subject to the provisions set forth herein, comply with such request as soon as practical but in no event later than three (3) business days after its receipt thereof. Advertiser may cancel or suspend a CPM or CPA-based Ad Campaign, or an Ad associated with such a CPM or CPA-based Ad Campaign, effective within approximately forty-eight (48) business hours of AdAction’s receipt of Advertiser’s cancellation notice in writing.
Advertiser guarantees that all advertisement material, links, descriptions, landing pages or related content associated to the Ads provided to AdAction and shown to users during fulfilment of AdAction Services will only ever contain Ad Campaigns agreed upon in the applicable IO. Advertiser is forbidden from changing the landing page, content, available offer or any other significant part of the Ad Campaign listed on the applicable IO. If Advertiser is found to be engaging in such practices, or making material changes to Ad Campaigns without sufficient prior written notice to AdAction, AdAction can, in its sole discretion, find Advertiser to be in material breach of the applicable IO and these Terms and seek reasonable damages.
Advertiser further guarantees that all advertisements, websites, ad campaigns, links, landing pages and/or related material or content comply with all applicable laws and regulations (including all laws respecting intellectual property rights) and, in any event, shall not include the following (“Ad Guidelines”):
The positioning, placement, frequency and other editorial decisions related to Ads shall be made by AdAction and/or its Affiliates and Publishers, as applicable, in their respective sole discretion. The applicable IO may set forth the particular place(s) where Ads may appear and/or be distributed. Advertiser agrees that in a case where no points of placement or distributions are set forth in the applicable IO or, in cases where “Run of Network” or similar designation is specified in the applicable IO, the Ads may appear at any point of placement and/or distribution that AdAction and/or its Affiliates and Publishers may determine, in their respective sole discretion.
5. Ad Codes
Unless otherwise stated in writing by AdAction, each Ad used by AdAction in connection with an Ad Campaign must include, in unaltered form, the special transaction tracking computer code provided by AdAction (“Ad Codes”). Advertiser will not knowingly modify, circumvent, impair, disable or otherwise interfere with any Ad Codes and/or other technology and/or methodology required or made available by AdAction to be used in connection with any and all Ads. In connection with CPA-based Ad Campaigns, Advertiser agrees to pay AdAction a reasonable market rate determined by AdAction on a net thirty (30) day basis in instances where conversion data cannot be supplied due to a failure of the Ad Codes and Advertiser’s inability to provide such information, in the alternative. All determinations made by AdAction in connection with the Ads, Actions and any associated fees invoiced to Advertiser shall be final and binding on Advertiser. Notwithstanding the foregoing, AdAction’s Services do not involve investigating or resolving any claim or dispute involving Advertiser and any Publisher, Affiliate or other third party.
6. E-mail Marketing
The following terms apply to all Ad Campaigns transmitted via e-mail by AdAction’s Affiliates on behalf of Advertiser. Any and all e-mail-based Ads:
7. Sponsored Content, Content based sites and content-based advertising
AdAction offers Advertisers the opportunity to advertise on our owned and operated content marketing sites, where the Advertiser’s product is relevant to the audience and topic of the site. AdAction will place Advertiser’s creative (if provided) and provided tracking links. AdAction will determine in its sole discretion the appropriate placement of such ad. Per these Terms, Advertiser will be responsible for all valid conversions, as defined by the applicable IO.
If Advertiser purchases sponsored content placements, the price and content shall be determined between parties and outlined on the applicable IO. AdAction reserves all rights of final approval and refusal for any content to be placed on any AdAction site, or related property. Advertiser may not present the content on any AdAction site or property to any other party in any way that is misleading as to the sponsored nature of the content.
All advertising, sponsored content or otherwise, must follow the requirements of Section 3 of these Terms. All claims made must be verifiable, truthful and accurate. AdAction reserves the right to remove any content at any time with no warning to Advertiser.
The fees for Actions shall be set forth in the applicable IO(s). Subject to Section 9 below, the payment of the fees shall be unconditioned and shall be paid regardless whether the Advertiser actually collected the funds from his applicable advertisers or not (if applicable). Conditioned that the Advertiser shall enable AdAction 24/7 access to Advertiser’s campaign tracking system, the fees shall be calculated according to the Advertiser’s record of Valid Actions (as defined in Section 9).
AdAction will invoice Advertiser monthly. Unless otherwise set forth in the applicable IO, payment will be due to AdAction within thirty (30) days of the date of invoice. If payment is not made in a timely manner, AdAction may, at its option, immediately terminate the Agreement and/or any applicable IO(s). Interest will accrue on any past due amounts at the rate equal to the lesser of one and one-half percent (1.5% per month) or the maximum amount permitted by law. In addition, Advertiser shall be liable to AdAction for all attorneys’ fees and other costs of collection incurred in collecting such unpaid amounts. Advertiser agrees and acknowledges that it shall be fully responsible for any and all taxes, whether state or local, and related fees, costs and penalties incurred by AdAction and/or any of its Publishers or Affiliates.
Prior to initiating the applicable campaign, as deemed necessary by AdAction, Advertiser may be required to pay AdAction advance payment set forth in the IO. Any fees payable to AdAction according to the IO shall be deducted from the Advance Payment. After the Advance Payment is fully exhausted, and as a condition for continuing the campaign, the Advertiser shall pay AdAction additional Advance Payment. In the event of a cancelation of an IO the Advertiser shall be acquitted for the non-used balance of the Advance Payment (if any) within 30 days of such cancelation.
Subject to Section 9 below, AdAction reserves the right to invoice Advertiser for Actions AdAction believes to be Valid Actions.
9. Leads/CPA/Unaccepted Actions
In connection with Leads and CPA-based Ad Campaigns, Advertiser will pay AdAction for all Actions generated; provided, however, that Advertiser shall have no obligation to pay for any Lead/CPA-based Action that:
Advertiser shall make best commercial efforts to prevent and/or substantially limit the occurrences of invalid and/or fraudulent Actions by using suitable fraud detection and customary prevention technology. In addition, and as a condition for nonpayment of applicable fees due for an invalid Action, the Advertiser shall provide AdAction with: (i) a written notification within five (5) days of the discovery of an invalid Action, any fraud claim submitted after the said period will not allow the Advertiser to deny the fees for such invalid Actions; and (ii) a written monthly report that shall include summary of the invalid Actions that occurred in the preceding month. Without derogating from the above, AdAction will not be required to accept any invalid Action claims presented to it unless it receives all the required evidence to satisfactorily determine that such actions were invalid Actions.
For certain incentivized traffic sources, AdAction receives end-user requests for incentives that are not delivered as expected upon user completion of a conversion or required action. Where AdAction finds the end-user has completed the requirements of the offer or campaign and a Valid Action occurred, AdAction reserves the right to invoice the Advertiser for these Valid Actions. AdAction will provide reporting of these Valid Actions to Advertiser monthly and both parties will work in good faith to validate such Actions. Valid Actions will be added to Advertiser’s monthly invoice.
The data associated with any and all Lead/CPA-based Actions (“Action Data”) that are not both accepted and paid for by Advertiser shall be deemed the Confidential Information of AdAction, subject to any and all restrictions set forth herein (“Unaccepted Action Data”). Upon Advertiser’s acceptance of a Lead/CPA-based Action (and payment to AdAction therefor in accordance with payment terms set forth herein and in the applicable IO), AdAction shall grant to Advertiser joint ownership and the full right to use such Action Data. Where Advertiser does not accept Leads/CPA-based Actions, where Advertiser fails to make payments for same in accordance with the payment terms herein and in the applicable IO and/or where such Leads/CPA-based Actions are later determined not to be Valid Actions, Advertiser shall have no rights in and to such Action Data, and such Action Data shall be considered and treated as Unaccepted Action Data. Without limiting the generality of the confidentiality obligations set forth herein, Advertiser agrees that it:
Advertiser shall provide AdAction, at its request, with periodic reports detailing information regarding Valid Actions, inter alia number of invalid Actions, rates of cancellations, fraudulent events and users, chargebacks, refunds on such Actions and any related information.
Advertiser agrees to provide AdAction with detailed reporting of Actions Advertiser believes are not Valid Actions no less than every seven (7) days. Advertiser agrees that failure to provide such regular, on time reporting of Actions Advertiser believes are not Valid Actions and therefore, non-billable, will disallow the denial of payment for such Actions to AdAction.
The Agreement shall continue for the term set forth in any underlying IO, provided that either party may terminate the Agreement and/or any IO at any time, upon seven (7) business days’ prior written notice. Upon termination or expiration of the Agreement for any reason:
12. Warranty/Limitation of Liability
THE ADACTION, SERVICES, ADACTION ADS, AD GUIDELINES, ACTIONS AND AD CODES PROVIDED BY ADACTION UNDER THE AGREEMENT AND/OR ANY APPLICABLE IO ARE SUPPLIED ON AN “AS IS” AND “AS AVAILABLE” BASIS. TO THE FULLEST EXTENT OF THE LAW, ADACTION MAKES NO WARRANTIES (INCLUDING IMPLIED WARRANTIES OF PURPOSE AND NON-INFRINGEMENT), GUARANTEES, REPRESENTATIONS, EXPRESS, IMPLIED, ORAL OR OTHERWISE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, ADACTION DOES NOT WARRANT OR GUARANTEE ACTIONS, CONVERSION RATES AND/OR RESPONSE RATES. WITHOUT DEROGATING FROM THE GENERALITY OF ANY PROVISIONS CONTAINED HEREIN, ADVERTISER ACKNOWLEDGES THAT ALTHOUGH ADACTION ENDEAVOURS TO PLACE THE ADS IN WEBSITES THAT ARE SUITABLE FOR THE GOALS OF THE APPLICABLE CAMPAIGN AND THE TARGET USERS, ADACTION DOESN’T WARRANT THAT: (i) THE CAMPAIGN SHALL BE SUCCESSFUL OR; (ii) THAT THE WEBSITE AND ITS USERS SHALL RISE TO THE EXPECTATIONS OF THE ADVERTISER OR; (iii) THAT IT HAS EXAMINED THE CONTENT OF THE WEBSITE AND/OR THE SUITABILITY THEREOF, OR HAS THE ABILITY TO MONITOR AND/OR CONTROL SUCH CONTENT, INTER ALIA IN TERMS OF LEGITIMACY AND/OR INFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS; (iv) THAT THE SERVICE AND ITS OPERATION WILL BE UNINTERRUPTED OR ERROR FREE. THE ADACTION, SERVICES, ADACTION ADS, AD GUIDELINES, ACTIONS AND/OR AD CODES MAY CONTAIN BUGS, ERRORS, PROBLEMS OR OTHER LIMITATIONS. ADACTION HAS NO LIABILITY, WHATSOEVER, TO ADVERTISER OR ANY THIRD PARTY, FOR ANY OTHER PARTY’S SECURITY METHODS AND PRIVACY PROTECTION PROCEDURES AND ADACTION DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS AND IMPLIED, THAT ANY OTHER PARTY’S SECURITY METHODS AND PRIVACY PROTECTION PROCEDURES WILL BE UNINTERRUPTED OR ERROR-FREE. ADACTION HAS NO LIABILITY FOR ADVERTISER’S USE OF, OR INABILITY TO USE, THE AD GUIDELINES OR APPLICABLE ACTIONS AND ADACTION DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS AND/OR IMPLIED, THAT ADVERTISER’S USE OF THE ADACTION, SERVICES, ADACTION ADS, AD GUIDELINES AND/OR ACTIONS WILL BE UNINTERRUPTED OR ERROR-FREE. ADACTION MAKES NO GUARANTEES, AND ACCEPTS NO RESULTING LIABILITY, FOR FAILURE TO MEET SCHEDULED DELIVERY DATES. IN NO EVENT SHALL ADACTION BE RESPONSIBLE FOR ANY CONSEQUENTIAL, SPECIAL, PUNITIVE OR OTHER INDIRECT DAMAGES INCLUDING, WITHOUT LIMITATION, LOST REVENUE OR PROFITS, EVEN IF ADACTION HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ADACTION WILL NOT BE LIABLE, OR CONSIDERED IN BREACH OF THE AGREEMENT, ON ACCOUNT OF A DELAY OR FAILURE TO PERFORM UNDER THESE TERMS AND/OR ANY IO AS A RESULT OF CAUSES OR CONDITIONS THAT ARE BEYOND ADACTION’S CONTROL. NOTWITHSTANDING ANYTHING CONTAINED HEREIN TO THE CONTRARY, ADACTION’S LIABILITY UNDER ANY CAUSE OF ACTION SHALL BE LIMITED TO THE AMOUNTS PAID TO ADACTION BY ADVERTISER DURING THE PRIOR THREE (3) MONTH PERIOD PURSUANT TO THE AGREEMENT. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, ADVERTISER ACKNOWLEDGES AND AGREES THAT ADACTION MAKES NO REPRESENTATIONS, ENDORSEMENTS, GUARANTIES OR WARRANTIES, EXPRESS OR IMPLIED, AND IN NO EVENT SHALL ADACTION BE LIABLE FOR, THE ACTIONS OR OMISSIONS OF ANY ADVERTISER, FOR ANY CONTENT CONTAINED IN ANY ADVERTISEMENTS OR LINKED WEBSITES, APPS OR OTHER ONLINE PROPERTIES, OR FOR ANY PRODUCT OR SERVICE OFFERED, PURCHASED, ACCESSIBLE OR USABLE THROUGH ANY ADVERTISER’S ADVERTISEMENT, WEBSITE, APP OR ONLINE PROPERTY. ADVERTISER FURTHER ACKNOWLEDGES AND AGREES THAT ADACTION MAKES NO REPRESENTATIONS, ENDORSEMENTS, GUARANTIES OR WARRANTIES, EXPRESS OR IMPLIED, AND IN NO EVENT SHALL ADACTION BE LIABLE FOR, ANY ACTIONS OR INACTIONS OF PUBLISHERS AND/OR AFFILIATES, OR FOR A PUBLISHER’S WEBSITE(S), APP(S) OR ONLINE PROPERTIES, FOR ANY CONTENT CONTAINED ON A PUBLISHER’S WEBSITE(S), APP(S) OR ONLINE PROPERTIES, OR FOR ANY PRODUCT(S) OR SERVICE(S) OFFERED, PURCHASED, ACCESSIBLE OR USABLE THROUGH A PUBLISHER’S WEBSITE(S), APP(S) OR ONLINE PROPERTIES.
13. Representation and Warranties
Advertiser represents and warrants that:
Each party agrees to indemnify, defend and hold harmless the other, its subsidiaries, advertisers, vendors and suppliers, and each of their respective agents, partners, officers, directors and employees from and against any third-party loss, cost, claim, injury or damage (including reasonable attorneys’ fees) arising out of or related to a breach of such party’s representations or warranties made in the Agreement or a breach of the terms and conditions of the Agreement.
Upon the assertion of any claim or the commencement of any suit or proceeding against an indemnitee by any third party that may give rise to liability of an indemnitor hereunder, the indemnitee shall promptly notify the indemnitor of the existence of such claim and the indemnitor shall defend and/or settle the claim at its own expense and with counsel of its own selection. Indemnitee shall at all times have the right to fully participate in the defense of any claim and in any settlement which it reasonably believes would have an adverse effect on its business. The indemnitee shall make available to the indemnitor all books and records relating to the claim, and the parties to this Agreement agree to render to each other such assistance as may reasonably be requested in order to ensure a proper and adequate defense. An indemnitee shall not make any settlement of any claims which might give rise to liability of an indemnitor hereunder without the prior written consent of the indemnitor. An indemnitor shall not make any settlement of any claims which give rise to or impose any liability or obligations on the indemnitee without the prior written consent of the indemnitee, such consent not to be unreasonably withheld. Nothing in this Agreement shall be construed to prevent indemnitee from retaining counsel of its choice, at the expense of the indemnitee, to represent indemnitee’s interests and participate in the defense of any such claims covered under this section.
For purposes of the Agreement, “Confidential Information” shall mean all data and information, of a confidential nature or otherwise, disclosed during the term of the Agreement by one party (“Disclosing Party”) to the other party (“Receiving Party”), as well as information that the Receiving Party knows or should know that the Disclosing Party regards as confidential including, but not limited to:
Advertiser recognizes that AdAction has proprietary relationships with its Publishers and Affiliates. Advertiser agrees not to circumvent AdAction’s relationship with such Publishers and Affiliates, or to otherwise solicit, purchase, contract for or obtain services similar to the Services performed by AdAction hereunder from any Publisher and/or Affiliate that is known, or should reasonably be known, by Advertiser to have such a relationship with AdAction, during the term of the Agreement and for six (6) months following termination or expiration of the Agreement. Notwithstanding the foregoing, to the extent that Advertiser can show that any such Publishers and Affiliates already provided such services to Advertiser prior to the date of the first IO executed by the parties, then Advertiser shall not be prohibited from continuing such relationship. Advertiser agrees that monetary damages for its breach, or threatened breach, of this Section 14 will not be adequate and that AdAction shall be entitled to:
17. Force Majeure
Other than with respect to payment obligations arising hereunder, neither party will be liable, or be considered to be in breach of this Agreement, on account of such party’s delay or failure to perform as required under the terms of the Agreement as a result of any causes or conditions that are beyond such party’s reasonable control and that such party is unable to overcome through the exercise of commercially reasonable diligence (a “Force Majeure Event”). If any such Force Majeure Event occurs including, without limitation, acts of God, fires, explosions, telecommunications, Internet or Affiliate Network failure, results of vandalism or computer hacking, storm or other natural occurrences, national emergencies, acts of terrorism, insurrections, riots, wars, strikes or other labor difficulties, or any act or omission of any other person or entity, the affected party will give the other party notice and will use commercially reasonable efforts to minimize the impact of any such event.
Assignment: Neither party may assign, transfer or delegate any of its rights or obligations under the Agreement or any IO without the prior written consent of the other party, and any attempts to do so shall be null and void; provided, however, that either party may assign the Agreement, any IO or any portion hereof/thereof, to:
Choice of Law/Venue: The Agreement shall be construed in accordance with and governed by the laws of the State of Colorado. Each party irrevocably waives, to the fullest lawful extent, all right to trial by jury in any proceeding relating to this agreement, the notes or the transactions they contemplate.
Modification: These Terms, any exhibits attached hereto, and any and all applicable IO(s) represent the complete and entire expression of the agreement between the parties, and shall supersede any and all other agreements, whether written or oral, between the parties. These Terms, any exhibits attached hereto, and any and all applicable IO(s) may be amended only by a written agreement executed by an authorized representative of each party. To the extent that anything in or associated with any IO is in conflict or inconsistent with these Terms, the IO shall take precedence.
Non-Waiver/Severability: No waiver of any breach of any provision of the Agreement shall constitute a waiver of any prior, concurrent or subsequent breach of the same or any other provisions hereof, and no waiver shall be effective unless made in writing and signed by an authorized representative of the waiving party. If any provision contained in the Agreement is determined to be invalid, illegal or unenforceable in any respect under any applicable law, then such provision will be severed and replaced with a new provision that most closely reflects the real intention of the parties, and the remaining provisions of the Agreement will remain in full force and effect.
No Additional Terms: In the event that AdAction is required to digitally sign, click-through or agree to additional terms using Advertiser’s website(s), Advertiser agrees that such digital terms, conditions, policies, or guidelines (“Online Terms”) are inconsequential and in no way binding; that they are the result of a technical requirement, which cannot be altered, in order to access the online service. Any such Online Terms which appear on Advertiser’s website(s) are to be disregarded and deemed non-effective, and shall be superseded by any contradicting terms of the Agreement.
Relationship of the Parties: The parties hereto are independent contractors. There is no relationship of partnership, agency, employment, franchise or joint venture between the parties. Neither party has the authority to bind the other, or incur any obligation on its behalf; provided, however, that AdAction acts as a limited agent of Advertiser for the sole purpose of performing the Services set forth in applicable IO(s).
Data Processing Addendum
Capitalized terms used in this Data Processing Addendum (“Addendum”) shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Advertiser Terms and Conditions and any applicable Insertion Order(s) (collectively, the “Agreement”). Except as modified below, the terms of the Agreement shall remain in full force and effect. The following obligations shall only apply to the extent required by Data Protection Laws with regard to the relevant Advertiser Personal Data, if applicable.
2. Roles of the Parties; Compliance . While providing the Services to Advertiser and Advertiser Affiliates pursuant to the Agreement, AdAction and AdAction Affiliates may Process Advertiser Personal Data on behalf of Advertiser or any Advertiser Affiliate as per the terms of the Agreement and this Addendum. The parties acknowledge and agree that, as between the parties, with regard to the Processing of Advertiser Personal Data under the Agreement, Advertiser is a Controller and AdAction is a Processor. In some circumstances, the parties acknowledge that Advertiser may be acting as a Processor to a third-party Controller in respect of Advertiser Personal Data, in which case AdAction will remain a Processor with respect to the Advertiser in such event. Each party will comply with the obligations applicable to it in such role under Data Protection Laws with respect to the Processing of Advertiser Personal Data.
3. Details of Processing . The parties acknowledge and agree that the nature and purpose of the Processing of Advertiser Personal Data, the types of Advertiser Personal Data Processed, the categories of Data Subjects, and other details regarding the Processing of Advertiser Personal Data are as set forth in Appendix 1.
4. Processing of Advertiser Personal Data . AdAction shall not Process Advertiser Personal Data other than on Advertiser’s documented instructions unless Processing is required by Data Protection Laws to which AdAction is subject, in which case AdAction shall to the extent permitted by Data Protection Laws inform Advertiser of that legal requirement before Processing Advertiser Personal Data. For the avoidance of doubt, the Agreement shall constitute documented instructions for the purposes of this Addendum. Advertiser hereby instructs AdAction to Process Advertiser Personal Data: (a) to provide the Services to Advertiser; (b) to perform its obligations and exercise its rights under the Agreement and this Addendum; and (c) as necessary to prevent or address technical problems with the Services. Advertiser’s instructions for the Processing of Advertiser Personal Data shall comply with Data Protection Laws. Advertiser shall be responsible for: (i) giving adequate notice and making all appropriate disclosures to Data Subjects regarding Advertiser’s use and disclosure and AdAction’s Processing of Advertiser Personal Data; and (ii) obtaining all necessary rights, and, where applicable, all appropriate and valid consents to disclose such Advertiser Personal Data to AdAction and to permit the processing of such Advertiser Personal Data by AdAction for the purposes of performing AdAction’s obligations under the Agreement or as may be required by Data Protection Laws. Advertiser shall notify AdAction of any changes in, or revocation of, the permission to use, disclose, or otherwise process Advertiser Personal Data that would impact AdAction’s ability to comply with the Agreement, this Addendum, or Data Protection Laws.
5. Processing Subject to the CCPA . As used in this Section, the terms “Sell,” “Share,” “Business Purpose,” and “Commercial Purpose” shall have the meanings given in the CCPA and “Personal Information” shall mean any personal information (as defined in the CCPA) contained in Advertiser Personal Data. AdAction will not: (a) Sell or Share any Personal Information; (b) retain, use, or disclose any Personal Information (i) for any purpose other than for the Business Purposes specified in the Agreement, including for any Commercial Purpose other than the Business Purposes specified in the Agreement, or as otherwise permitted by the CCPA, or (ii) outside of the direct business relationship between Advertiser and AdAction; or (c) combine Personal Information received from, or on behalf of, Advertiser with Personal Data received from or on behalf of any third party, or collected from AdAction’s own interaction with Data Subjects, except to perform any Business Purpose permitted by the CCPA. AdAction hereby certifies that it understands the foregoing restrictions under this Section and will comply with them. The parties acknowledge that the Personal Information disclosed by Advertiser to AdAction is provided to AdAction only for the limited and specified purposes set forth in Appendix 1. AdAction will comply with applicable obligations under the CCPA and provide the same level of privacy protection to Personal Information as is required by the CCPA. Advertiser has the right to take reasonable and appropriate steps to help ensure that AdAction uses the Personal Information transferred in a manner consistent with Advertiser’s obligations under the CCPA by exercising Advertiser’s audit rights in Section 13. AdAction will notify Advertiser if it makes a determination that Advertiser can no longer meet its obligations under the CCPA. If AdAction notifies Advertiser of unauthorized use of Personal Information, including under the foregoing sentence, Advertiser will have the right to take reasonable and appropriate steps to stop and remediate such unauthorized use by limiting the Personal Information shared with AdAction, terminating the portion of the Agreement relevant to such unauthorized use, or such other steps mutually agreed between the parties in writing.
6. Confidentiality . AdAction shall take reasonable steps to ensure that individuals that process Advertiser Personal Data are subject to obligations of confidentiality or are under an appropriate statutory obligation of confidentiality.
7. Security . Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, AdAction shall in relation to Advertiser Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with the security standards in Appendix 2 (the “Security Measures”). Advertiser agrees that, without limitation of AdAction’s foregoing obligations, Advertiser is solely responsible for its use of the Services, including: (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Advertiser Personal Data; and (b) securing any account authentication credentials, systems, and devices Advertiser uses to access or connect to the Services, where applicable. Without limiting AdAction’s obligations hereunder, Advertiser is responsible for reviewing the information made available by AdAction relating to data security and making an independent determination as to whether the Services meet Advertiser’s requirements and legal obligations under Data Protection Laws.
8. Subprocessing . AdAction may engage such Subprocessors as AdAction considers reasonably appropriate for the processing of Advertiser Personal Data in accordance with this Addendum, provided that AdAction shall notify Advertiser of the addition or replacement of such Subprocessor and Advertiser may, on reasonable grounds, object to a Subprocessor by notifying AdAction in writing within 10 days of receipt of AdAction’s notification, giving reasons for Advertiser’s objection. Upon receiving such objection, AdAction shall: (i) work with Advertiser in good faith to make available a commercially reasonable change in the provision of the Services which avoids the use of that proposed Subprocessor; and (ii) where such change cannot be made within 10 days of AdAction’s receipt of Advertiser’s notice, Advertiser may by written notice to AdAction with immediate effect terminate the portion of the Agreement or relevant IO to the extent that it relates to the Services which require the use of the proposed Subprocessor. This termination right is Advertiser’s sole and exclusive remedy to Advertiser’s objection of any Subprocessor appointed by AdAction. AdAction shall require all Subprocessors to enter into an agreement containing data protection obligations not less protective than those in this Addendum. AdAction shall remain fully liable for all the acts and omissions of each Subprocessor.
9. Data Subject Rights . In the event that any Data Subject exercises any of its rights under the Data Protection Laws in relation to Advertiser Personal Data, AdAction will advise the Data Subject to submit the request to Advertiser and Advertiser will be responsible for responding to any such request. Taking into account the nature of the Processing of Advertiser Personal Data and the functionality of the Services, AdAction will shall use reasonable commercial efforts to assist Advertiser in fulfilling its obligations as Controller following written request from Advertiser, provided that AdAction may charge Advertiser on a time and materials basis in the event that AdAction considers, in its reasonable discretion, that such assistance is onerous, complex, frequent, or time consuming.
10. Security Incidents . AdAction will notify Advertiser without undue delay after becoming aware of a confirmed Security Incident. Such notification may be delivered to an email address provided by Advertiser or by direct communication (for example, by phone call or an in-person meeting). Advertiser is solely responsible for ensuring that the appropriate notification contact details are current and valid. AdAction will take reasonable steps to provide Advertiser with information available to AdAction that Advertiser may reasonably require to comply with its obligations as Controller to notify impacted Data Subjects or Supervisory Authorities. Upon becoming aware of a confirmed Security Incident, AdAction will: (a) notify Advertiser of the Security Incident without undue delay after becoming aware of the Security Incident; and (b) take reasonable steps to identify the cause of such Security Incident, minimize harm, and prevent a recurrence. AdAction will take reasonable steps to provide Advertiser with information available to AdAction that Advertiser may reasonably require to comply with its obligations under Data Protection Laws. AdAction’s notification of or response to a Security Incident under this Section will not be construed as an acknowledgement by AdAction of any fault or liability with respect to the Security Incident.
11. Data Protection Impact Assessment and Prior Consultation . In the event that Advertiser considers that the Processing of Advertiser Personal Data requires a privacy impact assessment to be undertaken or requires assistance with any prior consultations to any Supervisory Authority of Advertiser, following written request from Advertiser, AdAction shall, taking into account the nature of AdAction’s Processing of Advertiser Personal Data and the information available to AdAction, use reasonable commercial efforts to provide relevant information and assistance to Advertiser to fulfil such request, provided that AdAction may charge Advertiser on a time and materials basis in the event that AdAction considers, in its reasonable discretion, that such assistance is onerous, complex, frequent, or time consuming.
12. Deletion or Return of Advertiser Personal Data . Unless otherwise required by applicable law, following termination or expiration of the Agreement AdAction shall, at Advertiser’s option, delete or return all Advertiser Personal Data and all copies to Advertiser.
13. Relevant Records and Audit Rights . AdAction shall make available to Advertiser on request all information reasonably necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections by Advertiser or an auditor mandated by Advertiser, not being competitors of AdAction (“Mandated Auditor”) of any premises where the Processing of Advertiser Personal Data takes place in order to assess compliance with this Addendum. AdAction shall provide reasonable cooperation to Advertiser in respect of any such audit and shall at the request of Advertiser, provide Advertiser with relevant records of compliance with its obligations under this Addendum. AdAction shall promptly inform Advertiser if, in its opinion, a request infringes the Data Protection Laws or any other confidentially obligations with AdAction’s other Advertisers. Advertiser agrees that: (i) audits may only occur during normal business hours, and where possible only after reasonable notice to AdAction (not less than 20 days’ advance written notice); (ii) audits will be conducted in a manner that does not have any adverse impact on AdAction’s normal business operations; (iii) Advertiser and any Mandated Auditor will comply with AdAction’s standard safety, confidentiality, and security procedures in conducting any such audits; and (iv) any records, data, or information accessed by Advertiser or any Mandated Auditor in the performance of any such audit will be deemed to be the Confidential Information of AdAction. To the extent any such audit incurs in excess of 20 hours of AdAction personnel time, AdAction may charge Advertiser on a time and materials basis for any such excess hours.
14. International Data Transfer . In the event that any Advertiser transfers to AdAction any Advertiser Personal Data that is subject to European Data Protection Laws,and and such transfer is not subject to an alternative adequate transfer mechanism under European Data Protection Laws or otherwise exempt from cross-border transfer restrictions, then Advertiser on behalf of itself and each Advertiser Affiliate as “data exporter” and AdAction on behalf of itself and each AdAction Affiliate as “data importer” agree that the applicable terms of the Standard Contractual Clauses shall apply to and govern such transfer and are hereby incorporated herein by reference, which terms shall take precedence over those in this Addendum. In the event that the Standard Contractual Clauses cease to be recognized as a legitimate basis for the transfer of Personal Data to an entity located outside the EEA, Advertiser shall cooperate with AdAction to identify and implement an alternative legitimate basis to the extent that one is required by the Data Protection Laws. The Standard Contractual Clauses shall come into effect on the later of: (i) the data exporter becoming a party to them; (ii) the data importer becoming a party to them; and (iii) commencement of the relevant transfer; and the Standard Contractual Clauses shall automatically terminate once the transfer becomes lawful under European Data Protection Laws in the absence of such Standard Contractual Clauses on any other basis.
15. General Terms . Any obligation imposed on AdAction under this Addendum in relation to the Processing of Advertiser Personal Data shall survive any termination or expiration of the Agreement and automatically expire upon AdAction’s deletion or return of all Advertiser Personal Data. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either: (i) amended as necessary to ensure its validity and enforceability, while preserving the intent of the provision as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein. With regard to the subject matter of this Addendum, the provisions of this Addendum shall prevail over the Agreement with regard to data protection obligations for Personal Data of a Data Subject under Data Protection Laws. Any liabilities arising in respect of this Addendum are subject to the limitations of liability under the Agreement. This Addendum will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws.
Appendix 1 to Data Processing Addendum
Details of Processing of Advertiser Personal Data
The subject matter and duration of the Processing are as described in the Agreement and the Addendum.
2. Nature and purpose of the Processing of Advertiser Personal Data
The nature of the Processing are those activities reasonably required to facilitate or support the provision of the Services as described in the Agreement and the Addendum.
The purpose of the Processing is the provision of the Services as described in the Agreement and the Addendum, and include the following business purposes:
3. The categories of Data Subjects to whom Advertiser Personal Data relates
The categories of Data Subjects shall be as is contemplated or related to the Processing described in the Agreement, and may include Advertiser’s authorized account users and its end customers.
4. The categories of Advertiser Personal Data
The categories of Advertiser Personal Data Processed are those categories contemplated in and permitted by Agreement, may include name, work address, account ID, email address and phone number of Users, and may and will include any data Advertiser chooses to include in post back data to AdAction, which may include advertising identifiers, device identifiers, location data, IP addresses, game play, in-app purchases, email address and and birth date of End Users.
5. The sensitive data included in Advertiser Personal Data
6. The frequency of Advertiser’s transfer of Advertiser Personal Data to AdAction:
If applicable, on a continuous basis for the term of the Agreement.
7. The period for which Advertiser Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:
As set forth in the Addendum or the Agreement.
8. For transfers to Subprocessors, the subject matter, nature and duration of the Processing of Advertiser Personal Data:
As set forth in the Addendum or the Agreement.
Appendix 2 to Data Processing Addendum
1. Information Security Program . Implement, maintain, and comply with information security policies and procedures designed to protect the confidentiality, integrity, and availability of Advertiser Personal Data and any systems that store or otherwise Process it, which are: (a) aligned with an industry-standard control framework (e.g., NIST SP 800-53, ISO 27001, CIS Critical Security Controls); (b) approved by executive management; (c) reviewed and updated at least annually; and (d) communicated to all personnel with access to Advertiser Personal Data.
2. Risk Assessment . Maintain risk assessment procedures for the purposes of periodic review and assessment of risks to the organization, monitoring and maintaining compliance with the organization’s policies and procedures, and reporting the condition of the organization’s information security and compliance to internal senior management.
3. Personnel Training . Train personnel to maintain the confidentiality, integrity, and availability of Advertiser Personal Data, consistent with the terms of the Agreement and Data Protection Laws.
4. Vendor Management . Prior to engaging Subprocessors and other subcontractors, conduct reasonable due diligence and monitoring to ensure subcontractors are capable of maintaining the confidentiality, integrity, and availability of Advertiser Personal Data.
5. Access Controls . Only authorized personnel and third parties are permitted to access Advertiser Personal Data. Maintain logical access controls designed to limit access to Advertiser Personal Data and relevant information systems (e.g., granting access on a need-to-know basis, use of unique IDs and passwords for all users, periodic review and revoking or changing access when employment terminates or changes in job functions occur).
6. Secure User Authentication . Maintain password controls designed to manage and control password strength, expiration, and usage. These controls include prohibiting users from sharing passwords and requiring that passwords controlling access to Advertiser Personal Data must: (a) be at least 8 characters in length and meet minimum complexity requirements; (b) not be stored in readable format on the organization’s computer systems; (c) have a history threshold to prevent reuse of recent passwords; and (d) if newly issued, be changed after first use.
7. Incident Detection and Response . Maintain policies and procedures to detect and respond to actual or reasonably suspected Security Incidents, and encourage the reporting of such incidents.
8. Vulnerability Management . Detect, assess, mitigate, remove, and protect against new and existing security vulnerabilities and threats, including viruses, bots, and other malicious code, by implementing vulnerability management, threat protection technologies, and scheduled monitoring procedures.
9. Physical Security . Take steps to ensure the physical and environmental security of data centers, server room facilities and other areas containing Advertiser Personal Data, including by: (a) protecting information assets from unauthorized physical access; (b) managing, monitoring, and logging movement of persons into and out of the organization’s facilities; and (c) guarding against environmental hazards such as heat, fire, and water damage.
10. Business Continuity and Disaster Recovery . Maintain business continuity and disaster recovery policies and procedures designed to maintain service and recover from foreseeable emergency situations or disasters.
Appendix 3 to Data Processing Addendum
Standard Contractual Clauses
1. Application of Modules . If Advertiser is acting as a Controller with respect to Advertiser Personal Data, “Module Two: Transfer controller to processor” of the Standard Contractual Clauses shall apply. If Advertiser is acting as a Processor to a third-party Controller with respect to Advertiser Personal Data, AdAction is a sub-Processor and “Module Three: Transfer processor to processor” of the Standard Contractual Clauses shall apply.
2. Sections I-V. The parties agree to the following selections in Sections I-IV of the Standard Contractual Clauses: (a) the parties select Option 2 in Clause 9(a) and the specified time period shall be the notification time period set forth in Section 8 of the Addendum; (b) the optional language in Clause 11(a) is omitted; (c) the parties select Option 1 in Clause 17 and the governing law of the Republic of Ireland will apply; and (d) in Clause 18(b), the parties select the courts of the Republic of Ireland.
3. Annexes. The name, address, contact details, activities relevant to the transfer, and role of the parties set forth in the Agreement and the Addendum shall be used to complete Annex I.A. of the Standard Contractual Clauses. The information set forth in Appendix 1 to the Addendum shall be used to complete Annex I.B. of the Standard Contractual Clauses. The competent supervisory authority in Annex I.C. of the Standard Contractual Clauses shall be the relevant supervisory authority determined by Clause 13 and the GDPR, unless otherwise set forth in Sections 5 or 6 of this Appendix 3. If such determination is not clear, then the competent supervisory authority shall be the Irish Data Protection Authority. The technical and organizational measures in Annex II of the Standard Contractual Clauses shall be the measures set forth in Appendix 2 to the Addendum.
4. Supplemental Business-Related Clauses. In accordance with Clause 2 of the Standard Contractual Clauses, the parties wish to supplement the Standard Contractual Clauses with business-related clauses, which shall neither be interpreted nor applied in such a way as to contradict the Standard Contractual Clauses (whether directly or indirectly) or to prejudice the fundamental rights and freedoms of Data Subjects. AdAction and Advertiser therefore agree that the applicable terms of the Agreement and the Addendum shall apply if, and to the extent that, they are permitted under the Standard Contractual Clauses, including without limitation the following:
5. Transfers from the United Kingdom . If Advertiser transfers Advertiser Personal Data to AdAction that is subject to UK Data Protection Laws, the parties acknowledge and agree that: (a) the template addendum issued by the Information Commissioner’s Office of the United Kingdom and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022 (available at: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf), as it may be revised from time to time by the Information Commissioner’s Office (the “UK Addendum”) shall be incorporated by reference herein; (b) the UK Addendum shall apply to and modify the Standard Contractual Clauses solely to the extent that UK Data Protection Laws apply to Advertiser’s Processing when making the transfer; (c) the information required to be set forth in “Part 1: Tables” of the UK Addendum shall be completed using the information provided in this Appendix 3 and the Addendum; and (d) either party may end the UK Addendum in accordance with section 19 thereof.
6. Transfers from Switzerland. If Advertiser transfers Advertiser Personal Data to AdAction that is subject to the Swiss FADP, the following modifications shall apply to the Standard Contractual Clauses to the extent that the Swiss FADP applies to Advertiser’s Processing when making that transfer: (a) the term “member state” as used in the Standard Contractual Clauses shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from suing for their rights in their place of habitual residence in accordance with Clause 18(c) of the Standard Contractual Clauses; (b) the Standard Contractual Clauses shall also protect the data of legal entities until the entry into force of the revised Swiss FADP on or about 1 September 2023; (c) references to the GDPR or other governing law contained in the Standard Contractual Clauses shall also be interpreted to include the Swiss FADP; and (d) the parties agree that the supervisory authority as indicated in Annex I.C of the Standard Contractual Clauses shall be the Swiss Federal Data Protection and Information Commissioner.