Demand Partner Audience Fastlane Addendum

In addition to the Demand Services Agreement between Demand Partner and PubMatic (the “Agreement”), the following terms and conditions additionally apply to Demand Partner’s participation in PubMatic’s Audience Fastlane program. Capitalized terms not defined herein shall have the meanings set forth in the Agreement.

1. License Grant. Demand Partner hereby grants to PubMatic a non-exclusive, right and license during the Term to use, , host, integrate, display, sell, market, create derivatives of, create algorithms of the Audience Data on behalf of Demand Partner for the purposes of (a) using the Audience Data to create, deliver, analyze, model, plan, and optimize advertising campaigns, audiences and segments, and interest-based and cross-app advertising; (b) providing the Demand Services for Demand Partner’s benefit; and (c) ad delivery, analytics and reporting.
   1. Required Consents. Demand Partner shall be solely responsible at no cost to PubMatic for (a) procuring and maintaining during the Term all necessary and applicable rights, consents, licenses, and clearances with respect to the Audience Data as necessary for PubMatic to exercise the rights and licenses granted by Demand Partner herein (“Required Consents”) and (b) paying to any interested third parties all required royalties, clearance costs, and fees relating to or arising out of any Required Consents.
   2. Restrictions. PubMatic shall not make the Audience Data available to any third party in raw and unmodified form. PubMatic shall implement administrative, physical, and technical safeguards to protect the Audience Data from unauthorized access, loss, or disclosure that are no less rigorous than accepted industry standards and using reasonable care. PubMatic shall notify Demand Partner promptly in the event PubMatic learns of any unauthorized access, loss, or disclosure of any Audience Data, and will reasonably cooperate with Demand Partner in any proceeding against any third parties necessary to protect Demand Partner’s rights with respect to the Audience Data. PubMatic shall retain the right to discontinue processing any of the Audience Data at any time in the event that the Audience Data violates the terms of this Addendum or applicable law.
2. Data Protection Addendum. To the extent applicable, the Connect Data Protection Addendum shall form part of this Agreement and its terms are hereby incorporated in the Agreement by reference.
   1. Processing of Personal Data Relating to Select U.S. Residents.
      1. Use Instructions and Limitations. Demand Partner instructs the following in connection with PubMatic’s Processing of Personal Data relating to residents of California, Colorado, Connecticut, Utah, and Virginia or other US states as may be applicable:
         1. PubMatic shall use, retain, disclose, or otherwise process Personal Data only on behalf of Demand Partner and for the specific business purpose of providing the Demand Services and in accordance with Demand Partner’s instructions, including as described in this Addendum. PubMatic shall not Sell or Share Personal Data, as “Sell” and “Share” are defined in the CCPA and other Data Protection Laws, nor use, retain, disclose, or otherwise process Personal Data outside of its business relationship with Demand Partner or for any other purpose except as required by law. PubMatic will inform Demand Partner in the time period required by applicable Data Protection Laws if PubMatic determines that it is no longer able to meet its obligations under the applicable Data Protection Laws or where, in PubMatic’s reasonable opinion, any of Demand Partner’s instructions infringes any applicable Data Protection Laws. Demand Partner reserves the right to take reasonable and appropriate steps to discontinue and remediate unauthorized use of Personal Data.
         2. PubMatic shall have rights to use Personal Data solely (i) to the extent necessary to (a) perform its obligations under this Addendum; (b) operate, manage, test, maintain, and enhance the Demand Services including as part of its business operations; (c) disclose aggregate statistics about the Demand Services in a manner that prevents individual identification or re-identification of Demand Partner, Audience Data, or Personal Data, including without limitation any individual device or individual person; and/or (d) protect the Demand Services from a threat to the Demand Services or Personal Data; (ii) if required by order of a court or authorized governmental agency, provided that prior notice first be given to Demand Partner; or (iii) as otherwise expressly authorized by Demand Partner.
         3. PubMatic will not combine Personal Data it processes on Demand Partner’s behalf with Personal Data it receives from or on behalf of another person or persons, or that it collects from its own interactions with individuals, provided that PubMatic may combine Personal Data to perform any business purpose permitted or required under this Addendum to perform the Demand Services.
      2. Third Parties. To the extent PubMatic processes the Personal Data of California residents as a “Third Party,” as “Third Party” is defined under the CCPA, § 1798.100 et. seq., this Section 2.1.2 will apply instead of Section 2.1.1 for such processing conducted as a Third Party: PubMatic may process Personal Data only for the limited and specified purposes described in this Addendum and related Schedules, Service Orders, and/or Statements of Work. PubMatic must comply with all applicable Data Protection Law, including all applicable sections of the CCPA and provide the same level of privacy protection as required of businesses by the CCPA. Among these, PubMatic must comply with consumer requests to opt out of Sale or Sharing forwarded by Demand Partner. Where PubMatic is providing the Demand Services that includes the collection of Personal Data on either Demand Partner or PubMatic’s behalf on a Demand Partner-managed website, PubMatic shall check for and comply with the website visitor’s opt-out preference signal unless otherwise informed by Demand Partner that such website visitor has consented to the Sale or Sharing of their Personal Data. Demand Partner shall forward consumer requests to PubMatic via the instructions provided on https://pubmatic.com/legal/dsr-notice. PubMatic will inform Demand Partner in the time period required by applicable Data Protection Law if PubMatic determines that it is no longer able to meet its obligations under Data Protection Law or where, in PubMatic’s reasonable opinion, any of Demand Partner’s instructions infringes any Data Protection Law. Demand Partner reserves the right to take reasonable and appropriate steps to discontinue and remediate unauthorized use of Personal Data.
      3. Deidentification. Where PubMatic is permitted by applicable Data Protection Law or this Addendum to use Demand Partner Personal Data for its internal business purposes in an aggregated and deidentified manner, PubMatic agrees to take reasonable measures designed to ensure that the Personal Data cannot be associated with an individual (or household, where applicable), publicly commits to maintain and use the information in de-identified form only and make no attempt to re-identify the information except where necessary to test its de-identification processes, and contractually obligates any authorized recipients to comply with these obligations.
      4. Certification. PubMatic certifies that it understands these obligations and restrictions and will comply with them.
3. Demand Partner Obligations. Demand Partner will perform its obligations under this Addendum, including with respect to the collection and provision of Audience Data as contemplated hereby, in compliance with all applicable laws, rules, and regulations.
   1. Demand Partner shall ensure that each of the sources of Audience Data: (i) is subject to a privacy policy that clearly and conspicuously discloses the collection, provision and use (including, without limitation, the use contemplated by this Addendum) of Audience Data, including descriptions of data collection for interest-based advertising, as applicable, (ii) provides a conspicuous mechanism by which end users may opt out of interest-based advertising, as applicable and/or required by law, rule, or regulation, and (iii) to the extent required by applicable law, rule or regulation, obtain, end users’ prior and informed consent to the use, collection and sharing of the Audience Data as contemplated by this Addendum.
   2. Demand Partner will not pass or make available to PubMatic as part of Audience Data: (i) Personal Directory Data or (ii) Sensitive Personal Data.
   3. Demand Partner will not pass or make available to PubMatic, or will immediately inform PubMatic if it previously provided, any data relating to an end user in the event that Demand Partner knows that such end user has opted out of interest-based or cross-app advertising, the uses of Audience Data contemplated by this Addendum, or the services provided by Demand Partner.
4. Additional Representations and Warranties. Demand Partner represents and warrants that (i) the Audience Data does not, and will not, infringe, violate, or misappropriate the Intellectual Property rights of any third party; (ii) it has all Required Consents described in Section 1.1; (iii) the Audience Data will meet the requirements of this Addendum; (iv) it will comply with all applicable laws, rules, and regulations, including privacy laws and regulations, in its collection, storage, sharing and use of the Audience Data; and (v) the collection, provision and use of Audience Data as contemplated hereby do not, and will not, (a) violate the terms of any privacy policy or other disclosure made at the time of collection, or (b) violate the terms of service of any operating system or platform (including, without limitation, iOS or Android), web site, application or other source of Audience Data.
5. Demand Partner Indemnification. Demand Partner agrees to indemnify, defend, and hold PubMatic and its directors, officers, shareholders, employees, affiliates, and agents harmless from and against any liabilities, damages, losses, or expenses (including reasonable attorneys’ fees) arising out of any claim, demand, action, or proceeding initiated by a third party that is based upon, arises out of, or relates to the alleged or actual breach of any of Demand Partner’s representations and warranties set forth herein, and the use by PubMatic of the Audience Data as contemplated in this Addendum; provided, however, that PubMatic: (i) promptly notifies Demand Partner in writing of the claim, except that any failure to provide this notice promptly only relieves Demand Partner of its responsibility pursuant to this Section to the extent its defense is materially prejudiced by the delay; (ii) grants Demand Partner sole control of the defense and/or settlement of the claim, provided Demand Partner uses legal counsel reasonably acceptable to PubMatic; and (iii) provides Demand Partner, at Demand Partner’s expense, with all assistance, information and authority reasonably required for the defense and/or settlement of the claim. Demand Partner shall not settle any claim in a manner that adversely affects the rights of PubMatic without PubMatic’s prior written consent, which consent shall not be unreasonably withheld or delayed. PubMatic may participate in and observe the proceedings at its own cost and expense with legal counsel of its own choosing.
6. Exception To Demand Services Agreement; Fees; Termination.
   1. Exception to Demand Services Agreement. Notwithstanding Section 3.2.4 of the Demand Services Agreement, Demand Partner may share Audience Data with PubMatic solely for purposes of Audience Fastlane participation in accordance with this Addendum.
   2. Fees. Audience Fastlane participation is provided at no additional fee to Demand Partner beyond the payment otherwise payable under the Demand Services Agreement.
   3. Termination. Either party may terminate this Addendum at any time upon thirty (30) days’ written notice to the other party. PubMatic may also terminate this Addendum immediately upon written notice if Demand Partner breaches any provision of this Addendum. Termination of this Addendum does not terminate the Demand Services Agreement, and Demand Partner may continue to use the Demand Services in accordance with the Demand Services Agreement.
   4. Survival. Sections 4, 5, and 6.3 shall survive termination of this Addendum.

DEFINITIONS.

“Audience Data” means any data owned or licensed by Demand Partner that is delivered or otherwise made available to PubMatic pursuant to this Addendum.

“Audience Fastlane” means the “Connect” program as offered to Demand Partner described at https://pubmatic.com/legal/program-descriptions.

“Connect Data Protection Addendum” means the PubMatic – Data Processing Addendum for Connect located at https://pubmatic.com/legal/pubmatic-connect-data-provider-agreement/.

“Data Protection Laws” means all applicable local, state, federal, or international laws, regulations, or treaties relating to the privacy, security, or protection of Personal Data, as may be defined in such laws, including the European Area Law, U.S. state privacy laws, such as the California Consumer Protection Act (“CCPA”), § 1798.100 et. seq., and any subsequent supplements, amendments, or replacements to the same.

“Intellectual Property” includes trade secrets, copyrights, trademarks, patents, logos, service marks, inventions, technology, Confidential Information, and other proprietary materials.

“Personal Data” shall have the meaning of this term or any similar term (such as “personal information” or “personally identifiable information”) under the relevant applicable privacy or Data Protection Laws, or where no such laws apply, shall mean any information that by itself or when combined with other information (such as name, address, telephone number, e-mail address, precise geo location, financial account number, and government-issued identification number) can be used to identify a specific natural person.

“Personal Directory Data” means calendar, address book, phone/text log, or photo/video file data (including any associated metadata), or similar data created by a user that is stored on or accessed through a device.

“Sensitive Personal Data” shall have the meaning relating to this term or any similar term (such as “sensitive personal information”) under relevant Data Protection and Privacy Requirements, or where no such laws apply, shall mean, with respect to a specific natural person, medical or health information (including information about health conditions or treatments), financial information (including financial account information and number), sexual orientation, social security number or other government-issued identifiers, and personal information of children protected under any applicable child protection laws (such as the personal information defined under the United States Children’s Online Privacy Protection Act of 1998 (“COPPA“).