Publisher Connect Addendum

In addition to the Publisher Services Agreement, the following terms and conditions additionally apply to Connect.

1. License Grant. Publisher hereby grants to PubMatic a non-exclusive, worldwide, sublicensable license during the Term to use, host, syndicate, publicly display, sell, market, create algorithms based on, and modify the Audience Data for its own behalf and/or on behalf of Publisher for the purposes of (a) using the Audience Data to create, deliver, analyze, model, plan, optimize, and report on advertising campaigns, audiences and segments for targeted private marketplace packages for PubMatic Customers; and (b) providing the PubMatic Products for Publisher’s benefit.
   1. Required Consents. Publisher shall be solely responsible at no cost to PubMatic for procuring and maintaining during the Term all necessary and applicable rights, consents, licenses, and clearances with respect to the Audience Data as necessary for PubMatic and the PubMatic Customers to exercise the rights and licenses granted by Publisher herein.
   2. Restrictions. PubMatic shall not make the Audience Data available to any third party in raw and an unmodified form. PubMatic shall implement administrative, physical and technical safeguards to protect the Audience Data from unauthorized access, loss or disclosure that are no less rigorous than accepted industry standards and using reasonable care. PubMatic shall notify Publisher promptly in the event PubMatic learns of any unauthorized access, loss or disclosure of any Audience Data, and will reasonably cooperate with Publisher in any proceeding against any third parties necessary to protect Publisher’s rights with respect to the Audience Data. PubMatic shall retain the right to discontinue offering any of the Audience Data at any time in the event that Audience Data violates the terms of this Agreement or does not generate any Data Revenue.
2. Data Protection Addendum. To the extent applicable, the Connect Data Protection Addendum shall form part of this Agreement and its terms are hereby incorporated in the Agreement by reference.
   1. Processing of Personal Data Relating to Select U.S. Residents.
      1. Use Instructions and Limitations. Publisher instructs the following in connection with PubMatic’s Processing of Personal Data relating to residents of California, Colorado, Connecticut, Utah, and Virginia or other US States as may be applicable:
         1. PubMatic shall use, retain, disclose, or otherwise process Personal Data only on behalf of Publisher and for the specific business purpose of providing the Services and in accordance with Publisher’s instructions, including as described in the Agreement. PubMatic shall not Sell or Share Personal Data, as “Sell” and “Share” are defined in the CCPA and other applicable Data Protection and Privacy Requirements, nor use, retain, disclose, or otherwise process Personal Data outside of its business relationship with Publisher or for any other purpose except as required by law. PubMatic will inform Publisher in the time period required by applicable Data Protection Law if PubMatic determines that it is no longer able to meet its obligations under Data Protection and Privacy Requirements or where, in PubMatic’s reasonable opinion, any of Publisher’s instructions infringes any Data Protection and Privacy Requirements. Publisher reserves the right to take reasonable and appropriate steps to discontinue and remediate unauthorized use of Personal Data.
         2. PubMatic shall have rights to use Personal Data solely (i) to the extent necessary to (a) perform its obligations under this Agreement; (b) operate, manage, test, maintain and enhance the Services including as part of its business operations; (c) to disclose aggregate statistics about the Services in a manner that prevents individual identification or re-identification of Publisher, Publisher Data, or Personal Data, including without limitation any individual device, or individual person; and/or (d) protect the Services from a threat to the Services or Personal Data; (ii) if required by order of a court or authorized governmental agency, provided that prior notice first be given to Publisher, or (iii) as otherwise expressly authorized by Publisher.
         3. PubMatic will not combine Personal Data it processes on Publisher’s behalf with Personal Data it receives from or on behalf of another person or persons, or that it collects from its own interactions with individuals, provided that PubMatic may combine Personal Data to perform any business purpose permitted or required under the Agreement to perform the Services.
      2. Third Parties. To the extent PubMatic processes the Personal Data of California residents as a “Third Party,” as “Third Party” is defined under the CCPA, § 1798.100 et. seq., this Section 2.1.2, will apply instead of Section 2.1.1 for such processing conducted as a Third Party: PubMatic may process Personal Data only for the limited and specified purposes described in the Agreement and related Schedules, Service Orders, and/or Statements of Work. PubMatic must comply with all applicable Data Protection and Privacy Requirements, including all applicable sections of the CCPA and provide the same level of privacy protection as required of businesses by the CCPA. Among these, PubMatic must comply with consumer requests to opt out of Sale or Sharing forwarded by Publisher. Where PubMatic is providing Services that includes the collection of Personal Data on either Publisher or PubMatic’s behalf on a Publisher-managed website, PubMatic shall check for and comply with the website visitor’s opt-out preference signal unless otherwise informed by Publisher that such website visitor has consented to the Sale or Sharing of their Personal Data. Publisher shall forward consumer requests to PubMatic via the instructions provided on https://pubmatic.com/legal/dsr-notice. PubMatic will inform Publisher in the time period required by applicable Data Protection Law if PubMatic determines that it is no longer able to meet its obligations under Data Protection and Privacy Requirements or where, in PubMatic’s reasonable opinion, any of Publisher’s instructions infringes any Data Protection and Privacy Requirements. Publisher reserves the right to take reasonable and appropriate steps to discontinue and remediate unauthorized use of Personal Data.
      3. Deidentification. Where PubMatic is permitted by applicable Data Protection and Privacy Requirements or this Section 2.1 to use Publisher Personal Data for its internal business purposes in an aggregated and deidentified manner, PubMatic agrees to take reasonable measures designed to ensure that the Personal Data cannot be associated with an individual (or, household, where applicable), publicly commits to maintain and use the information in de-identified form only and make no attempt to re-identify the information except where necessary to test its de-identification processes, and contractually obligates any authorized recipients to comply with these obligations.
      4. Certification. PubMatic certifies that it understands these obligations and restrictions and will comply with them.
      5. DOJ Bulk Sensitive Data Rules. This Section 2.1.5 applies solely in instances where PubMatic provides Publisher with access to personal data (such as when PubMatic facilitates access for the Publisher’s generation of its Licensed Content). Solely for purposes of this Section 2.1.5, the terms “access,” “country of concern,” and “covered person” shall have the meanings ascribed to them in 28 CFR Part 202 Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (“DOJ Bulk Sensitive Data Rules”).
         1. Publisher represents and warrants that it is not a covered person or country of concern. Publisher will immediately notify PubMatic if it foresees a change that would cause it to become such a covered person or country of concern.
         2. Without limitation to Publisher’s other obligations under the Agreement, when accessing personal data through PubMatic (including via pixel placement), Publisher shall not: (x) transfer any such personal data to, or otherwise enable access to such personal data by (1) a covered person or country of concern or (2) absent equivalent protections to this Section 2.1.5, any subcontractor, affiliate, or third party; or (y) engage in any activity or conduct that would result in a violation of the DOJ Bulk Sensitive Data Rules by Publisher or PubMatic. Publisher shall promptly report to PubMatic any known or suspected violations of this Section 2.1.5.
         3. PubMatic may immediately suspend Publisher’s access to any personal data or any portion thereof and terminate the Agreement (x) upon receipt of Publisher’s notice or report, or (y) if PubMatic believes that Publisher has failed to comply with this Section and/or is using the personal data in a manner that violates any applicable laws or regulation, or that would otherwise damage PubMatic’s customers, partners, business, or reputation.
3. Publisher Obligations. Publisher will perform its obligations under this Agreement, including with respect to the collection and provision of Audience Data as contemplated hereby, in compliance with all applicable laws, rules and regulations.
   1. Publisher shall ensure that the Publisher Properties and each of the sources of Audience Data: (i) contain a privacy policy that clearly and conspicuously discloses the collection, provision and use (including, without limitation, the use contemplated by this Agreement) of Audience Data, including descriptions of data collection for interest-based advertising, as applicable, (ii) provide a conspicuous mechanism by which End Users may opt out of interest-based advertising, as applicable and/or required by law, rule, or regulation, and (iii) to the extent required by applicable law, rule or regulation, obtain, with respect to Publisher’s services, End Users’ prior and informed consent to the use, collection and sharing of the Audience Data as contemplated by this Agreement.
   2. Publisher will not pass or make available to PubMatic as part of Audience Data: (i) Personal Directory Data or (ii) Sensitive Personal Data.
   3. Publisher will not pass or make available to PubMatic, or will immediately inform PubMatic if it previously provided, any data relating to an End User in the event that Publisher knows that such End User has opted out of interest-based or cross-app advertising, the uses of Audience Data contemplated by this Agreement, or the services provided by Publisher.
4. ADDITIONAL REPRESENTATIONS AND WARRANTIES. Publisher represents and warrants that (i) the Audience Data does not, and will not, infringe, violate, or misappropriate the Intellectual Property rights of any third party; (ii) it has all required consents described in Section 1.1; (iii) the Audience Data will meet the requirements of this Addendum (iv) it will comply with all applicable laws, rules, and regulations, including privacy laws and regulations, in its collection, storage, sharing and use of the Audience Data; and (v) the collection, provision and use of Audience Data as contemplated hereby do not, and will not, (a) violate the terms of any privacy policy or other disclosure made at the time of collection, or (b) violate the terms of service of any operating system or platform (including, without limitation, iOS or Android), web site, application or other source of Audience Data.
5. Publisher indemnification Publisher agrees to indemnify, defend, and hold PubMatic and its directors, officers, shareholders, employees, affiliates, and agents harmless from and against any liabilities, damages, losses, or expenses (including reasonable attorneys’ fees) arising out of any claim, demand, action, or proceeding initiated by a third party that is based upon, arises out of, or relates to the alleged or actual breach of any of Publisher’s representations and warranties set forth Publisher herein, and the use by PubMatic or the PubMatic Customers of the Audience Data as contemplated in this Agreement; provided, however, that PubMatic: (i) promptly notifies Publisher in writing of the claim, except that any failure to provide this notice promptly only relieves Publisher of its responsibility pursuant to this Section to the extent its defense is materially prejudiced by the delay; (ii) grants Publisher sole control of the defense and/or settlement of the claim; provided Publisher uses legal counsel reasonably acceptable to PubMatic; and (iii) provides Publisher, at Publisher’s expense, with all assistance, information and authority reasonably required for the defense and/or settlement of the claim. Publisher shall not settle any claim in a manner that adversely affects the rights of PubMatic without PubMatic’s prior written consent, which consent shall not be unreasonably withheld or delayed. PubMatic may participate in and observe the proceedings at its own cost and expense with legal counsel of its own choosing.

DEFINITIONS.

“Audience Data” means any data owned or licensed by Publisher that is delivered or otherwise made available to PubMatic pursuant to this Agreement.

“Connect Data Protection Addendum” means the data protection addendum located at https://pubmatic.com/legal/connect-data-protection-addendum/.

“Data Revenue” means gross revenue earned by Publisher for the data on sales of impressions via the PubMatic Products.

“End User” means a specific natural person who uses the Publisher Properties.

“Intellectual Property” includes trade secrets, copyrights, trademarks, patents, logos, service marks, inventions, technology, Confidential Information, and other proprietary materials.

“Personal Data” shall have the meaning of this term or any similar term (such as “personal information” or “personally identifiable information”) under the relevant applicable privacy or Data Protection and Privacy Requirements, or where no such laws apply, shall mean any information that by itself or when combined with other information (such as name, address, telephone number, e-mail address, precise geo location, financial account number, and government-issued identification number) can be used to identify a specific natural person.

“Personal Directory Data” means calendar, address book, phone/text log, or photo/video file data (including any associated metadata), or similar data created by a user that is stored on or accessed through a device.

“Publisher Properties” means Publisher owned, operated and/or controlled web or mobile properties or other sources of data for Publisher.

“PubMatic Customer” means any PubMatic customer, publisher, demand partner, agency, or advertiser that receives Audience Data from PubMatic.

“PubMatic Products” means the online advertising services owned, operated, or provided by PubMatic through which Audience Data shall be utilized in accordance with the rights and licenses granted herein.

“Sensitive Personal Data” shall have the meaning relating to this term or any similar term (such as “sensitive personal information”) under relevant Data Protection and Privacy Requirements, or where no such laws apply, shall mean, with respect to a specific natural person, medical or health information (including information about health conditions or treatments), financial information (including financial account information and number), sexual orientation, social security number or other government-issued identifiers, and personal information of children protected under any applicable child protection laws (such as the personal information defined under the United States Children’s Online Privacy Protection Act of 1998 (“COPPA”).

“Term” means the Initial Term and any Renewal Terms.

“Wind-Down Period” is defined as a 90 day period after the termination date of this Agreement during which Publisher will continue to provide Audience Data to PubMatic and the PubMatic Customers, at PubMatic’s option.