Publisher Data Protection Addendum

Publisher Data Protection Addendum

Last Updated: April 5, 2024

This Data Protection Addendum (“Addendum“) is entered into by and between PubMatic, Inc. (“PubMatic“) and you (“Publisher”), and forms part of all agreements between the parties relating to the subject matter of this Addendum (each, an “Agreement”). This Addendum is effective as of the date on which the Addendum is signed or otherwise adopted by both parties (“Effective Date”).

The terms in this Addendum shall only apply to the extent PubMatic collects or otherwise processes Data (including Personal Data) protected or otherwise regulated by Data Protection Law. Capitalized terms used in this Addendum shall have the meaning given to them in the main body of the Agreement unless otherwise defined in this Addendum.

IT IS AGREED:

1. Definitions

“Adequacy Mechanism” has the meaning described in Section 9.

“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code. § 1798.100 et. seq., as amended by the California Privacy Rights Act 2020.

“Controller” means the entity that determines the purposes and means of the processing of Personal Data.

“Data” has the meaning given to it in Section 2 of this Addendum.

“Data Privacy Framework” means the EU-US, UK Extension to the EU-US and Swiss-US Data Privacy Framework (“DPF”) Program as set forth by the US Department of Commerce, European Commission, UK Government, and Swiss Federal Administration, and which regards the collection, use and retention of personal information from the EU, UK and Switzerland.

“Data Protection Law” means as any international, federal, state, or local laws, regulations, or treaties applicable to a party in its Processing of Data, including but not limited to: (i) Regulation 2016/679 (the European General Data Protection Regulation (“GDPR”); (ii) the EU e-Privacy Directive (Directive 2002/58/EC) (“e-Privacy Directive”); (iii) all national implementations of (i) and (ii); (iv) the Swiss Federal Data Protection Act of 19 June 1992 and its corresponding ordinances (“Swiss DPA“); and (v) in respect of the United Kingdom, GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 the (together, “UK Privacy Law“); and (v) State Privacy Laws, in each case, as may be amended, superseded or replaced from time to time.

“Demand Partners” means PubMatic’s media buying clients, including but not limited to advertisers, demand side platforms, ad exchanges, agencies, agency trading desks, and ad networks.

“Europe” means, for the purposes of this DPA, the European Economic Area (EEA), the United Kingdom, and Switzerland.

“Personal Data” means any information relating to an identified or identifiable natural person to the extent that such information is protected as “personal data” under applicable Data Protection Law.

“Privacy Requirements” means: (i) Data Protection Law, as applicable to Publisher, PubMatic, its Demand Partners, and their respective processing of Data under this Addendum; and (ii) any applicable self-regulatory codes, rules or guidelines, including without limitation, the rules, codes and guidelines of the European Interactive Digital Advertising Alliance (EDAA), the Digital Adverising Alliance (DAA), the Network Advertising Initiative (NAI), and IAB Transparency and Consent Framework (TCF) (in each case, as amended, superseded or replaced).

“Publisher Property” has the meaning given to it in the Agreement or, if not set forth in the Agreement, means the websites, mobile applications and/or other digital media properties owned or operated by the Publisher and accessible through the PubMatic ProductsProducts or via which Personal Data used in connection with the PubMatic Products is collected.

“PubMatic Products” has the meaning given to it in the Agreement or if not set forth in the Agreement, means PubMatic’s online advertising services, products, and features described at https://pubmatic.com/legal/program-descriptions.

“Restricted Transfer” means: (i) where the GDPR applies, a transfer of Personal Data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; (ii) where the UK Privacy Law applies, a transfer of Personal Data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of Personal Data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.

“State Privacy Laws” means the CCPA, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring of 2022, the Indiana Consumer Data Protection Act, the Iowa Act Relating to Consumer Data Protection of 2023, the Montana Consumer Data Privacy Act, the Tennessee Information Protection Act, the Utah Consumer Privacy Act of 2022, and the Virginia Consumer Data Protection Act, and other additional U.S. state privacy laws enacted, in each case as amended and including any regulations promulgated thereunder.

“Tracking Technologies” means technologies used to store or gain access to data stored on a user’s device, including (as applicable), cookies, mobile SDKs, browser cache, unique identifiers, web beacons, pixels and/or similar tracking technologies.

“PubMatic Privacy Policy” means the PubMatic privacy policy available on PubMatic’s public facing website, the most current version of which is available at www.pubmatic.com/privacy-policy (as updated or amended from time to time).

“Standard Contractual Clauses” means Module 1 (Controller to Controller) of the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 located at https://ec.europa.eu/info/system/files/1_en_annexe_acte_autonome_cp_part1_v5_0.pdf.

“UK Addendum” means the International Data Transfer Addendum (version B1.0) to the EU Commission Standard Contractual Clauses issued by UK Information Commissioners Office under S.119(A) of the UK Data Protection Act 2018, as amended, superseded or replaced from time to time.

The terms “data subject“, “processing” (and “process“) shall have the meanings given to them in European Data Protection Law.

The terms “Sell” and “Share” shall have the meanings given to them in the CCPA.

1. Scope of processing: Unless otherwise and separately agreed between the parties, the parties agree and understand that: (i) in connection with the PubMatic Products, PubMatic may collect or otherwise receive data (including Personal Data) about or related to end users of the Publisher Properties as more particularly described in Annex A of this Addendum (collectively, “Data”); (ii) PubMatic and its Demand Partners use Tracking Technologies in order to collect certain Data; and (iii) PubMatic (and its Demand Partners) may process the Data for the purposes contemplated by the Agreement and for any other purposes described in the PubMatic Privacy Policy (“Permitted Purposes”).
2. Relationship of the parties: The parties acknowledge that to the extent the Data is Personal Data, each party shall process such Data as a Controller and in PubMatic’s case, only for the Permitted Purposes.
3. Requesting Consent: Neither PubMatic nor its Demand Partners has a direct relationship with any data subject visiting the Publisher Properties or viewing ads delivered to the Publisher Properties through the PubMatic Products. Accordingly, in each case where consent is the lawful basis for processing Personal Data and/or required for use of Tracking Technologies pursuant to the Privacy Requirements, Publisher agrees that it shall be responsible for obtaining all necessary consents from the relevant data subjects on behalf of PubMatic and applicable Demand Partners to lawfully permit PubMatic and all applicable Demand Partners to: (i) collect, process and share Data via the PubMatic Products for Permitted Purposes; and (ii) use Tracking Technologies in order to collect Data in connection with the performance of the PubMatic Products. Publisher represents and warrants that it shall, at all times maintain and make operational on Publisher Properties a mechanism for obtaining and recording such consent and that enables such consent to be withdrawn, in accordance with applicable Privacy Requirements. PubMatic is registered with and supports the IAB Transparency and Consent Framework (“Industry Framework”).
4. Notice Requirements: Publisher agrees that it is responsible for ensuring that all data subjects are appropriately notified about the data collection and use practices taking place on the Publisher Properties through the PubMatic Products. Publisher represents and warrants that it shall conspicuously post, maintain and abide by a publicly accessible privacy notice within all Publisher Properties from which the Data is collected that satisfies the requirements of the Privacy Requirements and the Agreement (including this Addendum). Without prejudice to the generality of the foregoing, such notice shall at a minimum include the following information: (i) a statement that data may be collected for advertising purposes; (ii) a description of the type of Personal Data collected by PubMatic and its Demand Partners and the purposes of processing thereof, including for delivering ads across the Publisher Properties over time; (iii) a description of the categories of individuals who will have access to the Personal Data; (iv) the identity of the Controller(s) of the Data; (v) a conspicuous link to or description of how to access a relevant choice mechanism; and/or (vi) any other information required to comply with the information and transparency requirements of applicable Privacy Requirements. The PubMatic Privacy Policy, its explanation of the Data PubMatic collects and how the PubMatic Products use it, may assist you in complying with your notification obligations under this Addendum.
5. Prohibited Data Sharing: Publisher shall not include or launch any Publisher Property on any of the PubMatic Products if such Publisher Property is directed at or likely to be accessed by any data subject that is deemed a child under applicable Privacy Requirements of the country in which the child resides. Publisher shall flag within the PubMatic Products or inform PubMatic in writing prior to launching any of such Publisher Properties on any of the PubMatic Products or pass to PubMatic or its Demand Partners any Personal Data of any data subject that is deemed a child under applicable Data Protection Law.
6. Noncompliance: If Publisher is unable to comply with its consent and notice obligations under the Agreement (including this Addendum) in respect of the Data, Publisher shall promptly notify PubMatic.
7. Co-operation and Data Subject Rights: The parties shall, on request, provide each other with all reasonable and timely assistance (at their own expense) and co-operation to enable the other party to comply with its obligations under the Privacy Requirements, including in order to enable the other party to respond to: (i) any request from a data subject to exercise any of its rights under Data Protection Law (including its rights of access, correction, objection, erasure and data portability, as applicable) in relation to the Data; and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data (“Correspondence”). Each party shall promptly inform the other if it receives any Correspondence directly from a data subject in relation to the Data. Subject to obligations of confidentiality and polices on disclosure of information, where a party has a concern that the other party has not complied with this Addendum, the parties agree to exchange information to ascertain the cause of such non-compliance and take reasonable steps to remediate.
8. Processing of California Personal Data: To the extent PubMatic is a Third Party as defined by the CCPA, the following provisions shall apply: PubMatic may process Personal Data of California consumers only for the limited and specified purposes as described in the Agreement or this DPA, in related schedules, services orders, and/or statements of work, and in PubMatic’s relevant privacy policies, including this DPA. PubMatic must comply with all applicable Data Protection Laws, including all applicable sections of the CCPA and provide the same level of privacy protection as required of businesses by the CCPA. Among these, PubMatic must comply with consumer requests to opt out of Sale or Sharing forwarded by Publisher. Publisher shall forward such requests (and other privacy rights requests) via the instructions provided at https://pubmatic.com/legal/dsr-notice/. Where PubMatic is providing PubMatic Products that includes the collection of Personal Data on either Publisher’s or PubMatic’s behalf, to the extent required, PubMatic shall check for and comply with an opt-out preference signal unless otherwise informed by Publisher that such data subject has consented to the Sale or Sharing of their Personal Data. PubMatic will inform Publisher in the time period required by applicable Data Protection Law if, PubMatic determines that it is no longer able to meet its obligations under Data Protection Laws or where in PubMatic’s reasonable opinion, any of Publisher’s instructions infringes any applicable Data Protection Laws. Company reserves the right to take reasonable and appropriate steps to discontinue and remediate unauthorized use of Personal Data.
9. Standard Contractual Clauses: Subject to Section 11, the parties agree that when the transfer of Personal Data from Publisher (as exporter) to PubMatic (as importer) is a Restricted Transfer and European Data Protection Law applies, the transfer shall be subject to the Standard Contractual Clauses, which shall be deemed incorporated into and shall form part of this Addendum, as follows:

(a) in relation to transfers of Personal Data protected by the GDPR, the Standard Contractual Clauses shall apply, completed as follows: (i) in Clause 7, the optional docking clause will apply, (ii) in Clause 11, the optional language will not apply; (iii) in Clause 17, Option 1 will apply, and the Standard Contractual Clauses will be governed by laws of Ireland; (iv) in Clause 18(b), disputes shall be resolved before the courts of Ireland; (v) Annex I of the Standard Contractual Clauses shall be deemed completed with the information set out in Annex A to this Addendum; and (vii) Annex II of the Standard Contractual Clauses shall be deemed completed with the information set out in Annex B to this Addendum;

(b) in relation to transfers of Personal Data protected by UK Privacy Law, the Standard Contractual Clauses shall also apply completed in accordance with paragraph (a) above, but as modified and interpreted by Part2: Mandatory Clauses of the UK Addendum, which shall be deemed executed by the parties and incorporated into and form an integral part of this Addendum. In addition, Tables 1 to 3 in Part 1 of the UK Addendum shall be completed respectively with the information set out in Annexes A and B of this Addendum and Table 4 in Part 1 shall be deemed completed by selecting “neither party”; and

(c) in relation to transfers of Personal Data protected by the Swiss DPA, the Standard Contractual Clauses shall also apply completed in accordance with paragraph (a) above, with the following modifications: (i) references to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA; (ii) references to specific Articles of “Regulation (EU) 2016/679” shall be replaced with the equivalent article or section of the Swiss DPA; (iii) references to “EU”, “Union”, “Member State” and “Member State law” shall be replaced with references to “Switzerland”, or “Swiss law”; (iv) the term “member state” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland); (v) Clause 13(a) and Part C of Annex A are not used and the “competent supervisory authority” is the Swiss Federal Data Protection Information Commissioner; (vi) references to the “competent supervisory authority” and “competent courts” shall be replaced with references to the “Swiss Federal Data Protection Information Commissioner” and “applicable courts of Switzerland”; (vii) in Clause 17, the Standard Contractual Clauses shall be governed by the laws of Switzerland; and (viii) Clause 18(b) shall state that disputes shall be resolved before the applicable courts of Switzerland,

It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses. Accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement, including this Addendum, the Standard Contractual Clauses shall prevail to the extent of such conflict.

1. Adequacy Mechanisms: The terms of the Standard Contractual Clauses will not apply where and to the extent PubMatic (as data importer) and the applicable transfer of Personal Data are covered by an alternative, suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection or appropriate safeguards for Personal Data (provided that it is deemed legally valid in jurisdictions subject to Data Protection Law), including the Data Privacy Framework or any U.S.- EU cross border transfer program which supersedes the Data Privacy Framework (an “Adequacy Mechanism”). Where an Adequacy Mechanism applies, PubMatic shall process the Personal Data in compliance with the Adequacy Mechanism and the Standard Contractual Clauses shall not apply.
2. Alternative Transfer Mechanisms: The parties agree that if Data Protection Law no longer allows the lawful transfer of Personal Data under the Standard Contractual Clauses and/or a relevant regulator or court of competent jurisdiction requires the parties to adopt additional measures (“Additional Measures“) or an alternative data export solution (“Alternative Transfer Mechanism“) to enable the lawful transfer of Data outside of Europe and such requirements are not satisfied by an Adequacy Mechanism in line with Section 10 above (if applicable), both parties agree to cooperate and agree any Additional Measures or Alternative Transfer Mechanism that may be required (but only to the extent such Additional Measures or Alternative Transfer Mechanism extend to the territories to which Data is transferred).
3. Contact. Publisher shall notify PubMatic of an individual within its organisation authorised to respond from time to time to enquiries regarding the Data and shall deal with such enquiries promptly. The individual within PubMatic authorised to respond from time to time to enquiries regarding the Data and who shall deal with such enquiries promptly can be contactable here: dpo@pubmatic.com (or such other contact as may be communicated to Publisher from time to time).
4. Changes in Law. In the event that there is a change in the Privacy Requirements that apply to the processing of Data, that would, in the reasonable opinion of a party, require changes to the PubMatic Products, the means by which the PubMatic Products are provided or used and/or terms and conditions of this Addendum, that party reserves the right (acting reasonably) to request such changes; provided that, to the extent possible, the party requesting the change will provide at least thirty (30) days prior written notice (including by email) of such changes and agrees to discuss such changes in good faith. If the requested changes will cause a material harm to any party (which includes for the avoidance of doubt, causing a party to be in breach of Data Protection Law) or materially alter any party’s provision or use (as applicable) of the PubMatic Products, such party may terminate the Agreement for the affected PubMatic Products upon written notice without liability for such termination.
5. Security: Both parties shall implement appropriate technical and organizational measures to protect the copy of the Data in their possession or control (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to the Data.
6. General: Except for the changes made by this Addendum, the Agreement remains unchanged and in full force and effect. If there is any conflict between any provision in this Addendum and any provision in the Agreement, this Addendum controls and takes precedence. With effect from the effective date, this Addendum is part of, and incorporated into the Agreement. To the extent there are any prior agreements with regard to the subject matter of this Addendum, this Addendum supersedes and replaces such prior agreements. This Addendum shall survive termination or expiry of the Agreement. Upon termination or expiry of the Agreement PubMatic may continue to process the Data provided that such processing complies with the requirements of this Addendum and the Privacy Requirements. This Addendum may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement. This Addendum may be executed via a recognized electronic signature service or delivered by facsimile transmission, or may be signed, scanned and emailed, and any such signatures shall be treated as original signatures for all applicable purposes.

Annex A

Description of the Transfer

1. List of Parties

Controller/ Data exporter:

Controller / Data importer:

1. Description of Transfer
   

Defined terms are as set out in the Data Processing Addendum agreed between the parties.

1. Competent Supervisory Authority

The competent supervisory authority will be (i) for Personal Data protected by the GDPR, , determined in accordance with Clause 13 of the Standard Contractual Clauses; (ii) for Personal Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner (“FDPIC”); and (iii) for Personal Data protection by UK Privacy Law, the Information Commissioners Office (the “ICO”).

.

Annex B

Technical and Organizational Measures

The technical and organizational measures implemented by PubMatic (including any relevant certifications) to maintain an appropriate level of security taking into account the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons, are as follows: