DATA PROCESSING TERMS

These DATA PROCESSING TERMS (the “Terms”), shall apply for all ad serving by Extreme Reach, Inc. ("Service Provider" on any websites, applications, digital properties, CTV, OTT (collectively, “Digital Property”) owned, operated, controlled, or represented by you and/or your affiliates (“PUBLISHER”). Service Provider and PUBLISHER are collectively referred to as the “Parties” and individually as a “Party.”  

These Terms shall apply where PUBLISHER sells or otherwise provides digital advertising inventory to certain advertisers (the “Advertiser”) for the placement of advertisements on its Digital Properties; and the Advertiser and/or its agencies have engaged Service Provider to serve digital advertisements and collect certain advertising campaign performance data on behalf of the Advertiser (the "Services"); and Advertiser places Service Provider’s pixels and/or other code or technology (the “Pixel(s)”) on Advertiser’s advertisements being served on the Digital Property to collect campaign performance data.    

1. Geography.  These standard terms are supplemented by the Attachments below for certain geographic regions and jurisdictions, as applicable.  For jurisdictions other than the EU, Switzerland, and the UK where the terms of Attachment 1, or the information therein, are sufficient to comply with such jurisdictions applicable data privacy laws, then Attachment 1 shall apply.  If the terms of an applicable Attachment conflict with the standard terms herein, the terms of the Attachment control for the applicable geographic region.

2. Data Collection Services and Practices.  Service Provider represents and warrants that in connection with its use of Pixels on the Digital Property:

1. Service Provider has entered into the necessary agreements with Advertiser or its agenc(ies) and has received the necessary consent and permission from Advertiser or its agencies to place its Pixels on the advertisements served on the Digital Property.
2. The Pixels will only collect data from advertisements it serves and will not otherwise collect any data from the Digital Property.
3. Agency, Advertiser, or Service Provider will include the Pixel in the creative for each advertisement provided to PUBLISHER.  Prior to changing the scope or functionality of any such Pixels, Service Provider will provide PUBLISHER with information about any such changes.
4. It will not permit or enable any Pixel to attach or redirect to third party tags, pixels, code or other tracking technologies that have not been placed directly on the Digital Property (“piggybacking”) without express permission from PUBLISHER.
5. It will not resell or otherwise transfer any data it collects or receives from the Digital Property other than as permitted under these Terms, whether or not such data contains any personally identifiable information or personal information.  This prohibition does not apply to any transfer of data to the applicable Advertiser or its agency in carrying out the Services.
6. Data collected from the Pixel will be used solely to provide reports and other analytics to Advertiser or its agency regarding the performance of an advertisement or campaign.  Service Provider will otherwise not use the data collected from the Pixel to serve targeted advertisements to the users of PUBLISHER’s Digital Property.
7. Service Provider will promptly honor any requests it receives from users of PUBLISHER Digital Property to opt-out of data collection by Service Provider.  
8. It will not grant access to data collected or tracked by means of the Pixel on the Digital Property to any third party, except as directed by Advertiser or (a) on a need to know basis in order to provide specific services to Advertiser; (b) after conducting a reasonable investigation of such third party; and (c) upon entering a written agreement with such third party which contains obligations which are at least as restrictive as the foregoing.
9. It will not use malicious code of any kind.
10. It will notify PUBLISHER of any actual or suspected breaches of security or incidents related to PUBLISHER or its users within one (1) week of discovery of such incident (or earlier where legally required).
11. Without limiting any of the foregoing, Service Provider does and will comply with all applicable laws, rules, regulations, legal orders or decrees and similar promulgations.
12. Service Provider will employ commercially reasonable methodologies, technologies, and other means to prevent the introduction of, and will not intentionally introduce any software virus, worm, “back door,” “Trojan Horse,” or similar harmful, destructive, or disruptive code or device into the Pixels or any other materials or services provided by Service Provider or into the Digital Property.
13. Service Provider will destroy any data collected from the Digital Property no later than (2) years after the termination of Advertiser’s contract, except where anonymized and aggregated for long-term benchmarking purposes.  

3. PUBLISHER Representations and Warranties. PUBLISHER represents and warrants:

1. In carrying out its duties under this Terms and in operating its Digital Properties when any applicable advertising campaign is being run with Service Provider's Pixel(s) it will comply with all applicable laws, rules, regulations, legal orders or decrees and similar promulgations, including but not limited to any data privacy laws.
2. It will not modify the Pixel, outside of updates required during trafficking, without prior notification to Service Provider and an opportunity for Service Provider to cure any potential defect in the Pixel, except as explicitly allowed herein.

4. Removal of Pixels. Publisher shall not remove or delete the Pixel except as allowed in this Section.  Upon notice to Service Provider, PUBLISHER may remove from the Digital Property any Pixel or other code or material provided by Service Provider if (1) the advertising campaign for which such Pixel is being used has concluded, (2) at the request of the Advertiser or advertiser’s agency, (3) to comply with any Law or to prevent a third party claim or lawsuit, (4) or to prevent any potential or actual damage to PUBLISHER’s or any third party property.    
5. Compensation. Service Provider will be compensated for any services provided under this Agreement exclusively by the Advertiser and/or its agencies that have retained Service Provider, and PUBLISHER will have no obligation whatsoever of any payment or other consideration to Service Provider for any of Service Provider’s services.
6. Limitation of Liability.  IN NO EVENT WILL EXTREME REACH OR PUBLISHER BE LIABLE FOR ANY INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH OR ARISING OUT OF THESE TERMS (INCLUDING LOSS OF BUSINESS, REVENUE, PROFITS, USE, OR OTHER ECONOMIC ADVANTAGE), HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
7. DISCLAIMER. OTHER THAN AS EXPRESSLY STATED HEREIN, EXTREME REACH MAKES NO FURTHER REPRESENTATIONS OR WARRANTIES, IMPLIED OR OTHERWISE.
8. General Provisions. These Terms constitute the entire understanding and agreement between Extreme Reach and Publisher with respect to the subject matter hereof, and hereby supersedes all prior or contemporaneous writings or understandings unless there is a fully executed agreement between Service Provider and Publisher that covers data processing, in which case the terms of that agreement shall control.  These Terms will be governed by the laws of the State of New York, United States of America, without regard to its choice of law principles, and any disputes arising hereunder will be submitted exclusively to the jurisdiction of a competent court in New York County in the State of New York (to which jurisdiction each Party hereby consents and waives any objections).  If any provision of these Terms is determined to be illegal, unenforceable, or otherwise invalid by a court of competent jurisdiction, the remainder of these Terms will be unimpaired and remain in full force and effect.  

ATTACHMENT 1 – EUROPEAN STANDARD CONTRACTUAL CLAUSES

Where required by applicable data protection law, Extreme Reach shall not Process or transfer any data (nor permit any data to be Processed or transferred) in a territory outside the EEA or UK (collectively, “Europe”) unless it has taken such measures as are necessary to ensure that the transfer is in accordance with applicable data protection law.  In particular, where such data is to be transferred outside of Europe to Extreme Reach or another recipient who is not located in a territory which has been considered adequate under applicable data protection law, the European Standard Contractual Clauses (2021/914) (“SCCs”) shall be incorporated into this Agreement as follows:

1.   The legal entity named on this account shall be the ‘data exporter’ of such data;
2.   Extreme Reach shall be the ‘data importer’;
3. where Extreme Reach receives and uses such data as a processor acting on behalf of Data Exporter, Module Two of the SCCs (“C2P SCCs”) shall apply, as follows:

1. Annex I of the C2P SCCs shall be deemed completed with the information set out in the relevant part of Annex 1 of this Attachment 1;
2. Annex II of the C2P SCCs  shall be deemed completed with the information set out in Annex 2 of this Attachment 1  ;
3. Annex III of the C2P SCCs shall be deemed completed with the information set out in Annex 3 of this Attachment 1;
4. Clause 7 (Docking Clause) of the C2P SCCs  shall be included;
5. Clause 9 of the C2P SCCs  shall include OPTION 1 and the time period shall be 10 days;
6. Clause 17 (Governing Law) of the C2P SCCs  shall include OPTION 2 and shall refer to the Netherlands as the Member State; and
7. Clause 18(b) of the C2P SCCs  shall refer to the courts of the Netherlands;

4. Data Exporter has the authority to enter into SCCs with Extreme Reach on Data Exporter Europe’s behalf; and
5. in the event of any conflict between the SCCs and the provisions of this Agreement, the SCCs shall prevail.

Annexes to the SCCs

ANNEX 1: DETAILS OF PROCESSING

Data exporter(s): Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union

Data importer(s): Identity and contact details of the data importer(s), including any contact person with responsibility for data protection

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred:

Consumers to whom advertising impressions are served.

Categories of personal data transferred:

Information related to a consumer’s device, such as IP Address, and, where combined or linked to IP address, Device Type, Browser Type and User Agent strings. 

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Data are transferred on a continuous basis (on advertising creatives including the importer’s technology)

Nature and purpose of the Processing

As Processor: The importer acts as Processor in relation to the following activities: The personal data are transferred to enable the importer to provide Extreme Reach Services as described on the Agreement Cover Page to Service Recipients in connection with advertising campaigns on the Roku Platform or purchased through OneView. The data transferred is further processed in order to enable the importer to provide reports on the service to the exporter, its affiliates or its advertisers.

The restrictions as set out in Section 4 of the Agreement shall apply.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

As Processor: Extreme Reach shall retain the personal data for as long as it is required to provide the Services to the applicable Advertiser.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

See Annex 3. The duration of processing by sub-processors is concurrent with the importer’s duration of processing as described in this Annex 1.

C.   COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13: 

Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Annexes to the SCCs

ANNEX 2

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons. 

The technical and organizational measures implemented by Extreme Reach (including any relevant certifications) to maintain an appropriate level of security taking into account the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons, are as follows: 

1. General Principles

• Extreme Reach shall implement and maintain an adequate and appropriate Security Incident management program.  

• Extreme Reach shall encrypt all Sensitive data, and any other data that is required to be encrypted under applicable laws or regulations, when transmitted electronically.  

• Extreme Reach shall ensure that all individuals that will have access to data undergo and successfully complete adequate and appropriate privacy and data security training prior to having access to data.  Such training must be provided to all such individuals on at least an annual basis and comply with applicable laws, regulations and best industry practices.  

• Extreme Reach shall implement and maintain policies documenting the consequences for violations of Extreme Reach’s privacy and data security policies and escalation procedures for non-compliance with such policies.

ANNEX 3

SUB-PROCESSOR LIST

PUBLISHER hereby authorizes the use of the following Sub-Processors: