Data Privacy Addendum
Data Privacy Addendum
Effective Date: October 19, 2026
This Data Privacy Addendum (“Addendum”) supplements the agreement between Aditude, Inc. and any of its affiliates (“Aditude”) and the customer that accepts it (“Controller”), each a “Party” and collectively the “Parties”. This Addendum applies to and takes precedence over that agreement and any associated contractual document between the Parties, such as an order form, statement of work or data protection addendum thereunder (collectively, the “Agreement”), to the extent of any conflict.
Acceptance. Controller accepts this Addendum by executing the Agreement, by accepting terms that incorporate this Addendum by reference, or by requesting, enabling, or continuing to use any service for which Aditude Processes Personal Data. Upon acceptance this Addendum is binding on the Parties and forms part of the Agreement.
Role Allocation and Scope. Aditude acts as Processor under this Addendum, except for the Identity Service described in Appendix A and elected by Controller, for which Aditude acts as a third party or controller to the extent required by applicable Data Privacy Laws, and not on Controller’s behalf. All services provided under the Agreement other than the Identity Service are “Processor Services,” and all Personal Data Processed in connection with Processor Services is “Processor Services Data.” References in this Addendum to “Processor” mean Aditude acting in its Processor role for Processor Services. Notwithstanding any other provision of this Addendum, where Controller elects the Identity Service, Appendix A governs Aditude’s Processing of Identity Service Data and prevails over any conflicting provision of this Addendum.
The Parties hereby agree as follows:
Definitions. For purposes of this Addendum:
“Data Privacy Laws” means all applicable laws, regulations, and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, communications secrecy, breach notification, or the Processing of Personal Data, including without limitation, to the extent applicable, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. and any amendments thereto (“CCPA”), the UK Data Protection Act 2018 (“UK Data Protection Law”), the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), the ePrivacy Directive (2002/58/EC), and any laws or regulations succeeding or implementing the foregoing. For the avoidance of doubt, if Processor’s processing activities involving Personal Data are not within the scope of a given Data Privacy Law, such law is not applicable for purposes of this Addendum.
“Data Subject” means an identified or identifiable natural person about whom Personal Data relates.
“EU SCCs” means the clauses issued pursuant to the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as described in the “Data Transfers” section below.
“Personal Data” includes “personal data,” “personal information,” and “personally identifiable information,” and such terms shall have the same meaning as defined by the applicable Data Privacy Laws.
“Process” and “Processing” mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Security Breach” means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
“UK SCCs” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (available as of the Effective Date at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/).
Scope and Purposes of Processing.
Processor will Process Personal Data, solely to fulfill its obligations to Controller under the Agreement, including this Addendum, and on Controller’s behalf, and for no other purposes, unless required to do otherwise by Data Privacy Laws to which Processor is subject. In such case, Processor will inform Controller of that legal requirement before Processing, unless that law prohibits Controller from providing such information on important grounds of public interest within the meaning of Data Privacy Laws.
Notwithstanding the foregoing, Processor may use aggregated data derived from its performance of the Services to maintain, support, and improve its products and services, provided that such use does not involve the use of Controller's Personal Data to train any underlying AI or machine learning models.
Without limiting the foregoing, Controller directs Processor to Process Personal Data in accordance with Controller’s written instructions, as may be provided by Controller to Processor from time to time, and in the following manner.
Subject matter, nature, and purpose of Processing: Processor will process Personal Data solely to fulfill its obligations to Controller for the following business purpose: to provide the Services as set forth in the Agreement.
Anticipated duration of Processing: For the term of the Agreement and a reasonable period thereafter, insofar as agreed by the Parties through the Agreement.
Categories of Personal Data typically subject to Processing under the Agreement: Personal Data may include: contact information, device data, location data, usage information, professional information and commercial information.
Typical categories of Data Subjects may include: site visitors, clients (publishers and advertisers), consumers, employment applicants.
Processor will immediately inform Controller if, in Processor’s reasonable opinion, an instruction from Controller infringes Data Privacy Laws or if Processor determines that it can no longer meet its obligations under this Agreement, this DPA, or Data Privacy Laws.
Processor will not:
Sell Personal Data. For purposes of this paragraph, “sell” shall have the meaning set forth in Data Privacy Laws and “share” shall have the meaning set forth in the CCPA.
Process Personal Data for any purpose other than for the specific purposes set forth herein. For the avoidance of doubt, Processor will not Process Personal Data outside of the direct business relationship between Controller and Processor.
Violate any applicable restrictions in Data Privacy Laws, including those on combining the Personal Data that Processor receives from, or on behalf of, Controller with Personal Data that Processor receives from, or on behalf of, another person or persons, or that Processor collects from any interaction between itself and a data subject;
Engage in any processing of Personal Data that is prohibited or not permitted by “processors” or “service providers” under Data Privacy Laws; or
Attempt to link, identify, or otherwise create a relationship between Personal Data and non-Personal Data or any other data without the express authorization of Controller.
Compliance with Data Privacy Laws.
Processor will only Process Personal Data as set forth in this Addendum and in compliance with Data Privacy Laws. Processor shall provide the same level of protection for Personal Data as is required under Data Privacy Laws applicable to Controller.
Processor hereby certifies that it understands its restrictions and obligations set forth in this Addendum and will comply with them.
Processor acknowledges and agrees to implement appropriate technical and organizational measures to honor Data Subject rights requests within 45 days of receipt, including but not limited to requests for access, correction, deletion, and opt-out of processing.
Processor shall respect and implement browser-based opt-out mechanisms, including Global Privacy Control signals and other opt-out preference signals, as required by applicable Data Privacy Laws.
Processor shall comply with all applicable state privacy laws and enable data subject rights as outlined in California Consumer Privacy Act and other state privacy laws, including but not limited to rights to access, correct, delete, and opt out of the sale of Personal Data.
Personal Data Processing Requirements. Processor will:
Ensure that the persons it authorizes to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Upon written request of Controller, assist Controller in the fulfillment of Controller’s obligations to respond to requests by Data Subjects (or their representatives) for exercising their rights under Data Privacy Laws (such as rights to access or delete Personal Data).
Promptly, and in any event within five days, notify Controller of (i) any third-party, Data Subject, or government requests or complaints regarding the Processing of Personal Data under this Agreement; or (ii) any third-party, Data Subject, or government requests for access to or information about Processor’s Processing of Personal Data on Controller’s behalf, unless prohibited by Data Privacy Laws. If Processor receives a third-party, Data Subject, or government request, Processor will await written instructions from Controller on how, if at all, to assist in responding to the request. Processor will provide Controller with reasonable cooperation and assistance in relation to any such request.
Provide reasonable assistance to and cooperation with Controller for Controller’s performance of a data protection impact assessment of Processing or proposed Processing of Personal Data.
Provide reasonable assistance to and cooperation with Controller for Controller’s consultation with regulatory authorities in relation to the Processing or proposed Processing of Personal Data, including complying with any obligation applicable to Processor under Data Privacy Laws to consult with a regulatory authority in relation to Processor’s Processing or proposed Processing of Personal Data.
Data Security. Processor will implement appropriate administrative, technical, physical, and organizational measures to protect Personal Data. Except as agreed by the parties by way of a binding variation of this Addendum, the Processor may not make any change to the security measures it applies to the Personal Data from time to time to the extent any such change would conflict with the provisions of this Addendum.
Security Breach. Processor will notify Controller promptly, and in any event within forty-eight (48) hours, of any Security Breach. Processor will and in any event within twenty-four hours, comply with the Security Breach-related obligations directly applicable to it under Data Privacy Laws and will assist Controller in Controller’s compliance with its Security Breach-related obligations, including without limitation, by:
At Processor’s own expense, taking steps to mitigate the effects of the Security Breach and reduce the risk to Data Subjects whose Personal Data was involved, while making best efforts to timely notify Controller of such mitigating measures; and
Providing Controller with the following information:
The nature of the Security Breach, including, where possible, what happened, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;
The likely consequences of the Security Breach; and
Measures taken or proposed to be taken by Processor to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects.
Subprocessors.
Controller acknowledges and agrees that Processor may use Processor affiliates and other subcontractors to Process Personal Data in accordance with the provisions within this Addendum and Data Privacy Laws (“Subprocessors”). A current list of Processor’s Subprocessors is in the attached Exhibit A, and Controller hereby consents to Processors use of such subcontractors.
Where Processor sub-contracts any of its rights or obligations concerning Personal Data, including to any affiliate, Processor will take steps to select and retain Subprocessors that are capable of maintaining appropriate privacy and security measures to protect Personal Data consistent with Data Privacy Laws.
Processor shall notify Controller before it adds or replaces Subprocessors. In the event Controller objects in writing to a new Subprocessor on reasonable data protection grounds within ten (10) business days of Processor’s notice, Processor will use reasonable efforts to make available to Controller a change in the services or recommend a commercially reasonable change to Controller’s use of the services to avoid Processing of Personal Data by the objected-to Subprocessor without unreasonably burdening Controller. If Processor is unable to do so within thirty (30) days of Controller’s objection, Controller may terminate the Agreement on thirty (30) days’ written notice. If Controller does not object within that ten (10) business day period, Controller is deemed to have approved the Subprocessor.
Data Transfers.
Unless instructed to do so by Controller, or as necessary to utilize third-party Subprocessors authorized under this DPA, Processor shall not Process or transfer any Personal Data in or to a territory other than the territory in which the Personal Data was first collected under the Agreement (nor permit such data to be so Processed or transferred), except as required by Data Privacy Laws to which Processor is subject. In such a case, Processor will inform Controller of that legal requirement before any such Processing or transfer, unless that law prohibits Controller from providing such information on important grounds of public interest within the meaning of Data Privacy Laws. Processor will take all such measures as are necessary to ensure such Processing or transfer is in compliance with Data Privacy Laws (including such measures as may be communicated by Controller to Processor). Except for transfers to authorized Subprocessors under this DPA, Processor shall inform Controller of any international transfers of Personal Data in advance of making the transfer and shall assist Controller in assessing the risks of such transfer and the parties' respective obligations to comply with Data Privacy Laws.
EU Data Transfers. With respect to Personal Data transferred from the European Economic Area, the EU SCCs shall apply, form part of this DPA, and take precedence over the rest of this DPA as set forth in the EU SCCs. The EU SCCs shall be completed as follows:
Where Processor acts as Controller’s Processor, Module Two of the EU SCCs shall apply.
Where Processor acts as Controller’s subprocessor, Module Three of the EU SCCs shall apply.
Clause 7 (the optional docking clause) is not included.
Under Clause 9 (Use of subprocessors), the parties select Option 2 (General written authorization). The initial list of subprocessors is set forth below in Exhibit A of this DPA, and Processor shall update that list and inform Controller in writing at least 30 business days in advance of any intended additions or replacements of subprocessors.
Under Clause 11 (Redress), the optional requirement that data subjects be permitted to lodge a complaint with an independent dispute resolution body does not apply.
Under Clause 17 (Governing law), the parties choose Option 1 (the law of an EU Member State that allows for third-party beneficiary rights). The parties select the law of The Netherlands.
Under Clause 18 (Choice of forum and jurisdiction), the parties select the courts in Amsterdam, The Netherlands.
Annexes I and II of the EU SCCs are set forth in Exhibit B-1 of the DPA.
Annex III of the EU SCCs (List of subprocessors) is inapplicable.
UK Data Transfers. With respect to Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, the UK SCCs form part of this Addendum and take precedence over the rest of this Addendum as set forth in the UK SCCs, unless the United Kingdom issues updates to the UK SCCs, in which case the updated UK SCCs will control. Undefined capitalized terms used in this provision shall mean the definitions in the UK SCCs. For purposes of the UK SCCs, they shall be deemed completed as follows:
Table 1 of the UK SCCs:
The Parties’ details shall be the Parties and their affiliates to the extent any of them is involved in such transfer, including those set forth in Exhibit B-1.
The Key Contact shall be the contacts set forth in Exhibit B-1.
Table 2 of the UK SCCs: The Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties.
Table 3 of the UK SCCs: Annex 1A, 1B, and II shall be set forth in Exhibit B-1.
Table 4 of the UK SCCs: Importer and Exporter may each end the UK SCCs as set out in Section 19 of the UK SCCs.
By accepting this Addendum, the Parties are deemed to be signing the UK SCCs and its applicable Tables and Appendix Information.
Swiss Data Transfers. With respect to Personal Data transferred from Switzerland for which the Swiss Federal Act on Data Protection (“FADP”) (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, the EU SCCs shall apply and shall be deemed to have the following differences to the extent required by the FADP:
References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR.
The term “member state” in the EU SCCs shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.
References to personal data in the EU SCCs also refer to data about identifiable legal entities until the entry into force of revisions to the FADP that eliminate this broader scope.
Under Annex I(C) of the EU SCCs (Competent supervisory authority): where the transfer is subject exclusively to the FADP and not the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and where the transfer is subject to both the FADP and the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by the FADP, and the supervisory authority is as set forth in the EU SCCs insofar as the transfer is governed by the GDPR.
Audit, Compliance and Remediation. Processor will make available to Controller all reasonable information necessary to demonstrate compliance with this Addendum and will allow for and contribute to audits, including inspections, ongoing manual reviews, automated scans, and other technical and operational testing— conducted by Controller or another auditor designated by Controller in its sole discretion at most once every 12 months. If requested by Controller, Controller will cover all reasonable Processor costs associated with being part of an audit.
Return or Destruction of Personal Data. Except to the extent required otherwise by Data Privacy Laws, Processor will, at the choice of Controller, return to Controller and/or securely destroy all Personal Data upon (a) written request of Controller or (b) termination of the Agreement. Except to the extent prohibited by Data Privacy Laws, Processor will inform Controller if it is not able to return or delete any Personal Data.
Indemnification. Processor will indemnify, defend, and hold harmless Controller and its affiliates and its and their respective directors, officers, employees, agents, successors, and permitted assigns (the “Controller Indemnitees”) from and against any and all losses, claims, damages, demands, liabilities, actions, fines, penalties, costs and related expenses (including reasonable attorneys’ fees) incurred by the Controller Indemnitees arising out of or resulting from claims brought by a third party (including any governmental or regulatory authority) related to Processor’s breach of this Addendum or Data Privacy Laws.
Controller will indemnify, defend, and hold harmless Processor and its affiliates and its and their respective directors, officers, employees, agents, successors, and permitted assigns (the “Processor Indemnitees”) from and against any and all losses, claims, damages, demands, liabilities, actions, fines, penalties, costs and related expenses (including reasonable attorneys’ fees) incurred by the Processor Indemnitees arising out of or resulting from claims brought by a third party (including any governmental or regulatory authority) related to Controller’s breach of this Addendum or Data Privacy Laws.
Term. This Addendum takes effect on the date Controller accepts it and continues for so long as Aditude Processes Personal Data in connection with the Agreement. Controller may immediately terminate this Addendum and the Agreement, in whole or in part, upon written notice to Processor if:
Processor experiences a Security Breach affecting Controller's Personal Data that is material in nature and Processor has failed to remediate or provide a credible remediation plan within thirty (30) days of written notice from Controller identifying the breach and the basis for termination;
Processor materially breaches any provision of this Addendum; or
Processor is unable to provide the level of data protection required under this Addendum.
Upon termination for any reason, Processor shall: cease all Processing of Controller's Personal Data; at Controller's direction, securely return or destroy all Personal Data in accordance with Section 10; provide reasonable transition assistance to Controller or its designee for up to ninety (90) days and provide a detailed exit plan including timeline and methodology for the return and/or destruction of Personal Data.
Processor shall not be entitled to any additional compensation for providing transition assistance unless otherwise agreed in writing.
Survival. The provisions of this Addendum survive the termination or expiration of the Agreement for so long as Processor or its subcontractors Process any Personal Data.
Assignment. Neither Party may assign or otherwise transfer any of its rights or obligations under this Addendum without the prior written consent of the other Party, which shall not be unreasonably withheld. Any attempted assignment in violation of this Section shall be null and void. Notwithstanding the foregoing, either party may assign this Addendum in its entirety, without consent of the other party, to its affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets.
Recordkeeping Obligations. The Processor shall maintain complete, accurate, and up to date written records of all categories of processing activities carried out on behalf of Controller and ensure such records shall include all information:
Necessary to demonstrate its compliance with this Addendum
That each party is required to record and/or maintain under the applicable Data Privacy Laws; and
That Controller may reasonably require from time to time
The Processor shall make copies of such records available to Controller promptly (and in any event within five days) on request from time to time.
Governing law. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles. Any dispute arising out of or relating to this Addendum shall be subject to the exclusive jurisdiction of the state and federal courts located in Delaware. The Parties consent to the personal and exclusive jurisdiction and venue of these courts. Notwithstanding the foregoing, for Personal Data subject to European Data Protection Laws, the governing law and jurisdiction provisions of the EU SCCs or UK SCCs shall apply to any disputes relating to such Personal Data.
Changes to this Addendum. Aditude may revise this Addendum from time to time. Aditude will post each revised version with its effective date and will notify Controller in accordance with Section 18. Where a revision materially reduces Controller’s rights or materially increases Controller’s obligations, Controller may object in writing within fifteen (15) days of the notice. If Controller objects, the services affected by the revision will be discontinued and the Agreement will otherwise continue in full force and effect. If Controller does not object within that period, or continues to use the services after the notice, Controller is deemed to have accepted the revised version. Revisions required to comply with Data Privacy Laws take effect on the date stated in the notice and are not subject to objection under this Section.
Notices. Any notice under this Addendum will be given in the manner provided in the Agreement, or by email to privacy@aditude.io in the case of Aditude and to the email address associated with Controller’s account in the case of Controller.
Exhibit A
Processor’s Subprocessors
Please see aditude.com/subprocessors
Exhibit B
Data Transfer Agreements
Exhibit B-1
Processor Services Transfers (EU SCCs Modules Two and Three, UK SCCs, Swiss adaptations)
Table 1: Parties and Transfer Details (UK SCCs)
Importer: Aditude, Inc.
Address: 8 The Green #13369 Dover DE 19901
Contact: privacy@aditude.io
Activities: Digital advertising technology services
Role: Processor
Exporter: Controller, as identified in the Agreement.
Address: as set out in the Agreement or in Controller’s account registration details.
Contact: as set out in the Agreement or in Controller’s account registration details.
Activities: receipt of the services under the Agreement.
Role: Controller
Key Contact: Controller’s contact as set out in the Agreement or its account registration details.
Table 2: Selected Transfer Mechanism (UK SCCs)
The Approved EU SCCs
Table 3: Appendix Information (UK SCCs)
As set forth in Annex 1A, 1B, II
Table 4: Ending This IDTA (UK SCCs)
Importer and Exporter may each end this IDTA as set out in Section 19 of the IDTA.
ANNEX I
A. LIST OF PARTIES
Importer: Aditude, Inc.
Address: 8 The Green #13369 Dover DE19901
Contact: privacy@aditude.io
Activities: Digital advertising technology services
Role: Processor
Exporter: Controller, as identified in the Agreement.
Address: as set out in the Agreement or in Controller’s account registration details.
Contact: as set out in the Agreement or in Controller’s account registration details.
Activities: receipt of the services under the Agreement.
Role: Controller or, where Module Three applies, Processor.
B. DESCRIPTION OF TRANSFER
Categories of data subjects:
Site Visitors
Clients (Publishers and Advertisers)
Consumers (users interacting with Publishers' Digital Media Assets)
Employment Applicants
Categories of personal data:
Contact information (name, email, phone, address)
Device data (IP address, device IDs, browser information)
Location data
Usage information (browsing history, interaction data)
Professional information
Commercial information
Tracking Technologies data
Sensitive data: None
Frequency: Continuous
Nature of processing: Collection, storage, analysis, and transmission of data to provide advertising technology services
Purpose: To enable Processor to provide the Services as set forth in the Agreement
Period: For the duration specified in Section 2(c)(ii) of the DPA:
Event-level/user-level data: Maximum 390 days
Aggregated data: As needed for legitimate business purposes
Cookie data: Maximum 390 days unless refreshed
C. COMPETENT SUPERVISORY AUTHORITY
For EU transfers: the supervisory authority of the EEA member state in which the exporter is established. For UK transfers: Information Commissioner's Office. For Swiss transfers: Federal Data Protection and Information Commissioner
1. Access Control
Multi-factor authentication for systems containing Personal Data
Strong password policies and regular rotation
2. Data Security
Industry-standard encryption for data at rest
Regular penetration testing and vulnerability assessments
Secure backup systems
3. Organizational Measures
Written information security policies and procedures
4. Physical Security
24/7 monitoring of data centers
Access control systems and visitor logs
5. Technical Controls
Firewalls and network segmentation
Anti-malware protection
6. Data Privacy Controls
Data minimization procedures
Privacy impact assessments
Breach notification protocols
Exhibit B-2
Identity Service Transfers (EU SCCs Module One, UK SCCs, Swiss adaptations)
Table 1: Parties and Transfer Details (UK SCCs)
Importer: Aditude, Inc.
Address: 8 The Green #13369 Dover DE 19901
Contact: privacy@aditude.io
Activities: Identity Service
Role: Controller
Exporter: Controller, as identified in the Agreement.
Address: as set out in the Agreement or in Controller’s account registration details.
Contact: as set out in the Agreement or in Controller’s account registration details.
Activities: operation of the Digital Media Assets and authorization of the Identity Service.
Role: Controller
Key Contact: Controller’s contact as set out in the Agreement or its account registration details.
Table 2: Selected Transfer Mechanism (UK SCCs)
The Approved EU SCCs, Module One.
Table 3: Appendix Information (UK SCCs)
As set forth in Annex I and Annex II below.
Table 4: Ending This IDTA (UK SCCs)
Either Party may end this IDTA as set out in Section 19 of the IDTA.
ANNEX I
A. LIST OF PARTIES
Importer: Aditude, Inc.
Address: 8 The Green #13369 Dover DE 19901
Contact: contact privacy@aditude.io.
Activities: provision of the Identity Service.
Role: Controller.
Exporter: Controller, as identified in the Agreement.
Address: as set out in the Agreement or in Controller’s account registration details.
Contact: as set out in the Agreement or in Controller’s account registration details.
Activities: operation of the Digital Media Assets and authorization of the Identity Service.
Role: Controller.
B. DESCRIPTION OF TRANSFER
Categories of data subjects: visitors to the Digital Media Assets.
Categories of personal data: IP addresses, mobile advertising identifiers, hashed email addresses and other pseudonymous identifiers, match results, suppression records, and related logs and metadata.
Sensitive data: none.
Frequency of transfer: continuous.
Nature of processing: collection, matching, transformation, storage, and transmission of identifiers for the Identity Service.
Purpose of the transfer: the Identity Service and the purposes described in Section 2 of Appendix A.
Retention period: as set out in Section 2(d) of Appendix A.
Onward transfers: to Identity Service Providers engaged by Aditude for the purpose of providing the Identity Service.
C. COMPETENT SUPERVISORY AUTHORITY
For EU transfers: the supervisory authority of the EEA member state in which the exporter is established. Where the exporter is not established in the EEA but has appointed a representative under Article 27 GDPR, the supervisory authority of the member state in which that representative is established. Where the exporter is neither established in the EEA nor represented, the supervisory authority of the member state in which the data subjects whose Personal Data is transferred are located.
For UK transfers: the Information Commissioner's Office.
For Swiss transfers: the Federal Data Protection and Information Commissioner.
ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES
1. Access Control
Multi-factor authentication for systems containing Personal Data
Strong password policies and regular rotation
2. Data Security
Industry-standard encryption for data at rest
Regular penetration testing and vulnerability assessments
Secure backup systems
3. Organizational Measures
Written information security policies and procedures
4. Physical Security
24/7 monitoring of data centers
Access control systems and visitor logs
5. Technical Controls
Firewalls and network segmentation
Anti-malware protection
6. Data Privacy Controls
Data minimization procedures
Privacy impact assessments
Breach notification protocols
Appendix A
Identity Service
This Appendix A forms part of the Addendum and applies only where Controller elects the Identity Service. By electing the Identity Service, Controller agrees to this Appendix A. Where Controller does not elect the Identity Service, this Appendix A does not apply and imposes no obligations on either Party.
For the Identity Service, Aditude acts as an independent controller and business and as a third party to the extent provided by applicable Data Privacy Laws, determines the purposes and means of its Processing of Identity Service Data, and does not act as Controller’s processor or service provider or on Controller’s behalf. Capitalized terms used in this Appendix A and not defined in it have the meanings given in the Addendum.
1. Definitions
“Digital Media Assets” has the meaning given in the Agreement, or where the Agreement does not define it, means the websites, mobile applications, and other digital properties on or through which Aditude provides the services.
“Identity Service” means the service under which Aditude or an Identity Service Provider collects, receives, matches, or transforms device or network identifiers, including IP addresses and mobile advertising identifiers, into hashed email addresses or other pseudonymous identifiers for identity enrichment and bid request optimization.
“Identity Service Data” means Personal Data Processed in connection with the Identity Service, including IP addresses, mobile advertising identifiers, hashed email addresses, match results, match scores, suppression records, and related logs and metadata.
“Identity Service Election” means Controller’s election to enable the Identity Service, made by signing an election form or order form identifying the Identity Service, by enabling the Identity Service in Aditude’s platform, by written or email confirmation from Controller, or by any other affirmative act of Controller that Aditude records as an election.
“Identity Service Provider” means any third party that Aditude engages to provide or support the Identity Service. Aditude engages Identity Service Providers in its own capacity and not on Controller’s behalf. Identity Service Providers are not Subprocessors for purposes of the Addendum.
2. Identity Service
(a) Provision of the Identity Service. Aditude may provide the Identity Service through any or all of the following: (i) disclosing device or network identifiers to an Identity Service Provider and receiving hashed email addresses or other pseudonymous identifiers in return; (ii) permitting an Identity Service Provider’s technology to collect device or network identifiers directly through Aditude’s integration on the Digital Media Assets; and (iii) matching device or network identifiers against a dataset licensed or otherwise made available to Aditude by an Identity Service Provider.
(b) Notice and consumer rights. Aditude will provide its own notice as required under applicable Data Privacy Laws. Aditude will receive and honor applicable opt-out preference signals, and any consent or opt-out signals, including Global Privacy Control, Controller passes to Aditude, and will not provide the Identity Service in respect of a data subject who has opted out of the sale or sharing of Personal Data or who has not provided or has withdrawn a required consent. Aditude will respond to data subject requests relating to Identity Service Data as required of it under applicable Data Privacy Laws. Controller shall promptly forward to Aditude any request or complaint it receives that relates to the Identity Service.
(c) Identity Service Providers. Aditude engages Identity Service Providers in its own capacity. Aditude will contract with each Identity Service Provider on terms addressing confidentiality, security, permitted purposes, retention, deletion, and suppression appropriate to the provider’s role.
(d) Retention and deletion. Aditude will retain each category of Identity Service Data only for as long as reasonably necessary and proportionate to the purposes of the Identity Service, taking into account operational requirements, legal obligations, security and fraud prevention, and the establishment, exercise or defense of legal claims, and will securely delete or de-identify it thereafter. Aditude will delete or suppress Identity Service Data where required by an applicable consumer request or opt-out, or by applicable Data Privacy Laws.
(e) International transfers. Where Identity Service Data is transferred from the European Economic Area, Module One of the EU SCCs applies, forms part of the Addendum, and is completed as set out in Exhibit B-2. Sections 8(c) and 8(d) of the Addendum apply to Identity Service Data transferred from the United Kingdom or Switzerland as if set out in this Section, with references to the EU SCCs read as references to Module One.
(f) Security and incidents. Aditude will implement appropriate technical and organizational measures to protect Identity Service Data. Aditude will notify Controller of a Security Breach involving Identity Service Data collected from the Digital Media Assets when required by applicable Data Privacy Laws.
(g) Suspension and termination. Controller may terminate the Identity Service on thirty days’ written notice, and remains responsible for any implementation and deconfiguration costs as applicable. Aditude may suspend or terminate the Identity Service, in whole or in part, on written notice if Aditude reasonably determines that its continued provision would not comply with applicable Data Privacy Laws or with the terms of an agreement with an Identity Service Provider. Termination of the Identity Service does not terminate the Addendum or the Agreement.
3. Controller Representations. Controller represents and warrants that (a) it has the authority to authorize the Identity Service for the Digital Media Assets, and will not enable the Identity Service for any jurisdiction, data category, or purpose for which the required legal basis or authorization is absent; (b) it has provided and will provide notice at or before the point of collection meeting the requirements of applicable Data Privacy Laws, including as to the categories of Personal Data collected, the categories of recipients, and any right to opt out of the sale or sharing of Personal Data, and has obtained and will maintain any consent or other lawful basis required by applicable Data Privacy Laws; and (c) it will pass to Aditude the consent signals and opt-out preference signals it collects.
4. Indemnification. For purposes of this Appendix A, Section 11 of the Addendum applies in accordance with the roles allocated here and to each Party’s breach of this Appendix A, including Controller’s representations under Section 3.
5. General. This Appendix A survives termination or expiration of the Addendum and the Agreement for so long as Aditude Processes any Identity Service Data.