join us today
If you are interested in working with us, please fill out the contact form and one of our team members will reach out to you to discuss how Between Exchange can help meet your needs.
We (“Supply/Sell Side platform”, “SSP”), whether directly or indirectly, owns and operates this website, including portals and user interfaces and the services and content thereon. Your use of and access to the site constitute your agreement to be bound by these standard terms of service and any additional rules and guidelines that we post on the site. If you do not agree to be bound by these standard terms of service, then you have to reconcile with us the individual terms and conditions in separate insertion order (IO) or you must not use the site. We will definitely prior notify you of all changes on the site. We recommend that you periodically visit this page to review by these standard terms of service. By using the site after we post any changes, you agree to accept those changes, whether or not you actually reviewed them.
Standard Terms for Publishers
Last updated on 31 December 2021
DEFINITIONS
The following definitions shall apply to these Standard Terms:
“Ad” means advertising digital materials of any type.
“Advertising Code” means a string of the code provided by SSP at Personal Account, that is designed to be inserted into the code of a Publisher’s Site or mobile application, which communicates with servers designated by SSP and requests transmission from those servers of Buyer’s Ads.
“Bid” means a Buyer’s offer to buy an Ad display in an available Placement.
“Buyer” means an advertiser, agency, demand side platform or other party who places Bids through, and/or otherwise purchases online advertising inventory from the Platform.
“End User” means a human visitor to a Publisher’s Site.
“Impression” means an instance in which an Ad is served to, and received by, an End User on a Publisher’s Site or mobile application as measured by SSP.
“Insertion Order (IO)” means a mutually agreed insertion order that incorporates these Standard Terms.
“Personal Account” means the user interface provided by SSP through which Publisher may access an Advertising Code or receive reporting statistics or Publisher’s revenue calculation in accordance with the Standard Terms. Access to the Personal Account is carried out by entering the Publisher login and password.
“Placement” means the Ads display locations on the Publisher’s Site reconciled by the Parties in the Personal Account.
“Platform” means SSP proprietary online trading platform, where auctions for the right to place Ads are conducted.
“Publisher’s Site” means any website, mobile application, or other media owned or operated by Publisher, or on which Publisher is legally authorized to act in the manner contemplated by these Standard Terms.
“SSP” means our supply-side platform, a software system that allows Publishers to offer their available inventory to Ad exchanges and Buyers.
1. SUBJECT OF STANDARD TERMS
1.1. Using its Personal Account on the Platform the Publisher agrees to place the Advertising Code on the Publisher’s Site or separate pages of it or mobile application that will be used for the Ad delivery and Ad Placement.
1.2. SSP is in charge of performing all the calculation considering traffic, the number of clicks, impression served and related statistics, which Publisher can find out in the Personal Account on the Platform.
1.3. As SSP’s Platform is in charge of counting the total number of impressions served and the revenue generated, the total sum that should be paid to the Publisher will be defined referring to the Platform system’s indications combined with Publisher’s data assessed by SSP.
1.4. SSP shall record the number of Ad Impressions to End Users on an accrual basis over the course of a month and pay the Publisher’s revenue in accordance with these Standard Terms.
1.5. Publisher shall execute a registration process and create the Personal Account by providing current, complete and accurate information to SSP at the Platform. Upon completion of the registration process, SSP shall provide Publisher with access to Personal Account interface.
1.6. The Parties may change the terms and conditions of these Standard Terms in the Insertion Order (IO). The terms and conditions of the Insertion Order (IO) have the prevailing legal force.
1.7. These programmatic technologies may be used on the Platform:
2. VALID WEBSITE(S)
2.1. It is up to SSP to select which Publisher’s Site to collaborate with so the SSP reserves the right to decline certain website such as:
2.2. SSP reserves the right to make occasional audits on Publisher’s Site in order to ensure the inventory is compliant to the Standard Terms. If during the course of such inspection the violation will be revealed by SSP, the account of such Publisher will be notified via email and suspended and the Ad will not be served at such site. The Publisher may appeal within 30 days of notification and dispute the suspension. SSP reserves the right to decide on the appeal and either restore or terminate the Publisher account. SSP will not be accountable on compensating the revenue to the Publisher who served the Ads at such Websites.
3. PUBLISHER OBLIGATIONS
3.1. Publisher warrants and confirms that:
3.1.1. Publisher will not provide any data (including data containing Personal Data) to the Platform unless it has the right to do so in accordance with all applicable laws.
3.1.2. Publisher will not provide any information to the SSP Platform that contains sensitive Personal Data.
3.1.3. Publisher agrees to carry both financial and regulatory responsibility for Personal Data leakage happened due to non compliance with 3.1.1
3.1.4. Publisher will not use any artificial software or hardware to fraudulently increase the number of Ad impressions.
3.1.5. Publisher will not search for and exploit vulnerabilities in the software code or algorithm of the Platform in order to artificially fraudulently increase the number of Ad impressions.
3.2. Publisher agrees that it shall not engage in any form of fraudulent traffic generating methods including: robots, spiders, auto-spawning browsers, auto reloading, meta refreshes or any other form of fraudulent and artificial traffic.
3.3. Publisher shall integrate the ads.txt file provided by SSP in the root directory of the Publisher’s Site.
4. SSP OBLIGATIONS
4.1. SSP shall use all reasonable endeavors to provide Ad to Publisher in accordance with these Standard Terms.
4.2. SSP shall use all reasonable endeavors to ensure that Buyers ensure that their Ad and the websites, goods and services that they promote shall comply with the applicable law.
4.3. SSP will measure Ad Impressions to End Users using Platform reporting systems. If there is a discrepancy between the SSP and Publisher’s reporting systems, the SSP Platform reporting systems will prevail, but SSP will discuss any such discrepancy over 10% with Publisher upon request and use all reasonable endeavors to resolve the matter to Publisher’s reasonable satisfaction.
5. PAYMENTS
5.1. SSP constantly takes into account all Ad impressions and evaluates the quality of Publisher’s traffic using its own and third-party fraud detection systems. A fraud increase in Ad traffic is excluded from statistics and payment.
5.2. SSP constantly evaluates the quality of Publisher’s traffic (Ad impressions) using its own and third-party fraud detection systems. A fraud increase in Ad traffic is excluded from statistics and payment. Publisher may request reasons for excluding part of the traffic from statistics and payment within ten (10) days from the end of the month, and then the SPP is obliged to provide a motivated response within five (5) working days.
5.3. Publisher may request reasons for excluding part of the traffic from statistics and payment within ten (10) days from the end of the month, and then the SPP is obliged to provide a motivated response within five (5) working days.
5.4. In order to receive revenue, the Publisher shall create a withdrawal request within ten (10) days after the end of the reporting month using the interface of the Personal Account. SSP may require and Publisher, in this case, will be obliged to provide an invoice for payment by email.
5.5. Self-Invoicing. SSP may issue, on behalf of Publisher, and Publisher agrees to accept invoices prepared by SSP Platform reporting the monthly revenue and amounts due.
5.6. Payment terms are set in the Insertion Order (IO). Except as otherwise agreed upon by the Parties, all payments will be made in U.S. dollars.
5.7. To ensure timely payment, Publisher must notify SSP of any changes to its account information, including change of address, phone or email address.
6. LICENSES
6.1. Subject to the terms and conditions of these Standard Terms, SSP grants to Publisher a limited, non-assignable, non-transferable, non-exclusive, non-sublicensable right and license to access the Platform, to use the Advertising Code or other integration method and to perform or display Ads on the Publisher’s Site (where applicable), solely for the purpose of performance of these Standard Terms and solely during the term hereof.
6.2. Publisher grants SSP a limited license to use and display Publisher’s name and logo (in the form provided by Publisher) and the respective URLs of the Publisher’s Site in connection with SSP’s sales and marketing materials during the term hereof. By listing Placements through the SSP Platform, or by bidding on Placements, Publisher grants SSP a limited, non-exclusive, fully paid-up license to display Placements (and content therein) in the Platform to be viewed and Bid on by Buyers in accordance with any Placement settings defined by Publisher.
6.3. SSP grants Publisher a limited license to use and display SSP’s name and logo (in the form provided by SSP) and the respective URLs of the SSP’s Site in connection with Publisher’s sales and marketing materials during the term hereof.
6.4. Except as may be expressly provided herein, neither Party shall have or obtain any rights in or to any intellectual property of the other Party in connection with these Standard Terms. SSP retains all right, title and interest in and to the Platform, the technology used by SSP to operate the Platform, SSP’s trademarks, and all enhancements made by SSP from time to time, including but not limited to all patent, trademark, copyright, trade secret and all other intellectual property rights.
7. PRIVACY AND DATA USAGE
7.1. Each party agrees to post on its website(s) an up-to-date and accurate privacy policy that: (i) complies with all applicable laws, rules, and regulations; (ii) accurately discloses all applicable data collection, use and disclosure practices, including the use of cookies, pixels, beacons, locally stored objects, or other similar technologies for purposes of targeting individual End Users with advertisements. Publisher further agrees that its privacy policy(ies) will provide End Users with a conspicuous link to a functional opt-out page.
7.2. To the extent that any data, including persistent identifiers (such as IP address or device identifiers) or precise geo-location data about End Users are collected, used, transmitted, or processed by or on behalf of Publisher, Publisher represents and warrants that all appropriate consents and waivers have been or will be obtained from such End User, including consents necessary to collect information about individual End Users through the use of technologies, such as cookies, located on the end user’s device. Notwithstanding anything to the contrary in these Standard Terms, SSP shall have the right to collect, use and disclose data transmitted through or otherwise derived from Publisher’s use of Platform in compliance with the applicable privacy policy(ies).
7.3. SSP collects certain data from Publisher, which may include End User “Personal Data” as defined in the CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation). To the extent that such Personal Data relates to End Users located in the USA, or the European Economic Area, Publisher acknowledges that Publisher acts for the purposes of compliance with applicable laws and regulations. Publisher and SSP agree to implement appropriate technical and organizational security measures to protect the Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, loss of integrity, and against all other unlawful forms of processing. Because such Personal Data is collected through the use of tracking technologies such as cookies and pixels, Publisher represents and warrants that Publisher has obtained or will obtain the necessary consent from the applicable End User as required by any law or regulation, before such tracking technologies are set on the applicable End User’s device.
7.4. The Parties shall take reasonable efforts to ensure the reliability of its employees, agents, contractors and partners who may have access to the Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know/access the relevant Personal Data. The Parties shall also ensure that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
7.5. Each Party acknowledges that Confidential Information may be disclosed to the other Party during the course of these Standard Terms. The recipient of Confidential Information agrees that it will take reasonable steps, at least substantially equivalent to the steps it takes to protect its own proprietary information, but in no event shall such protection be less than a reasonable standard of care, during the term of these Standard Terms, and for a period of three (3) years following expiration or termination of these Standard Terms.
8. INDEMNIFICATION AND LIMITATION OF LIABILITY
8.1. Except for any payment obligations, neither Party will be liable for any delay or failure to perform hereunder due to circumstances beyond such Party’s reasonable control including acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes (not involving such Party’s employees), or disruptions involving power or infrastructure systems not within such Party’s possession or reasonable control (each a “Force Majeure Event”). In the event of any Force Majeure Event lasting more than thirty (30) days, either Party adversely affected by that Force Majeure Event may terminate these Standard Terms.
8.2. Ad can not be changed or altered by the Publisher without prior written consent obtained from SSP. Ad can not be shared in the emails, personal messages or any other source by the Publisher, copied, sold, or used for any other purposes. The violation of this rule may lead to certain circumstances as the payments or Standard Terms termination.
8.3. The Publisher acknowledges that any fraudulent activity aimed at augmenting the number of clicks is strictly prohibited and can bear severe consequences, regardless of intent, means or form of execution. To such prohibited methods can be attributed: manipulations with click destinations for ad-banner’s, redirection of users to different pages, browser auto-spawning, blind text links, other practices determined by SSP as harmful or unacceptable and affect impressions or click-through rates. On the automatically reloading pages the Ad Placement is also not accepted. Publisher shall not ask End Users to click on the certain areas of the Publisher’s Site, don’t incentivize them to click on the Ad before they visit its site. Applying artificial click/visit boosters may inflict the sanctions on the Publisher ending with account and all payments termination. The decision of the termination is absolutely due to consideration of SSP.
8.4. In no event shall either Party be liable to the other for any: (a) loss of profits; (b) loss of goodwill; (c) loss of income; (d) business interruption loss.
8.5. Each Parties’ aggregate liability (whether in contract, tort or otherwise) under or in connection with these Standard Terms shall not exceed the net amount payable by SSP to Publisher in any rolling six (6) calendar month period ending the date on which such liability arises.
8.6. Any claim for indemnification hereunder shall be subject to the following provisions: (a) the Indemnifying Party shall be given prompt written notice of the claim by the indemnified Party, provided that any delay in providing notice shall not relieve the indemnifying Party of its indemnity obligations under these Standard Terms; (b) the Indemnified Party shall reasonably cooperate with the Indemnifying Party and its counsel at the indemnifying Party’s cost and expense.
8.7. In case the payment was not received by SSP from the Buyers in the events of bankruptcy, suspensions of the Buyer’s business activity or by other reasons, the payment of the Publisher’s services may be delayed as well up to the period until the receipt of the Buyers’ payment for Ad Placement.
9. TERMINATION
9.1. A party shall have the right to terminate these Standard Terms if the other party breaches any material term or condition of these Standard Terms and fails to cure such breach within ten (10) days after receipt of written notice of such breach. Termination of these Standard Terms by either party for breach will be a non-exclusive remedy for breach and will be without prejudice to any other right or remedy of such party.
9.2. In the event of termination of these Standard Terms, Publisher shall immediately cease using the SSP services, and each party shall destroy or return to the other party all copies in any form of the other party’s confidential information.
10. FINAL PROVISIONS
10.1. If the Publisher is a resident of or has a principal place of business in the United States of America, all claims arising out of or relating to the Standard Terms or the Services will be governed by the laws of the State of New York, excluding that state’s conflict of laws rules will be litigated exclusively in the federal and New York State courts of competent jurisdiction located in New York County, New York, USA, and the Parties consent to personal jurisdiction in those courts. In all other cases, these Standard Terms, and any issues or disputes of whatever nature arising out of or in any way relating to it or its formation (whether such disputes are contractual or non-contractual in nature, such as claims in tort, for breach of statute or regulation, or otherwise) shall be governed by and construed in accordance with the laws of England and Wales the Parties submit to the exclusive jurisdiction of the courts of England and Wales.
10.2. All notices under these Standard Terms must be in the English language, in writing and shall be sent to the address of the recipient set out in the Insertion Order (IO) or such other address as the recipient may designate by notice given in accordance with this section.
10.3. Scanned-images in PDF format of signed, sealed documents, received through the transmission of electronic messages, have the power of the original.
10.4. The Insertion Order (IO) can be signed using electronic document exchange and signature systems, for example DocuSign, and in this case it also has the power of the original.
Standard Terms for Demand Partners
Last updated on 31 December 2021
DEFINITIONS
The following definitions shall apply to these Standard Terms:
“Ad” means advertising digital materials of any type.
“Bid” means a Buyer’s offer to buy an Ad display in an available Placement.
“Bid Request” means a bargaining application. It contains information about Placement, time of Impression, as well as data from the End user’s device (IP address, web beacons or cookie, etc.).
“Bid Response” means a response to a Bid Request. It contains such information as Bid, banner/video ID, Tag and Buyer ID.
“Buyer” means an advertiser, agency, or other party who places Bids through, and/or otherwise purchases online advertising inventory from DSP System.
“DSP System” means an automated technology platform (Demand-Side Platform) designed for procurement of Impressions, that interacts with SSP System.
“End User” means a human visitor to a Publisher’s site.
“Impression” means an instance in which an Ad is served to, and received by, an End User on a Publisher’s site or mobile application as measured by SSP System and DSP System.
“Insertion Order (IO)” means a mutually agreed insertion order that incorporates these Standard Terms.
“Personal Account” means the user interface provided by SSP through which DSP may receive reporting statistics of traffic in accordance with the Standard Terms. Access to the Personal Account is carried out by entering DSP login and password.
“Placement” means Ads display locations on the Publisher’s site.
“Publisher” means owner or an authorized seller of any website, or mobile application, or other media on which an Ad Placement occurs.
“Real Time Bidding (RTB)” means a method of automated buying/selling of Ad Impressions on a real-time auction basis.
“SSP System” means an automated technology platform (Supply-Side Platform) that allows selling and buying Ad inventory. SSP System conducts Real Time Bidding (RTB) with DSP System.
“Tag” means scripts that communicate with servers designated by DSP and request transmission of Ads from those servers.
1. SUBJECT OF STANDARD TERMS
1.1. SSP and DSP shall integrate their platforms (SSP System and DSP System) to fulfill the terms and conditions of these Standard Terms.
1.2. DSP System shall receive Bid Requests for Ads from the SSP System in response to which DSP System shall provide Bid Response to SSP System.
Upon receipt of such Bid Response, SSP System shall select through RTB auction which Bid best fits the criteria set out in their Bid Request (the “winning Bid”).
Upon selection of the winning Bid, DSP System shall procure delivery of the winning Ad to the relevant Publisher’s site.
1.3. The cost for each Ad Impression to the End User on Publisher’s site is payable by DSP to SSP in accordance with these Standard Terms and Insertion Order (IO).
1.4. SSP shall record the number of Ad Impressions to End Users on an accrual basis over the course of a month and DSP shall pay SSP revenue in accordance with the terms of the Standard Terms.
1.5. The Parties may change the terms and conditions of these Standard Terms in the Insertion Order (IO). The terms and conditions of the Insertion Order (IO) have the prevailing legal force.
2. SSP OBLIGATIONS
2.1. SSP warrants and confirms that all sites and their content shall not:
(a) violate or encourage violation of any applicable legislation, regulations or advertising law;
(b) infringe any intellectual property rights of any third party or contain any material which may be abusive, obscene, threatening, or defamatory;
(c) be pornographic, obscene or contain sexually explicit images or activity;
(d) promote or contain links to malware including but not limited to viruses, malvertising, cloaked mobile paid services.
2.2. SSP System will not provide any information to DSP System that contains sensitive Personal Data.
2.3. SSP shall provide to DSP all updates (including, but not limited to general bug fixes and minor enhancements) and upgrades (including, but not limited to enhancements and major functionality changes) for SSP System reflecting improvements made to the underlying technology upon the implementation of such updates and upgrades.
2.4. SSP will host, customize and implement SSP System and ensure its performance in accordance with these Standard Terms.
2.5. On a monthly basis, not later than every tenth (10th) day of the month, SSP will provide DSP with information on the volume of services rendered and the amount of revenue for the month. DSP has the right to contest this information within ten (10) days.
3. DSP OBLIGATIONS
3.1. DSP warrants and confirms that Ad and the websites, goods and services that they promote shall not:
(a) violate or encourage violation of any applicable legislation, regulations or advertising law;
(b) infringe any intellectual property rights of any third party or contain any material which may be harmful, abusive, obscene, threatening, or defamatory;
(c) be pornographic, obscene or contain sexually explicit images or activity;
(d) promote or contain links to malware including but not limited to viruses, malvertising, cloaked mobile paid services;
(e) Ad should not imitate the design of the site (creative should not merge with the background of the site), has an irritating effect on the End User (blink, sound loud, etc.).
3.2. DSP must never serve Ads with the following attributes:
3.3. In case of claims of third parties on violation of their legal rights by Ad, Impressions/ Placements, DSP is obliged independently and at its own expense to take measures for settlement of these claims.
3.4. DSP shall execute a registration process and create the Personal Account by providing current, complete and accurate information at SSP System. Upon completion of the registration process, SSP shall provide DSP with access to Personal Account interface.
4. SYSTEMS INTEGRATION
4.1. SSP System will transmit to DSP System Bid Request. DSP System in reply on Bid Request will provide Bid Response to SSP System with information on Bid CPM (advertising cost per thousand Impressions).
4.2. The Bid, that forms the subject of the Bin Response, shall compete in near real time with other Bids submitted to SSP System for Placement/Impression.
In the event that such Bid (that forms the subject of the Bid Response) wins the RTB auction, an Ad shall be delivered (in near real time) to the applicable site, all in accordance with the winning Bid.
Note: for the provision of services in real-time, DSP System shall give a Bid Response on a Bid Request of SSP System within the given timeframe. The timeframe may be sent in Bid Request or agreed by the parties additionally. Failure to comply with this requirement by DSP recognized as its refusal of Ad Placement on the terms contained in the Bid Request of SSP System.
4.3. It is up to SSP System to decide whether to make the Placement or not to make the Placement of Ad provided by DSP System.
4.4. The cost of Ad Impression shall be determined at the RTB auction conducted by SSP System, and cannot be higher than the Bid specified in the Bid Response.
4.5. SSP System automatically report DSP System the cost of the Impression and invoke Ad from DSP System for Placement/Impression on agreed terms.
4.6. SSP is in charge of performing all the calculation considering traffic, the number of clicks, impression served and related statistics, which DSP can find out in the Personal Account.
4.7. The quantity, cost, Impression times, Placements, and other information contained in Bid Response and Bid Request are recorded in SSP System and DSP System event logs.
4.8. Either Party may request an event log from the other Party in order to analyze the scope of services provided. The minimum storage period for event logs is 90 calendar days.
4.9. SSP does not guarantee Placement/Impression of Ad in the required of DSP amount.
4.10. DSP shall ensure work capacity of Tags. Request the Ad on Tag is the moment of taking Impression into account by SSP System.
4.11. SSP will measure Ad Impressions to End Users using reporting systems of SSP System. If there is a discrepancy between SSP System and DSP System statistics, SSP System statistic will prevail, but SSP will discuss any such discrepancy over 10% with DSP upon request and use all reasonable endeavors to resolve the matter to DSP’s reasonable satisfaction.
5. PAYMENTS
5.1. The revenue payable by DSP for Ad Impressions shall be calculated in accordance with the type of auction specified in the Bid Request, but not lower than the floor price set by the SSP, if any.
5.2. SSP shall issue and send to the designated e-mail address of DSP stated in Insertion Order (IO) an invoice for payment within ten (10) calendar days from the end of the reporting month. Any dispute regarding an invoice must be submitted to the designated e-mail address of SSP in writing within ten (10) calendar days of receipt or it shall be deemed waived.
5.3. The Parties agree to be solely responsible from their side for reporting, declaring and/or paying of any applicable direct or indirect taxes, duties, levies imposed on the transactions under these Standard Terms. Bank transaction fee shall be borne by DSP.
6. INTELLECTUAL PROPERTY RIGHTS
6.1. SSP provides to DSP a limited, non-transferable, non-exclusive right to access and use SSP System during the validity of these Standard Terms solely as provided herein.
6.2. SSP retains all rights, title and interest, including, but not limited to intellectual property rights, in and to any and all content of SSP System. DSP retains all rights, title and interest including, but not limited to intellectual property rights, in and to any and all content of DSP System.
6.3. No part of the content of SSP System and DSP System may be copied, reproduced, republished, posted, displayed, encoded, translated, transmitted or distributed in any way to any other computer, server, website or medium for publication or distribution or for any commercial enterprise, without the respective prior written consent of the Parties.
6.4. If the Party becomes aware of any infringement, actual, threatened or suspected, or any other unauthorized use of the other Party`s proprietary rights, such Party shall promptly give notice to the other Party in writing. The Party whose rights were infringed shall, at its sole discretion, take whatever action deemed necessary in connection with the unauthorized use and/or infringement.
7. PRIVACY AND DATA USAGE
7.1. Both Parties understand and acknowledge that information and data transferred from SSP to DSP under these Standard Terms may be subject to California Consumer Privacy Act (“CCPA”), European Union’s General Data Protection Regulation (“GDPR”) or other applicable laws.
7.2. SSP and DSP are responsible for strict compliance with CCPA, GDPR or other applicable laws and for ensuring that the processing of Personal Data shall be in compliance with CCPA, GDPR or other applicable laws. Such information shall be afforded all of the applicable protections as well as the additional safeguards specified herein in order to ensure that any processing of information complies with CCPA, GDPR or other applicable laws.
7.3. The Parties shall take reasonable efforts to ensure the reliability of its employees, agents, contractors and partners who may have access to the personal data, ensuring in each case that access is strictly limited to those individuals who need to know/access the relevant personal data. The Parties shall also ensure that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
7.4. The Parties shall implement all necessary technical and organizational measures to ensure the security of personal data, which is collected from the data subjects, including, but not limited to the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident and a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
7.5. The Parties shall establish, implement, and operate an information security program that includes administrative, physical and technical safeguards for the protection of the security, confidentiality and integrity of the personal data in accordance with CCPA, GDPR and other Data Protection Laws, including, but not limited to safeguards related to: physical and environmental security measures, information transmission, periodic risk assessments, passwords, access control and authorization, responsibilities and accountability, encryption algorithms, secured software, web security, development and maintenance, incident management, fault and intrusion detection, secured information destruction and disposal, mitigation of vulnerabilities, back-up and business continuity, host services monitoring, employees confidentiality and background checks.
8. INDEMNIFICATION AND LIMITATION OF LIABILITY
8.1. Except for any payment obligations, neither Party will be liable for any delay or failure to perform hereunder due to circumstances beyond such Party’s reasonable control including acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes (not involving such Party’s employees), or disruptions involving power or infrastructure systems not within such Party’s possession or reasonable control (each a “Force Majeure Event”). In the event of any Force Majeure Event lasting more than thirty (30) calendar days, either Party adversely affected by that Force Majeure Event may terminate these Standard Terms.
8.2. In no event shall either Party be liable to the other for any: (a) loss of profits; (b) loss of goodwill; (c) loss of income; (d) business interruption loss.
8.3. Each Parties’ aggregate liability (whether in Standard Terms, tort or otherwise) under or in connection with these Standard Terms shall not exceed the net amount payable by DSP to SSP in any rolling six (6) calendar month period ending the date on which such liability arises.
8.4. Any claim for indemnification hereunder shall be subject to the following provisions: (a) the Indemnifying Party shall be given prompt written notice of the claim by the indemnified Party, provided that any delay in providing notice shall not relieve the indemnifying Party of its indemnity obligations under these Standard Terms; (b) the Indemnified Party shall reasonably cooperate with the Indemnifying Party and its counsel at the indemnifying Party’s cost and expense.
8.5. SSP has the right to suspend/stop Placement of DSP Ad in case of delay in payment of SSP revenue more than fifteen (15) days, until date of debt repayment.
9. TERMINATION.
9.1. A party shall have the right to terminate these Standard Terms if the other party breaches any material term or condition of these Standard Terms and fails to cure such breach within ten (10) days after receipt of written notice of such breach. Termination of these Standard Terms by either party for breach will be a non-exclusive remedy for breach and will be without prejudice to any other right or remedy of such party.
9.2. In the event of termination of these Standard Terms, Publisher shall immediately cease using the SSP services, and each party shall destroy or return to the other party all copies in any form of the other party’s confidential information.
10. FINAL PROVISIONS
10.1. If the DSP is a resident of or has a principal place of business in the United States of America, all claims arising out of or relating to the Standard Terms or the Services will be governed by the laws of the State of New York, excluding that state’s conflict of laws rules will be litigated exclusively in the federal and New York State courts of competent jurisdiction located in New York County, New York, USA, and the Parties consent to personal jurisdiction in those courts. In all other cases, these Standard Terms, and any issues or disputes of whatever nature arising out of or in any way relating to it or its formation (whether such disputes are contractual or non-contractual in nature, such as claims in tort, for breach of statute or regulation, or otherwise) shall be governed by and construed in accordance with the laws of England and Wales the Parties submit to the exclusive jurisdiction of the courts of England and Wales.
10.2. All notices under these Standard Terms must be in the English language, in writing and shall be sent to the address of the recipient set out in the Insertion Order (IO) or such other address as the recipient may designate by notice given in accordance with this section.
10.3. Scanned-images in PDF format of signed, sealed documents, received through the transmission of electronic messages from and to designated e-mail addresses of the Parties, have the power of the original.
10.4. The Insertion Order (IO) can be signed using electronic document exchange and signature systems, for example DocuSign, and in this case it also has the power of the original.
Standard Terms of Data Processing
Last updated on 31 December 2021
1. SCOPE AND SUBJECT MATTER OF THE AGREEMENT
This Data Processing Agreement (“DPA”) reflects the parties’ agreement on personal data processing with respect to your agreement with us.
Depending on our and your role in respect of data processing on each case you may be subject to the terms either related to Processor or Joint Controller.
2. DEFINITIONS
In this DPA:
“Services” means the services provided by each Party to the other Party;
“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’);
“Controller” means the Party which, alone or jointly with others, determines the purposes and means of the processing of personal data;
“Processor” means the Party which processes personal data on behalf of the Controller.
“Process/processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Sub-processor” or “Sub-contractor” means a third party subcontractor engaged by the Processor which, as part of the subcontractor’s role of delivering the Services, Processes Personal Data;
“Technical and organisational security measures” means those measures aimed to ensure a level of security appropriate to the risk including inter alias the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
“Data Protection Laws” means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their Member states, applicable to the Processing of Personal Data under the DPA.
3. APPLICATION OF AGREEMENT
This DPA shall apply to all Personal Data related to the Services:
Categories of Data Subjects: Data Subjects include individuals interacting with the ads demonstrated by the Parties acting as publishers.
This DPA shall not apply to data of children below 16; personal data revealing racial or ethnic origin, criminal offences, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The Parties shall not knowingly process such data and will take all reasonable measures to avoid processing of such data.
4. AUDIT RIGHTS
Each Party may audit the other Party’s compliance with the terms of the DPA up to once per year. A Party may perform more frequent audits of the computer systems that Process Personal Data to the extent required by applicable laws. If a third party is to conduct the audit, the third party must be mutually agreed to by both Parties and must execute a written confidentiality agreement acceptable to both Parties before conducting the audit.
To request an audit, the respective Party must submit a detailed audit plan at least 4 weeks in advance of the proposed audit date describing the proposed scope, duration, and start date of the audit. The opposing Party will review the audit plan and provide the other Party with any concerns or questions (for example, any request for information that could compromise security, privacy, or employment policies).
The audit reports are confidential information of the Parties. Any audits are at the expense of the Party requesting audit.
5. INCIDENT MANAGEMENT AND BREACH NOTIFICATION
Each Party evaluates and responds to incidents that create suspicion of unauthorized access to or handling of Personal Data.
The Party informed of such incidents and, depending on the nature of the activity, defines escalation paths and response teams to address those incidents. The Parties will mutually work, with the appropriate technical teams to respond to the incident. The goal of the incident response will be to restore the confidentiality, integrity, and availability of the Services environment, and to establish root causes and remediation steps. Each Party’s operations staff is instructed on responding to incidents where handling of personal data may have been unauthorized.
The respective Party shall notify the other Party without undue delay after becoming aware of a personal data breach and shall promptly investigate any security breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available, unless prohibited by law, the respective Party will provide the other Party with a description of the security breach, the type of data that was the subject of the breach, and other information reasonably required. The Parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons.
6. LEGALLY REQUIRED DISCLOSURES
Except as otherwise required or permitted by law, disclosing Party will promptly notify the other Party of any subpoena, judicial, administrative or arbitral order of an executive or administrative agency or other governmental authority (“demand”) that it receives and which relates to the Personal Data the disclosing Party is Processing on the other Party’s behalf. The other Party will provide reasonable information in its possession that may be responsive to the demand and any assistance reasonably required for the disclosing Party to respond to the demand in a timely manner.
7. MODIFICATION AND TERMINATION
The Parties agree that on the termination of the provision of the Services or this DPA, each Party will make available for retrieval or otherwise will return other Party’s Personal Data, unless legislation imposed upon the Parties prevents it from returning or destroying all or part of the Personal Data transferred. In that case, the Parties warrant that they will guarantee the confidentiality of the Personal Data and will not actively process the Personal Data.
Any Party may terminate this DPA for convenience with 5 days prior notice to the other Party. The Company is entitled to modify this DPA unilaterally provided that prior notice on the respective modifications will be sent to the other Party.
8. TECHNICAL AND ORGANIZATIONAL MEASURES
Each Party shall ensure that it implements and maintains compliance with appropriate technical and organizational security measures for the Processing of the respective Data. Accordingly, each Party will implement the following measures:
9. DISPUTE RESOLUTION
Each Party will create an escalation process and provide a written copy to the other Party within five (5) business days of any dispute arising out of or relating to this DPA. The escalation process will be used to address disputed issues related to the performance of this DPA, including but not limited to technical problems. The Parties agree to communicate regularly about any open issues or process problems that require prompt and accurate resolution as set forth in their respective escalation process documentation. The Parties will attempt in good faith to resolve any dispute arising out of or relating to this DPA, before and as a prior condition for commencing legal proceedings of any kind, first as set forth above in the escalation process and next by negotiation between executives who have authority to settle the controversy and who at a higher level of management than the persons with direct responsibility for administration of this DPA. Any Party may give the other Party written notice of any dispute not resolved in the normal course of business. Within two (2) business days after delivery of the notice, the receiving Party shall submit to the other a written response. The notice and the response will include (a) a statement of each Party’s position and a summary of arguments supporting that position and (b) the name and title of the executive who will represent that Party and of any other person who will accompany the executive. Within five (5) business days after delivery of the disputing Party’s notice, the executives of both Parties shall meet at a mutually acceptable time and place, including telephonically, and thereafter as often as they reasonably deem necessary, to attempt to resolve the dispute. All reasonable requests for information made by one Party to the other will be honored. All negotiations pursuant to this clause are confidential and will be treated as compromise and settlement negotiations for purposes of applicable rules of evidence.
TERMS FOR DATA PROCESSORS
Data Processors are typically the Parties which provide hosting, fraud detection and other supplementary services on behalf of the other Party.
Categories of Personal Data and Purpose of Processing
In order to perform the Services the Party acting as a customer authorizes and requests that the Party acting as a Service provider process the following Personal Data of mobile app users and other individuals engaged into relationship with the customer:
The Party acting as a Service provider processes the Personal Data according to the applicable law and the terms of this DPA for the purposes specified in the agreement covering provision of the Services including hosting, fraud protection and technical maintenance and analytics services.
Responsibility of the Processor
The Processor shall Process Personal Data solely for the provision of the Services, and agrees to:
Responsibility of the Controller
The Controller agrees that it shall ensure compliance at all times with the applicable data protection law, and, in particular, the Controller shall ensure that any disclosure of Personal Data made by it to the Processor is made with the Data Subject’s consent or is otherwise lawful. The control of Personal Data remains with the Controller.
Rights of Data Subjects
Processor shall pass on to the Controller any requests of an individual Data Subject to delete, release, correct or block Personal Data Processed under the DPA.
Processor will grant the Controller with electronic access to the digital environment that holds Personal Data to permit the Controller to delete, release, correct or block access to specific Personal Data or, if that is not practicable and to the extent permitted by applicable law, follow Controller’s written instructions to delete, release, correct or block access to Personal Data.
Cross Border and Onward Data Transfer
The Processor will undertake data protection and confidentiality obligations consistent with applicable data protection laws where a Processor processes Personal Data in or from a country that has not received an “adequacy” finding, and will execute Model Clauses incorporating security requirements consistent with those of this DPA.
Subprocessing
The Processor will enter into contracts with subprocessors which provide that the subprocessor will undertake data protection and confidentiality obligations consistent with applicable data protection laws.
Where the Processor subcontracts its obligations under the DPA it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on Processor under the DPA. Where the subprocessor fails to fulfill its data protection obligations under such written agreement the Processor shall remain fully liable to the Controller for the performance of the subprocessor’s obligations under such agreement.
The Data Controller may request that the Processor audit the subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Data Controller in obtaining a third-party audit report concerning subprocessor’s operations) to ensure compliance with such obligations. The Controller also will be entitled, upon written request, to receive copies of the relevant terms of the Processor’s agreement with subprocessors that may process Personal Data, unless the agreement contains confidential information, in which case the Processor may provide a redacted version of the agreement.
Terms for Joint Controllers
Joint Controllers are typically the Parties which jointly determine means and purposes of processing, including (but not limited to) publishers, advertisers, demand partners, supply partners (either direct or indirect), and ad mediators.
Categories of Personal Data and Purpose of Processing
In order to perform the Services the Party acting as a joint controller shall bear all respective responsibilities as a controller and will process the Personal Data related to various parameters of profiles of mobile app users.
Joint Controllers process the Personal Data according to the applicable law and the terms of this DPA for the purposes specified in the agreement covering provision of the Services including ad targeting.
Responsibilities of Joint Controllers
Joint Controllers shall Process Personal Data solely for the provision of the Services, and agree to:
The Controllers agree that they shall ensure compliance at all times with the applicable data protection law, and, in particular, the Controllers shall ensure that any disclosure of Personal Data is made with the Data Subject’s consent or is otherwise lawful.
Responsibility of the Publishers
Each Joint Controller acting as a publisher is the primary contact point for Data Subjects in respect of consent obtaining/withdrawal and exercising Data Subject’s rights. The publishers are ultimately liable for ensuring that the Personal Data is Processed lawfully and shall provide Data Subjects with all required information and ability to exercise the rights of the Data Subjects. Other Joint Controllers rely on the information provided by the Publishers.
The Publisher will defend, indemnify and hold harmless the other Joint Controllers, their affiliates, independent contractors, service providers and consultants, and its and their respective directors, officers, employees and agents, from and against any third party or government claims, suits or actions and any resulting damages, costs, liabilities and expenses (including, but not limited to, reasonable attorneys’ fees) arising out of or related to your violation of any terms of this DPA and your processing of personal data.
Rights of Data Subjects
Each Joint Controller shall pass on to the other Controllers any requests of an individual Data Subject to delete, release, correct or block Personal Data Processed under the DPA.
Each Controller will permit the other Controllers to delete, release, correct or block access to specific Personal Data or, if that is not practicable and to the extent permitted by applicable law, follow Controller’s written instructions to delete, release, correct or block access to Personal Data.
Cross Border and Onward Data Transfer
Each Controller will undertake data protection and confidentiality obligations consistent with applicable data protection laws where a Controller processes Personal Data in or from a country that has not received an “adequacy” finding, and will execute Model Clauses incorporating security requirements consistent with those of this DPA.
Engaging Other Controllers
The Joint Controllers will enter into contracts with other Joint Controllers provided that such new Joint Controllers will Process the Personal Data according to this DPA. Each Joint Controller shall take reasonable efforts to ensure that other Joint Controllers ara aware of each others’ existence and roles.
Model Clauses for the transfer of personal data to third countries from the Community to third countries (controller to controller transfers)
Definitions
For the purposes of the clauses:
The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.
I. Obligations of the data exporter
The data exporter warrants and undertakes that:
II. Obligations of the data importer
The data importer warrants and undertakes that:
III. Liability and third party rights
Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the data exporter under its data protection law.
In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).
IV. Law applicable to the clauses
These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause.
V. Resolution of disputes with data subjects or the authority
In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
VI. Termination
In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.
In the event that:
The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.
VII. Variation of these clauses
The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.
VIII. Description of the Transfer
The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.
ANNEX A
DATA PROCESSING PRINCIPLES
Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.
Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.
Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter.
Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.
Rights of access, rectification, deletion and objection: Data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority.
Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II.
Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes.
Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:
(a) such decisions are made by the data importer in entering into or performing a contract with the data subject, and
the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.
or (b) where otherwise provided by the law of the data exporter.
ANNEX B
DESCRIPTION OF THE TRANSFER
Data Subjects: mobile app users
Purposes: ad targeting
Categories of Data:
Recipients: ad networks, advertisers, advertising data brokers
MODEL CLAUSES (PROCESSORS)
For the purposes of transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection the Parties agreed on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.
Clause 1 Definitions
For the purposes of the Clauses:
Clause 2 Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Clause 3 Third-party beneficiary clause
The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.
The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
Clause 4 Obligations of the data exporter
The data exporter agrees and warrants:
Clause 5 Obligations of the data importer
The data importer agrees and warrants:
Clause 6 Liability
The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.
If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.
Clause 7 Mediation and jurisdiction
The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
Clause 8 Cooperation with supervisory authorities
The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5(b).
Clause 9 Governing law
The Clauses shall be governed by the law of the Member State in which the data exporter is established.
Clause 10 Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.
Clause 11 Sub-processing
The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement.
The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.
The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.
Clause 12 Obligation after the termination of services
The parties agree that on the termination of the provision of services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph 1.
Cookie Statement
Last updated on 31 December 2021
INTRODUCTION
The following definitions shall apply to these Standard Terms:
We may use cookies, web beacons, tracking pixels, and other tracking technologies when you visit our website, including any other media form, media channel, mobile website, or mobile application related or connected thereto (collectively, the “Site”) to help customize the Site and improve your experience.
We reserve the right to make changes to this Cookie Statement at any time and for any reason. Any changes or modifications will be effective immediately upon posting the updated Cookie Statement on the Site.
You are encouraged to periodically review this Cookie Statement to stay informed of updates. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Cookie Statement by your continued use of the Site after the date such revised Cookie Statement is posted.
USE OF COOKIES
A “cookie” is a string of information which assigns you a unique identifier that we store on your computer. Your browser then provides that unique identifier to use each time you submit a query to the Site. We use cookies on the Site to, among other things, keep track of services you have used, record registration information, record your user preferences, keep you logged into the Site, facilitate purchase procedures, and track the pages you visit. Cookies help us understand how the Site is being used and improve your user experience.
We use cookies to track your session information in order to improve your experience of the Site and the quality of our Service. A cookie is a small text file that is stored on a user’s computer for record-keeping purposes. We do link the information we store in cookies to any personal information you submit while on our site.
TYPES OF COOKIES
The following types of cookies may be used when you visit the Site:
ADVERTISING COOKIES
Advertising cookies are placed on your computer by advertisers and ad servers in order to display advertisements that are most likely to be of interest to you. These cookies allow advertisers and ad servers to gather information about your visits to the Site and other websites, alternate the ads sent to a specific computer, and track how often an ad has been viewed and by whom. These cookies are linked to a computer and do not gather any personal information about you.
ANALYTICS COOKIES
Analytics cookies monitor how users reached the Site, and how they interact with and move around once on the Site. These cookies let us know what features on the Site are working the best and what features on the Site can be improved.
OUR COOKIES
Our cookies are “first-party cookies”, and can be either permanent or temporary. These are necessary cookies, without which the Site won’t work properly or be able to provide certain features and functionalities. Some of these may be manually disabled in your browser, but may affect the functionality of the Site.
PERSONALIZATION COOKIES
Personalization cookies are used to recognize repeat visitors to the Site. We use these cookies to record your browsing history, the pages you have visited, and your settings and preferences each time you visit the Site.
SECURITY COOKIES
Security cookies help identify and prevent security risks. We use these cookies to authenticate users and protect user data from unauthorized parties.
SITE MANAGEMENT COOKIES
Site management cookies are used to maintain your identity or session on the Site so that you are not logged off unexpectedly, and any information you enter is retained from page to page. These cookies cannot be turned off individually, but you can disable all cookies in your browser.
THIRD-PARTY COOKIES
Third-party cookies may be place on your computer when you visit the Site by companies that run certain services we offer. These cookies allow the third parties to gather and track certain information about you. These cookies can be manually disabled in your browser.
CONTROL OF COOKIES
Most browsers are set to accept cookies by default. However, you can remove or reject cookies in your browser’s settings. Please be aware that such action could affect the availability and functionality of the Site.
For more information on how to control cookies, check your device’s settings for how you can control or reject cookies.
In addition to this, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/delete the cookies. Listed below are the links to the support documents on how to manage and delete cookies from the major web browsers.
Chrome: https://support.google.com/accounts/answer/32050
Safari: https://support.apple.com/en-in/guide/safari/sfri11471/mac
Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US
Internet Explorer: https://support.microsoft.com/en-us/topic/how-to-delete-cookie-files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc
If you are using any other web browser, please visit your browser’s official support documents.
You also may opt-out of some third-party cookies through the Network Advertising Initiative’s Opt-Out Tool (see https://thenai.org/).
OTHER TRACKING TECHNOLOGIES
In addition to cookies, we may use web beacons, pixel tags, and other tracking technologies on the Site to help customize the Site and improve your experience. A “web beacon” or “pixel tag” is tiny object or image embedded in a web page or email. They are used to track the number of users who have visited particular pages and viewed emails, and acquire other statistical data. They collect only a limited set of data, such as a cookie number, time and date of page or email view, and a description of the page or email on which they reside. Web beacons and pixel tags cannot be declined. However, you can limit their use by controlling the cookies that interact with them.
PRIVACY POLICY
For more information about how we use information collected by cookies and other tracking technologies, please refer to our Privacy Policy posted on the Site. This Cookie Statement is part of and is incorporated into our Privacy Policy. By using the Site, you agree to be bound by this Cookie Statement and our Privacy Policy.
CONTACT US
If you have questions or comments about this Cookie Statement, please contact us at info@betweenx.com or privacy@betweenx.com.