Advertising Partner Data Protection Agreement

Advertising Partner Data Protection Agreement

Axis Corp LTD — Public Partner Terms

1. Application and acceptance

1.1 This Data Protection Agreement (DPA) governs Personal Data exchanged between Axis Corp LTD, a company registered in the United Kingdom at Suite 7057, 128 Aldersgate Street, Barbican, London, England, EC1A 4AE (Axis), and the advertising partner (Partner) identified in the Parties’ commercial agreement relating to their advertising cooperation and services (Advertising Agreement). Each is a Party.

1.2 This DPA forms part of the Parties’ advertising services agreement, insertion order or other binding agreement between the Parties (Advertising Agreement).

1.3 The incorporated version is the version made available to Partner via public presentation. Later website changes do not amend an existing agreement without the Parties’ written or electronically recorded agreement, except changes taking effect under the mandatory terms of an incorporated transfer instrument.

1.4 The Parties’ binding order or integration record (Integration Record) identifies their legal entities, contacts, functions, authorised data flows, processing, and any optional activities. An Integration Record may consist of an order, Advertising Agreement, signed schedule or approval expressly recorded by authorised representatives through email or the onboarding platform. It cannot expand the permissions in this DPA or override its prohibitions. 

1.5 This DPA concerns exchanges between independent Controllers.

2. Definitions

2.1 Data Protection Laws means privacy, electronic communications, data security and breach-notification laws governing the relevant activity, including UK and EU data protection laws and US Privacy Laws, as amended and as their provisions take effect. UK GDPR means the GDPR as incorporated into UK law; EU GDPR means Regulation (EU) 2016/679.

2.2 Controller, Processor, Personal Data, Processing, Data Subject, Personal Data Breach and Supervisory Authority have their meanings under the relevant Data Protection Laws, including corresponding US concepts where relevant.

2.3 Advertising Services means the supply-side, exchange, demand-side, auction, delivery and related services authorised by the Advertising Agreement. Shared Data means Personal Data disclosed or made accessible between the Parties through those services. Disclosing Party and Receiving Party describe each Party’s role for a particular disclosure; those roles may alternate.

2.4 Permitted Purposes means the specific purposes in Annex I authorised for the integration. Privacy Signals means communicated consent, purpose and vendor permissions, restrictions, withdrawals, opt-outs, age flags and similar preferences, including signals under the IAB Europe Transparency & Consent Framework (TCF) and universal opt-out mechanisms that the relevant US law requires a Party to recognise, including Global Privacy Control.

2.5 US Privacy Laws means US federal and state privacy, security, breach-notification and consumer-protection laws covering the relevant Processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA), comprehensive state consumer privacy laws, sensitive-data laws and the Children’s Online Privacy Protection Act and its Rule (COPPA). Coverage depends on territorial scope, thresholds, exemptions and effective dates.

2.6 Sale, Sharing, Targeted Advertising, Sensitive Data, Business, Third Party, Service Provider and Contractor have their relevant US statutory meanings. Actual Processing, rather than its contractual label, determines whether a disclosure is a Sale or Sharing.

2.7 Restricted Transfer means a transfer, including qualifying remote access, requiring a mechanism under Chapter V of the UK GDPR or EU GDPR. EU SCCs means the clauses annexed to Commission Implementing Decision (EU) 2021/914. UK Addendum means the ICO’s International Data Transfer Addendum, version B1.0 effective 21 March 2022, including its mandatory clauses and replacements under them, available through the ICO’s international transfer guidance.

3. Roles and responsibilities

3.1 Each Party independently determines its purposes and essential means of Processing within the Permitted Purposes. Each is responsible for its legal bases, notices, recipients, rights responses, retention, security, records, assessments and regulatory notifications.

3.2 For US Processing, each Party acts as a Controller or Business where the statutory definition applies and as an independent Third Party when receiving data in that capacity. These labels do not override the Parties’ actual activities or legal responsibilities.

3.3 Each Party will Process only necessary Shared Data for the Permitted Purposes, maintain appropriate Processing and recipient records, and treat pseudonymous identifiers as Personal Data. Neither Party may rely solely on the other Party’s compliance to discharge its own duties.

4. Collection, permissions and use restrictions

4.1 The Party controlling collection from a website, app or device will provide required notices and obtain required permissions. A Party sourcing data indirectly will require its sources to do so contractually, take proportionate verification steps and retain available compliance evidence.

4.2 Each Party will establish a lawful basis for each purpose, honour Privacy Signals and obtain consent where required. Non-essential device storage or access, consent-dependent profiling, identifier synchronisation and personalised advertising must not occur without the necessary consent. TCF users must enforce relevant vendor and purpose restrictions and special-feature opt-ins.

4.3 Shared Data must not be used for unrelated data brokerage, unauthorised identifier enrichment, general-purpose model training, circumvention of privacy choices or other unapproved purposes. Combining datasets is allowed only where necessary for an authorised purpose and covered by the relevant notices, permissions and restrictions. A new purpose requires prior written agreement and any required additional legal basis, notices and consent.

4.4 Identifier matching, profile creation or use, cross-context enrichment and precise location are disabled unless expressly activated in the Integration Record with their specific purposes, data, recipients and permission controls. Precise location additionally requires separate opt-in. 

4.5 Neither Party will intentionally include names, personal email addresses or telephone numbers in bidstreams; disclose special-category or criminal-offence data; use consumer-health or biometric data; or use Shared Data for decisions producing legal or similarly significant effects.

4.6 Neither Party will knowingly disclose or use data of persons under 18 for Sale, Sharing, Targeted Advertising or personalised advertising. Child-directed inventory and COPPA-covered data are excluded. Each Party will enforce relevant age and inventory restrictions.

4.7 Each Party will filter URLs, event fields and audience labels to remove unnecessary identifying or sensitive content. On discovering prohibited data or a child-related signal, it will suppress affected activity, isolate the data, notify the other Party and securely delete or lawfully return it, retaining only necessary compliance evidence.

4.8 Each Party will take reasonable steps to maintain data accuracy for its purposes, communicate material inaccuracies promptly, correct, restrict or delete affected data and notify recipients where required.

5. US privacy requirements

5.1 Each Party will assess and record whether each flow involves Sale, Sharing, Targeted Advertising or covered profiling and implement required notices, choices and restrictions before disclosure or use.

5.2 Collection, use, disclosure and retention must be reasonably necessary and proportionate to specified, disclosed purposes. Each Party will observe purpose-compatibility rules and obtain consent where required for secondary uses.

5.3 Each Party will honour required opt-outs and recognised universal opt-out signals within statutory deadlines, including their required application to known accounts or profiles. Restrictions must pass through the integration without undue delay. Once effective, an opt-out stops the prohibited activity and associated onward disclosure. Retained data may be used only for another lawful, disclosed Permitted Purpose or statutory exception.

5.4 Neither Party will unlawfully discriminate, retaliate, use deceptive interfaces or require unnecessary account creation or identity verification for opt-outs.

5.5 Sensitive Data may be Processed only if its category and specific use are expressly activated in the Integration Record, are not prohibited by this DPA, and have the necessary consent, limitation rights and safeguards. Each Party will honour California limitation rights where triggered and assess precise location and sensitive inferences under the relevant state definitions, including visits to sensitive places.

5.6 Whenever California Personal Data is sold or shared with a Receiving Party as a Third Party:

(a) disclosure is solely for the limited, specified purposes expressly identified in the Integration Record from Annex I;

(b) the Receiving Party will meet its CCPA obligations, provide the same level of privacy protection required of Businesses by the CCPA, and honour communicated restrictions and choices;

(c) the Disclosing Party may take reasonable and appropriate compliance steps, including documentation requests, technical checks and reviews or audits under clause 11;

(d) the Receiving Party will notify the Disclosing Party without undue delay, and within three business days after determining it cannot meet its CCPA obligations, describing affected Processing and protective action;

(e) the Disclosing Party may require reasonable steps to stop and remedy unauthorised use, including cessation, restriction, lawful deletion, corrective evidence and suspension; the Receiving Party will cooperate promptly; and

(f) further Sale or Sharing requires compliant notices, choices and onward contracts and compliance with this DPA. This clause does not permit Service Provider or Contractor treatment for independent-controller reuse.

6. Transparency and individual rights

6.1 Each Party will maintain an accurate, accessible privacy policy covering its identity and contacts, data categories and sources, purposes, legal bases and legitimate interests, device technologies, profiling, recipients, retention, transfers and individual rights, including complaints and consent withdrawal, regarding its advertising activities. For US Processing, it will provide or arrange required notices and disclosures addressing actual Sale, Sharing, Targeted Advertising and Sensitive Data practices, retention and request methods.

6.2 Each Party will provide accessible request channels, verify identity only as permitted and necessary, and respond to requests concerning its Processing within statutory deadlines. Individuals need not exercise rights exclusively through the other Party.

6.3 Where a request concerns the other Party, the recipient will promptly provide that Party’s contact details or lawfully forward it securely. The Parties will reasonably assist each other with access, portability, correction, deletion, restriction, objection, withdrawal, US opt-outs, Sensitive Data limitations and appeals where required, in time to meet statutory deadlines.

6.4 Each Party will stop direct marketing and related profiling on objection, assess other objections under the governing legal requirements, implement withdrawals and restrictions without undue delay and before further consent-dependent use, and communicate required actions to affected recipients and Processors, including the other Party.

7. Recipients, Processors and personnel

7.1 Onward disclosure is limited to necessary recipients within Annex I’s types and authorised purposes, consistent with Privacy Signals, notices and clause 12. Each Party will conduct proportionate diligence and bind independent-controller recipients to appropriate purpose, security, retention, rights and transfer restrictions. Auction participation or a bid endpoint does not authorise unrestricted broadcasting.

7.2 Each Party may engage Processors without the other’s approval but cannot thereby expand authorised purposes, recipient types or locations. Before access, it will conduct proportionate diligence and enter into mandatory controller-to-processor terms covering instructions, confidentiality, security, further processors, assistance, incidents, audits and return or deletion. It will monitor compliance and ensure transfer safeguards.

7.3 Each Party remains responsible for its own disclosures, appointment and oversight duties and its Processors’ acts to the extent required by Data Protection Laws. Independent-controller publishers, advertisers, SSPs, DSPs and exchanges are not Processors merely because they receive data.

7.4 Access is restricted to authorised personnel with a need to know and continuing confidentiality duties. Each Party will provide induction and periodic training, proportionate lawful screening, individual accounts, least privilege and regular access reviews, and promptly revoke unnecessary access.

8. Security and incidents

8.1 Each Party will maintain Annex II’s measures for Shared Data within its control, with security appropriate to the risks, state of the art, costs and nature, scope, context and purposes of Processing. Controls must address confidentiality, integrity, availability, resilience, timely restoration and regular testing and be reviewed annually and after material changes or significant incidents.

8.2 Each Party will notify the other without undue delay and within 24 hours of awareness of a Personal Data Breach affecting exchanged Shared Data or materially compromising the integration. This includes incidents requiring notice under US breach laws even if outside the UK or EU breach definition. Notice must not await completion of an investigation or a regulatory-notification decision.

8.3 Notice will include available details of timing, nature, systems, affected categories and approximate numbers of people and records, likely consequences, containment, remediation and a response contact. Information may follow in phases, with material updates at least every 48 hours during active response unless agreed otherwise.

8.4 The affected Party will contain, investigate and remedy the breach, preserve evidence and provide a root-cause and corrective-action report promptly after investigation. Each Party will assist the other’s impact assessment and notification duties, including identifying affected US states, individuals and information categories.

8.5 Each Party independently makes required notifications, assessing relevant triggers, encryption exceptions, deadlines, content and recipients. Neither may notify on the other’s behalf or publicly identify it without written authorisation unless legally required, consulting first where lawful. Coordination must not delay statutory deadlines, including the UK/EU 72-hour supervisory notification period where triggered.

8.6 Incident notices to Axis must be sent to dpo@axis-marketplace.com and to Partner’s recorded incident contact. Notice is not an admission of liability.

9. Retention and deletion

9.1 Each Party will retain Shared Data only for recorded purposes and justified periods within the dataset-specific maximums in the Integration Record. Legal retention must be documented and limited to necessary records.

9.2 When a purpose or period expires, or earlier where a valid rights request or withdrawal requires, each Party will delete or genuinely anonymise affected data across active systems, caches, exports and Processors. Pseudonymisation is not deletion or anonymisation. Backups must expire within the agreed cycle, remain isolated from ordinary use and have deletions reapplied if restored. New events must not restart retention for old data.

9.3 Termination stops new exchanges and ordinary use for future transactions. Independently controlled records may remain only as necessary for an unexpired Permitted Purpose, legal obligation, rights suppression or legal claims, on a valid legal basis. Records retained solely for legal reasons must be minimised, segregated and restricted to that reason, not advertising reuse.

9.4 On reasonable request, a Party will confirm relevant deletion or explain continued retention categories, grounds and periods. Neither Party may require unlawful deletion or use retention to justify unrelated commercial reuse.

10. Impact assessments

Each Party will assess whether planned Processing requires a data protection impact assessment and complete required assessments and prior consultation before high-risk Processing begins. The Parties will reasonably assist each other with relevant data-flow, recipient, technology, retention, security and transfer information.

11. Assurance and cooperation

11.1 Each Party will provide reasonable compliance evidence, initially through policies, questionnaires and available independent assurance. An unresolved, documented material concern permits a proportionate audit of affected Processing by an independent, non-competing auditor under confidentiality.

11.2 Audits ordinarily require 30 business days’ notice, occur during business hours, and occur no more than annually. Shorter notice or additional audits are permitted where reasonably needed for a material incident, suspected unlawful use, or regulatory requirement. Audits must protect other customers’ data and confidential information and avoid unnecessary disruption without preventing effective verification. Each Party bears its internal costs; the requester pays external auditor fees.

11.3 Each Party will cooperate with competent authorities and, unless prohibited, notify the other of enquiries or binding demands materially affecting the arrangement. It will verify disclosure authority, minimise disclosure and challenge disproportionate demands where reasonable grounds exist.

12. International transfers

12.1 Restricted Transfers require a valid mechanism covering the actual transfer and recipient. Each Party will record storage and remote-access countries, assess transfer risks, implement necessary supplementary measures and suspend transfers where effective safeguards cannot be maintained. Changes to recorded countries require prior written agreement and completion of the necessary safeguards.

12.2 Where contractual safeguards are required and legally available, the Parties incorporate EU SCC Module One (Controller to Controller) and, for UK transfers, the UK Addendum, unaltered except for permitted selections and appendix completion. Either Party may be exporter or importer for a particular flow.

12.3 For the EU SCCs, Clause 7 applies; optional Clause 11 language does not. Clause 17 uses Option 1 and the law of Ireland; Clause 18 selects the courts of Ireland. The competent authority is determined under SCC Clause 13 by the exporter’s relevant establishment, representative or affected Data Subjects and must be identified in the Integration Record before transfer.

12.4 The Advertising Agreement, acceptance record, Integration Record and Annex I supply EU SCC Annex I’s identities, contacts, Controller roles, signatures or legally effective electronic execution, transfer descriptions and competent authority. Annex II supplies EU SCC Annex II. No transfer relying on these instruments may begin until the required particulars and execution formalities are complete.

12.5 For the UK Addendum: Table 1 comprises the Parties’ identities, contacts, flow roles and execution details recorded under clause 12.4; Table 2 comprises Module One and clause 12.3’s selections; Table 3 incorporates Annexes I and II and the relevant Integration Record particulars; and Table 4 permits both importer and exporter to end the Addendum as its mandatory clauses allow. Part 2 applies in full.

12.6 Acceptance of this DPA through a signed or legally effective electronic record also executes the incorporated instruments for the covered transfers where that method satisfies their execution requirements. Where it does not, the Parties will separately execute them before transfer. Public posting alone does not execute a transfer instrument.

12.7 The EU SCCs and UK Addendum prevail over conflicting terms. Neither this DPA nor the Advertising Agreement limits their mandatory liability, third-party rights or remedies.

13. General terms

13.1 Term and precedence. This DPA continues while either Party Processes Shared Data and, subject to clause 12.7, prevails over conflicting data-protection terms in the Advertising Agreement. The Integration Record may specify operational particulars but not reduce these protections.

13.2 Suspension and termination. A Party may immediately suspend an affected flow where reasonably necessary to address unlawful Processing, invalid permissions, security threats or failed transfer safeguards. It will promptly notify the other, limit suspension to what is necessary and cooperate in restoration. Either Party may terminate affected services for material breach unremedied 30 days after written notice, or immediately if the breach cannot lawfully be remedied or continued performance would be unlawful. Neither action permits unlawful retention or reuse.

13.3 Costs and liability. Each Party bears ordinary compliance and cooperation costs. Advertising Agreement liability terms apply only consistently with non-excludable duties, individual remedies and transfer instruments. Each Party remains responsible for its own infringements. A Party compensating damage for which both are responsible may recover the share corresponding to the other’s responsibility without limiting individual rights.

13.4 Notices. Notices go to Axis at dpo@axis-marketplace.com and to Partner’s privacy or legal contact to be communicated by Partner to Axis in writing. Email notices are received on delivery without a failure message; non-incident notices arriving outside the recipient’s business hours are received on its next business day. Contact changes may be notified in writing without formal amendment. This does not extend incident or statutory deadlines.

13.5 Confidentiality. Non-public information obtained under this DPA may be used only for the relationship, compliance or enforcement and must receive reasonable protection. This excludes information independently developed, already lawfully known, lawfully received without restriction or public without breach. Compelled disclosure must be limited to what is required, with advance notice where lawful. Protection lasts five years after termination and, for Personal Data and trade secrets, while they retain that character.

13.6 Amendments and severability. Amendments require written or legally effective electronic agreement by authorised representatives, subject to clause 1.3. Invalid terms will be limited or severed only as necessary. Non-enforcement is not waiver.

13.7 Law and disputes. Except for mandatory transfer-instrument requirements, this DPA is governed by the laws of England and Wales, with exclusive jurisdiction in the courts of England and Wales. Privacy contacts will seek prompt resolution without delaying urgent relief or regulatory cooperation.

13.8 Survival and third parties. Confidentiality, retained-data protection, deletion, relevant audits, transfers, liability and dispute provisions survive as needed. No third party has contractual enforcement rights except under transfer instruments or mandatory Data Protection Laws.

Annex I — Processing and transfer details

A. Parties and integration

Axis: Axis Corp LTD, Suite 7057, 128 Aldersgate Street, Barbican, London, England, EC1A 4AE; Controller; advertising exchange and DSP, with SSP functionality where agreed. Privacy and incident contact: dpo@axis-marketplace.com. Privacy policy: https://axis-marketplace.com/legal/privacy-policy. TCF Vendor ID: 1197.

Partner: the legal entity identified in the Advertising Agreement; Controller; SSP, DSP, exchange or other agreed combination as expressly recorded in the Integration Record. Its registered address, privacy and incident contacts, privacy policy and TCF Vendor ID, if used, must be communicated by Partner to Axis in writing before exchange.

Each Party is responsible for its directly contracted sources and recipients. The Integration Record identifies each direction of disclosure, functions, specific purposes and datasets, authorised optional activities, countries, retention limits and relevant transfer particulars.

B. Purposes and boundaries

C. Operations, individuals and duration

Operations: receipt, validation, real-time evaluation and routing, auctions, bid submission, permitted delivery, limited recording, measurement, consultation, authorised disclosure, restriction and deletion. Optional matching and profiling require express activation.

Frequency: continuous or repeated event-driven disclosures. 

Individuals: website and app end users whose advertising opportunities or interactions are processed. 

Duration: the Advertising Agreement term and limited retention under clause 9 and the Integration Record.

D. Data categories

E. Recipients

Approved types are publishers, advertisers, SSPs, DSPs and exchanges necessary for authorised transactions; measurement and fraud-prevention providers necessary for authorised purposes; and hosting, infrastructure and other Processors supporting those purposes. Each disclosure remains subject to clauses 4, 5, 7 and 12. These types do not authorise new purposes. Disclosure to authorities is permitted where legally required.

Annex II — Minimum technical and organisational measures

These requirements bind each Party for Shared Data within its responsibility.

1. Governance. Maintain documented privacy and security policies, assigned responsibility, assets, data flows, Processing records and risk assessments. Review risks annually and before material changes, track remediation and maintain management oversight.

2. Access. Use unique accounts, role-based access and least privilege; review access quarterly and promptly revoke unnecessary access. Require multifactor authentication for privileged access, remote administration and Personal Data systems where supported, documenting effective compensating controls for exceptions. Control and attribute emergency access.

3. Encryption. Encrypt transit over public or untrusted networks using current, securely configured TLS or equivalent. Strongly encrypt stored data, backups and portable devices where technically feasible; document and mitigate exceptions. Restrict and appropriately separate keys and secrets, rotate on compromise and exclude secrets from public code and logs.

4. Infrastructure. Segment networks and production, restrict administrative interfaces, harden configurations and maintain appropriate host and network protection. Use proportionate physical and environmental hosting controls; inventory systems and promptly address unsupported or exposed components.

5. Development and vulnerabilities. Restrict source access, review changes and test releases with rollback. Prefer synthetic or anonymous test data; production data requires necessity, authorisation and equivalent protection. Scan regularly and after significant changes, immediately contain actively exploited critical exposures and prioritise remediation by risk. Assess the need for annual independent penetration testing of material external components and testing after major architectural changes, documenting decisions and completing testing where warranted.

6. Monitoring and incidents. Log relevant authentication, privileged access, security events and material configuration changes; protect integrity and synchronise time. Maintain and annually exercise an incident plan covering detection, escalation, containment, evidence, investigation, notifications and recovery.

7. Resilience. Maintain risk-appropriate redundancy, capacity and recovery controls. Encrypt and restrict backups, isolate them from ordinary production compromise and test restoration annually.

8. Minimisation and separation. Limit fields to authorised purposes, remove unnecessary identifying and sensitive content, minimise URL detail and location precision and use pseudonymisation, aggregation or truncation where suitable. Prevent unauthorised cross-customer access and separate security records, advertising profiles and ordinary measurement. Pseudonymous data remains protected.

9. Bidstream controls. Validate permissions, restrictions and special-feature signals before dependent Processing; absent valid permission, do not perform that Processing. Enforce inventory restrictions and authorised routing, bidding and synchronisation. Authenticate endpoints or use equivalent controls, validate payloads and guard against extraction and replay. Do not broadcast raw data to unapproved endpoints. Propagate withdrawals and restrictions promptly.

10. US signals. Implement and test recognised opt-out and GPP or equivalent mappings. Suppress prohibited Sale, Sharing and Targeted Advertising before routing or reuse; preserve choices across known profiles where required. Stale or default signals must not override binding choices. Keep minimised enforcement evidence, block prohibited minor-related and Sensitive Data activity, test downstream propagation and promptly remedy signal loss.

11. Retention and rights. Enforce purpose-specific lifecycles and verify deletion across relevant active storage, caches, exports, media and suppliers. Apply clause 9’s backup requirements. Provide identifier-based rights tools without creating unnecessary identity datasets; separate compliance evidence from advertising histories. US workflows must distinguish verified requests from opt-outs, support agents and appeals where required, track state deadlines and downstream notices, and not require account creation for opt-outs.

12. Personnel and remote work. Require confidentiality, induction and annual security awareness training, managed-device protection, screen locks and secure remote connections. Restrict local downloads and removable media and prohibit access from public or shared devices. Limit remote access to recorded countries with required transfer safeguards.

13. Vendors and transfers. Assess vendors before engagement and periodically, impose written protections and verify hosting and access countries. Document transfer assessments and effective supplementary measures. Verify and minimise government disclosures, reasonably challenge disproportionate demands and suspend inadequately protected transfers.

14. Assurance. Keep proportionate evidence of policies, access reviews, training, testing, incidents, supplier oversight and remediation, minimising Personal Data, and provide relevant evidence under clause 11.