1.1 “Adequate Country” is a country that has an adequacy decision from the European Commission.

1.2 The terms “Business”, “Business Purpose“, “Consumer”, “Controller”, “Data Subject”, “Holder”, “data intermediary”, “Personal Data”, “Personal Information”, “Personal Data Breach”, “Processing” (and “Process”), “Processor”, “Sale” (or “Sell”), “Service Provider”, “Sensitive Data”, “Share”, “Special Categories of Personal Data” and “Supervisory Authority” shall all have the same meanings as ascribed to them in the applicable Data Protection Laws.

1.3 Under this DPA: “Controller” shall also mean and refer to a “Business”; “Processor” shall also mean and refer to a “Service Provider”, a “Holder”, and a “data intermediary”; “Data Subject” shall also mean and refer to a “Consumer”; “Personal Data” shall also mean and refer to “Personal Information”; and “Sensitive Data” shall also mean and refer to “Special Categories of Personal Data” or "Highly Sensitive Data", as applicable. Each such term shall also include any equivalent or analogous term under applicable Data Protection Laws with substantially the same meaning or legal effect.

1.4 “Consent” means an End User’s informed and freely given consent, that meets the requirements stipulated under Article 7 of the GDPR or the IAB Policies.

1.5 “Data Protection Laws" means any and all applicable privacy and data protection laws and regulations including, where applicable, the EU Data Protection Laws, the UK Data Protection Laws, FADP, Israeli Data Protection Laws, Singapore Data Protection Laws, and the US Data Protection Laws, as may be amended or superseded from time to time.

1.6 Data Privacy Framework" or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce; as may be amended, superseded or replaced.

1.7 “DPF Principles” means the Principles and Supplemental Principles available at: https://www.dataprivacyframework.gov/program-articles/Participation-Requirements-Data-Privacy-Framework-(DPF)-Principles; as may be amended, superseded or replaced.

1.8 “EEA” means the European Economic Area.

1.9 “End User” means an individual visiting or browsing the Publisher Sites or any other digital property operated by the Publisher.

1.10 "EU Data Protection Laws" means the (i) EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”); (ii) Regulation 2018/1725; (iii) the EU e-Privacy Directive (Directive 2002/58/EC), as amended (e-Privacy Law); (iv) any national data protection laws made under, pursuant to, replacing or succeeding (i) and (ii); (v) any legislation replacing or updating any of the foregoing; and (vi) any judicial or administrative interpretation of any of the above, including any binding guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant supervisory authority.

1.11 “IAB Framework” means the IAB Tech Labs’ technical specification for the GDPR transparency & consent framework (“TCF”) and the Global Privacy Platform (“GPP”).

1.12 “IAB Policies” means the (i) IAB Europe TCF available at: https://iabeurope.eu/wp-content/uploads/2023/05/230509-TCF-Policies-TransparencyConsentFramework_Policies_version_TCF-v2.2.pdf; (ii) IAB Global Privacy platform including the Multi State Privacy Framework (“MSPA”) available at: https://www.iabprivacy.com/IAB%20First%20Amended%20and%20Restated%20Multi-State%20Privacy%20Agreement%20(MSPA).pdf

1.13 “IDs” means (i) a unique identifier stored on an End-User’s device; (ii) a unique identifier generated for a specific End User; (iii) an online identifier associated with a particular device; or (iv) a cookie ID, agent ID, IP address, URL or RTB tag, or any other online identifier identifying an End User or a specific device.

1.14 “Israeli Data Protection Laws” means, collectively, the: (i) Israeli Protection of Privacy Law, 5741-1981, the regulations promulgated pursuant thereto, including the Israeli Protection of Privacy Regulations (Data Security), 5777-2017 and the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001; (iii) any amendments or legislation replacing or updating any of the foregoing, and; (iv) any judicial or administrative interpretation of any of the above, including any binding guidance, guidelines, codes of practice, approved codes of conduct or certification mechanisms approved by the Israeli Privacy Protection Authority.

1.15 “Privacy Signals” means the End Users’ preference signals, indicating the End Users’ preference for Processing Personal Data, such as: requesting to opt-out from selling or sharing Personal Data, opt-out from Processing Personal Data for Targeted Advertising, including without limitation, flags or signals sent through a cookie banner, cookie manager, consent management platform or other technology (“CMP”) such as IAB Global Privacy Platform (“GPP”) or otherwise the CCPA “Do Not Sell Or Share My Personal Information” signals, Google restricted data Processing (“RDP”) signals, Global Consent Platform (“GCP”) signals, and any other opt-out from interest-based advertising signals such as the Digital Advertising Alliance (DAA) and the Network Advertising Initiative (NAI), as applicable.

1.16 “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, including, where applicable, any "data breach" as such term is defined under Singapore Personal Data Protection Laws (as defined below), and any equivalent or analogous term under applicable Data Protection Laws. For the avoidance of doubt, any Personal Data Breach of the other party’s Personal Data will comprise a Security Incident.

1.17 "Standard Contractual Clauses” or “SCCs” means: (i) the standard contractual clauses for the transfer of  Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission Decision 2021/914 of 4 June 2021, which may be found at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN and incorporated herein by reference (“EU SCC”); (ii) the UK “International Data Transfer Addendum to the European Commission Standard Contractual Clauses” available at: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf and incorporated herein by reference (“UK SCC”); or (iii) the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (“Swiss SCC”).

1.18 ”Swiss Data Protection Laws” or “FADP” shall mean the Swiss Federal Act on Data Protection of June 19, 1992, SR 235.1, and any other applicable data protection or privacy laws of the Swiss Confederation as amended, revised, consolidated, re-enacted, or replaced from time to time, and to the extent applicable to the Processing of Personal Data under the Agreement.

1.19 “Singapore Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time, including without limitation the Singapore Personal Data Protection Act 2012, as amended.

1.20 ”UK Data Protection Laws” shall mean the Data Protection Act 2018 (DPA 2018), as amended, and the GDPR, as incorporated into UK law as the UK GDPR, as amended ("UK GDPR"), and any other applicable UK data protection laws or regulatory Codes of Conduct or other guidance that may be issued from time to time.

1.21 "US Data Protection Laws" means any and all applicable federal and state privacy laws and regulations applicable to the Supplier’s Processing activities of Personal Data under this DPA, and any implementing regulations and amendments thereto, including without limitation the: (i) California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 – 1798.199) of 2018 including as modified by the California Privacy Rights Act as well as all regulations promulgated thereunder from time to time (‘CCPA’); (ii) the Colorado Privacy Act C.R.S.A. § 6-1-1301 et seq. (SB 21-190) (‘CPA’); (iii) the Connecticut Data Privacy Act, S.B. 6 (Connecticut 2022) (‘CTDPA’); (iv) the Florida Digital Bill of Rights S.B 262 (‘FDBR’); (v) the Montana Consumer Data Privacy Act 68th Legislature 2023, S.B. 0384 (‘MTCDPA’); (vi) the Oregon Consumer Data Privacy Act ORS 646A.570-646A.589 (‘OCDPA’); (vii) the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code Ann. § 541.001 et seq (‘TDPSA’); (viii) the Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq (‘UCPA’); and (ix) the Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. (SB 1392). All as amended or superseded from time to time and including any implementing regulations and amendments thereto.

2.1 Pursuant to this DPA and in the course of the engagement set forth therein, Kueez and Publisher will Process the Personal Data described in Annex I.

2.2 The parties acknowledge that, each party shall be considered as independent controller in connection of the processing of the and each party will Process the Processed Data solely for the limited and specified purposes set forth in Annex I under the US Privacy Laws Addendum (detailed in Annex III) and solely for the Processing of the Personal Data by Kueez for the Restricted Purposes (as defined in such Annex), Kueez shall be considered a Service Provider or Processor, as applicable; Otherwise under the CCPA, Kueez shall be a Third Party business, and each party shall be liable for Processing any Personal Data under its control in compliance with applicable Data Protection Laws.

2.3 Each prty shall be individually and separately responsible for complying, and shall be able to demonstrate compliance, with applicable Data Protection Laws. The purpose, subject matter, and duration of the Processing, the type of Personal Data, and categories of Data Subjects are described in Annex I attached hereto.

3.1 Each party shall notify the other party, in writing (unless prohibited by law):

3.1.1 Promptly upon becoming aware of a suspected or actual Security Incident that may affect the other party or the Processing of Personal Data provided to or made available by the other party (“Security Incident Notice”). A Security Incident Notice shall include, to the extent available: (i) a description of the nature of the Security Incident, including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) a description of the likely consequences of the Security Incident; and (iii) a description of the measures taken or proposed to be taken to address the Security Incident, including, where appropriate, measures to mitigate its possible adverse effects; and

3.1.2 Without undue delay upon becoming aware of a Data Subject request, Consumer user right request (“DSR Notice”) or otherwise and regulatory, authority or a complaint, investigation, inquiry, warrant, subpoena, or proceedings from or brought by any public, governmental, or judicial Kueez or authority that relates to the Personal Data Processed under this DPA (“SAR Notice”).

3.1.3 In the event of a Security Incident Notice, a DSR or SAR Notice, the parties undertake to cooperate in good faith to ensure compliance with applicable Data Protection Laws.

3.2 Each party represents and warrants that it shall not provide or transfer any children’s (as defined by applicable law) Personal Data to be Processed under this DPA.

3.3 Each party shall implement and maintain an information security program with appropriate technical and organizational measures. This program is to ensure a level of security that will be appropriate to the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing, which includes at a minimum: (i) security measures that shall be no less than those required under Data Protection Laws and the security measures set forth in Annex II; and (ii) where required by Data Protection Laws, the appointment of a Data Protection Officer to oversee the privacy program.

3.4 Each party shall provide reasonable cooperation and assistance to the other party in ensuring compliance with its obligation to carry out data protection impact assessments.

3.5 Each party shall ensure: (i) the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to Personal Data; (ii) that persons authorized to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; and (iii) that such persons comply with the requirements of this DPA in respect of Processing such Personal Data.

3.6 In addition, and if applicable based on the applicable jurisdiction, each party shall Process the Personal Data solely as provided through the Privacy Signals, including the IAB Policies and the IAB Framework, and similar industry frameworks or guidelines applicable to the Agreement.

3.7 IAB Specifications where applicable: Publisher acknowledges and agrees that the End User does not have a direct relationship with Kueez, however, certain features of Kueez Services are dependent and based upon End User’s consent or any other demonstrated lawful bases, that shall be obtained by Publisher and which Kueez relies on, amongst others, in its capacity as an Kueez under the IAB Framework. The Publisher also acknowledges that it shall be able to demonstrate such consent at any time and represents that such consent exists. Kueez shall transfer the Privacy Signal "as is" to the applicable demand partner, as it was provided by the Publisher. The Publisher acknowledges and agrees that such Privacy Signal is directly transmitted to the demand partner “as is”, and such demand partner will respond following the Privacy Signal instructions. Kueez, as the technical provider, has no actual control over such demand partner and shall not be responsible or liable for the demand partner’s actions based on the Privacy Signal or any misuse by the applicable demand partner. Kueez is not and will not be liable for any act or omission, misuse or damages, caused by the demand partner, however will contractually require the demand partner to comply with terms similar to the terms of this DPA and the Privacy Signals.

3.8 The Publisher shall: (i) provide End Users with applicable privacy documentations and disclosures, including without limitation, a compliant privacy policy that complies with applicable Data Protection Laws; (ii) understand how the TCF operates and acknowledge that Kueez exclusively operates within the IAB Framework and applicable TCF requirements; (iii) use a CMP approved by the IAB, including support for the disclosed as part of the disclosed vendors segment in accordance with TCF v2.3 indicating whether a vendor was disclosed to the End User in the CMP; (iv) document any needed consents and opt-outs, as required under applicable Data Protection Laws and the TCF; (v) ensure that End Users can re-access the CMP and easily manage their privacy choices and preferences; (vi) display Kueez as a vendor within the TCF where Kueez may Process Personal Data for the applicable TCF purposes, and display any other relevant vendors engaged in connection with the advertising services, as applicable; (vii) send the corresponding Privacy Signals, where applicable; (viii) ensure that the appropriate TCF purposes, features, and signals are selected and transmitted to enable Kueez Services; (ix) where the Publisher collects precise geolocation from its End Users, it shall transfer and share the precise geolocation solely subject to collecting consent from the applicable data subject; and (x) to the extent the Publisher triggers Kueez's pixels or any similar tracking URL technologies on its digital properties, ensure that such technologies are triggered only after obtaining any valid consent required under applicable Data Protection Laws for storing information, or gaining access to information already stored, on an End User's device.

4.1 The parties will not transfer, directly, or through onward transfers, any Personal Data, to any recipient located in a territory not recognized as providing an adequate level of protection for such Personal Data (within the meaning of the applicable Data Protection Laws), specifically that is not recognized as an Adequate Country, or to a recipient that is not certified under the DPF.

4.2 Without derogating from the generality of the above, Kueez will not transfer, directly or through onward transfers, the Personal Data to any recipient located in a territory other than the EEA, UK, or an Adequate Country, or to a recipient that is not certified under the DPF (“Restricted Transfer”), unless it first takes all such measures as are necessary to ensure the transfer complies with applicable Data Protection Laws. Such measures may include the following: (i) transferring such Personal Data to a recipient that is certified by a suitable framework or other legally adequate transfer mechanism recognized by the relevant Supervisory Authorities in the EEA or UK as providing an adequate level of protection for Personal Data; (ii) transferring such Personal Data to a recipient that has achieved binding corporate rules authorization in accordance with applicable Data Protection Laws; or (iii) transferring such Personal Data to a recipient that has executed the Standard Contractual Clauses with the other Party or with any Sub-Processor acting on its behalf.

4.3 For the avoidance of doubt, the Publisher acknowledges and agrees that Kueez is established in a country which is subject to adequacy decision, accordingly, any transfer of Personal Data by the Publisher to Kueez shall not, to the extent such transfer is subject to applicable Data Protection Laws, be treated as a Restricted Transfer and shall be in compliance with applicable Data Protection Laws.

In the event of a conflict between the terms and conditions of this DPA and the Agreement, this DPA shall prevail. For the avoidance of doubt, if the Standard Contractual Clauses have been executed between the parties, the terms of the Standard Contractual Clauses shall prevail over those of this DPA solely with regard to the international transfer of Personal Data. Except as set forth herein, all of the terms and conditions of the Agreement shall remain in full force and effect.

This DPA shall be effective as of the Effective Date and shall remain in force until the Agreement terminates.

1. Conduct security testing or penetration testing, remediate any identified high vulnerabilities, provide written remediation plans for medium and low vulnerabilities;

2. Maintain a level of security appropriate to protect against any unauthorized or unlawful Processing or accidental loss, destruction, damage, denial of service, alteration or disclosure, and appropriate to the nature of Personal Data;

3. Oblige its employees, agents, or other persons to whom it provides access to Personal Data to keep it confidential; take reasonable steps to ensure the integrity of any employees who have access to Personal Data; provide annual training to staff and subcontractors on the security requirements contained herein;

4. Adhere password policies for standard and privileged accounts consistent with industry best practices;

5. Ensure that only those personnel who need to have access to Personal Data are granted access, such access is limited to the least amount required, and only granted for the purposes of performing the Services and the obligations under this DPA;

6. Maintain a physical security program that is consistent with the corresponding industry practices;

7. Ensure that any storage media (whether magnetic, optical, non-volatile solid state, paper, or otherwise capable of retaining information) that captures Personal Data, if applicable, is securely erased or destroyed before repurposing or disposal;

1. This US Privacy Law Addendum (“US Addendum”) adds specifications applicable to US Data Protection Laws and is in addition to the obligations set forth in the DPA. All terms used but not defined in this US Addendum shall have the meaning set forth in the DPA.

2. Notwithstanding the above, in the event the parties are members of the MSPA, the MSPA shall prevail.

3. ROLES:

3.1 Parties shall act as separate independent Controllers, except when the Processing is for the Restricted Purposes (as defined below), in which Company may be deemed a Processor. Specifically, under the CCPA, the Company shall be a Third Party except when Processing Personal Information for the Restricted Purposes, in which it shall be defined as a Service Provider.

3.2 For the purpose of this US Addendum the “Restricted Purposes” means advertising-related Processing that qualifies as a Business Purpose, including (i) auditing, security and integrity purposes, debugging, short term, transient uses, and internal research or improvement of the Services; (ii) technical advertising services that are not targeted, cross-contextual or profiling and include frequency capping, measurement, fraud detection and prevention, and ensuring and measuring viewability; and (iii) contextual advertising which includes first-party advertising to the extent such activity does not result in a Sale or Share of Personal Data or constitute Processing of Personal Data for Targeted Advertising purposes.

3.3 The subject matter, duration, nature, and purpose of the Processing, types of Personal Information Processed, and categories of Data Subjects are as described in Annex I.

4. CONTROLLER TO CONTROLLER:

4.1 Be individually and separately responsible for complying with applicable US Data Protection Laws, and to the extent applicable to the IAB Policies.

4.2 Provide End Users with clear and conspicuous disclosures and notices on how the Personal Information is Processed, the purpose of Processing, the categories of Personal Information shared and the categories of the recipients, as well as the End Users’ rights, including the right to appeal and the ability to opt out of the Sale, Share of Personal Information or from Targeted Advertising, all in compliance with and as required by the US Data Protection Laws.

4.3 Ensure that it provides an opt-out mechanism and it enables the End User to send a Privacy Signal and transfer the Privacy Signal down the advertising chain. When a Privacy Signal is received, neither party will Process such End Users’ Personal Information for Targeted Advertising, or Cross Contextual Advertising purposes.

4.4 Comply with requirements for Processing Deidentified Information, including by not attempting to re-identify it, using reasonable, technical, and organizational measures to prevent re-identifying it, and publicly committing to such actions.

5. CONTROLLER TO PROCESSOR

5.1 Representation and Undertaking: a party shall Process the End User Personal Information only on behalf of and under the instructions of the other party and in accordance with US Data Protection Laws and shall not: (i) Sell or Share the Personal Information; (ii) retain, use or disclose the Personal Information for any purpose other than for a Business Purpose or Restricted Purposes as specified in the Agreement; (iii) combine the End User Personal Information with other Personal Information that it receives from, or on behalf of, another partner, or collects from its own; or (iv) if and to the extent applicable limit the use of its Sensitive Personal Information (“SPI”).

5.2 Sub-Processors or Sub-contractors: The Controller party provides a general authorization to engage Sub-Processors to the extent the Processor party undertakes it will restrict the onward sub-Processor’s access only to what is strictly necessary, and will prohibit the sub-processor from Processing the Personal Information for any other purpose other than for a Business Purpose or Restricted Purposes as specified in the Agreement. The Processor party shall impose contractual obligations as required by US Data Protection Laws on such sub-processors.

1.1. Audit: A Controller party has the right to ensure the Processor party complies with US Data Protection Laws. For this purpose, the Processor party, upon receiving a reasonable written request from the Controller party, will make available to the Controller party information necessary to demonstrate compliance with this DPA and US Data Protection Laws. To the extent required by applicable US Data Protection Laws, and upon receiving prior written notice, the Processor party will allow audits, including inspections, by the Controller party (or an auditor on its behalf). Any such audit must be tailored to what is reasonably necessary to verify compliance with this DPA, and must occur during normal business hours, and not more than once per calendar year. The results of the audit will be the confidential information of the Processor party. Notwithstanding the above, under US Data Protection Laws and subject to the Publisher’s consent, the Processor party may alternately, in response to the Controller party's on-premise audit request to initiate an independent auditing on its own, to verify its compliance with its obligations under US Data Protection Laws and provide the Publisher with the results. In any case, the expenses of the audit shall be paid by the Controller party. The Processor party may refuse audit or access to certain information if it determines it may harm other partners or customers, or it may cause a security breach, or it is not related or necessary for the purpose of demonstrating compliance with US Data Protection Laws.

5.3 Certification: The Processor party certifies that it understands the rules, requirements, and definitions of the CCPA and agrees to refrain from Selling or Sharing Personal Information. The Processor party acknowledges and confirms that it does not receive any monetary goods, payments, or discounts in exchange for processing the Personal Information for a Business Purpose or Restricted Purposes as specified in the Agreement.