Privacy policy

Data Protection Addendum (“DPA”) – Independent Controllers

This DPA is entered into on the Effective Date of the Insertion Order (Effective Date) between Rakuten TV Media S.A.S and the Company. Hereinafter also referred to as “Controller A” and “Controller B”.

All capitalized terms will have the meanings set forth in the Insertion Order. In the event of any conflict between the terms of the Insertion Order and this DPA, the provisions of the Insertion Order shall prevail, unless expressly stated otherwise herein.

Art. 1         Definitions

For the Purposes of this Addendum:

• “Personal Data“, “Special Categories of Data“/“Sensitive Data”, “Process/Processing“, “Controller“, “Processor“, “Data Subject“, “Personal Data Breach” and “Supervisory Authority” shall have the same meanings given to them in the GDPR.
• “C-to-C Transfer Clauses” means the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 1: Transfer Controller to Controller.
• “Data Protection Law(s)” means privacy or data protection laws that apply to Personal Data processed by the Parties, including, but not limited to, the GDPR, or any successor(s) to any of those, as well as any other applicable data protection law.
• “GDPR” means Regulation (EU) 2016/679 of the European Parliament and the Council (General Data Protection Regulation) and the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK GDPR”).
• “Standard Contractual Clauses” means: (i) where the GDPR or Swiss DPA applies, the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCCs“); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR (“UK SCCs“).
• “Data Exporter” means the Party that, acting as an independent data controller within the meaning of Regulation (EU) 2016/679, discloses, transfers, or otherwise makes available Personal Data to the other Party under this Agreement, including where such transfer constitutes a restricted transfer pursuant to applicable Data Protection Laws.
• “Data Importer” means the Party that, acting as an independent data controller within the meaning of Regulation (EU) 2016/679, receives or otherwise obtains Personal Data from the Data Exporter under this Agreement, including where such receipt constitutes a restricted transfer pursuant to applicable Data Protection Laws.

Art. 2     Role of the Parties

In order to provide the services under the Insertion Order, Controller A discloses data, including Personal Data to Controller B for the purposes described in the Insertion Order (the “Permitted Purposes”). Controller A is an independent Controller of the Personal Data it discloses to Controller B. Pursuant to the Insertion Order, Controller B Processes the Personal Data as a separate and independent Controller for the Permitted Purposes. In no event will the Parties process the Personal Data as joint Controllers. The details of the Processing Activities are specified in Appendix A to this DPA.

Art. 3         Obligations – Representations & Warranties

• (a) Each Party shall use Personal Data in accordance with applicable Data Protection Laws, will not cause the other Party to breach its obligations under Data Protection Laws and will individually and separately fulfill all obligations that apply to it as a Controller under Data Protection Laws.

• (b) Controller B shall use the Personal data it receives from Controller A only for the Permitted Purposes in line with the Insertion Order and this DPA unless otherwise required by applicable laws.
• (c) In order to perform their obligations under the Insertion Order and in compliance with applicable Data Protection Laws, each Party’s obligations include without limitation:

1. identifying its independent legal bases for Processing Personal Data; and
2. fulfilling transparency requirements regarding its use of and disclosure of Personal Data.

• (d) Controller A warrants and undertakes that, where required under applicable Data Protection Law, it has obtained or will obtain the necessary consent from Data Subjects to disclose Personal Data to Controller B pursuant to the Insertion Order for the Permitted Purposes (including, in particular, obtaining any necessary consent from End Users for Controller B to use Personal Data in accordance with Data Protection Laws, as described in its appropriate privacy policy and, where applicable, cookie policy).
• (e) Controller A warrants and undertakes that, where required under applicable Data Protection Law, it has provided the appropriate notices to Data Subjects, including but not limited to any required notice at collection or after collection as the case may be.
• (f) Controller A further warrants that it will disclose accurate and up-to-date Personal Data to Controller B as required under the Insertion Order.
• (g) Each Party shall implement and maintain appropriate technical and organizational measures (including, but not limited to, encryption and password protection), when transferring and/or Processing Personal Data, to preserve the confidentiality, integrity and availability of the Personal Data, and prevent any unlawful Processing or disclosure or damage, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of the Data Subjects. The technical and organizational security measures shall include at a minimum those listed in Appendix B to this DPA.
• (h) In the event that either Party receives any correspondence, inquiry or complaint from a Data Subject or Supervisory Authority (“Inquiry”) related to the Processing of Personal Data by the other Party in connection with the Insertion Order, it will promptly inform the other Party and provide full details of the Inquiry. The Parties shall cooperate in good faith to timely respond to the Inquiry in accordance with requirements under the applicable Data Protection Legislation in its capacity as independent Controllers.
• (i) Each Party shall notify the other Party without undue delay and in any event within 24 hours of becoming aware of a Personal Data Breach notifiable to the Supervisory Authorities under applicable Data Protection Laws affecting Personal Data Processed by either Party in connection with the Insertion Order. Each Party agrees to keep the other Party regularly updated as to the handling of such Personal Data Breach and bear their own costs in complying with their obligations under this clause.
• (j) Each Party shall provide all such co-operation and information as the other Party may reasonably require in order to enable that Party to comply with its obligations under Data Protection Laws, including but not limited to carrying out any data protection impact assessments or prior consultations with authorities. Each Party will bear its own costs in complying with its respective obligations under Data Protection Legislation.

Art. 4         International Data Transfers

• (a) The Parties acknowledge that in carrying out their obligations under the Insertion Order, Personal Data may be transferred internationally. In all cases where Personal Data is transferred internationally to a country not providing adequate Personal Data protection in accordance with applicable Data Protection Laws, the Parties will put in place appropriate safeguards that ensure a level of data protection of Personal Data essentially similar to that provided under applicable Data Protection Laws and this Addendum.
• (b) The obligations herein shall apply inter alia to any onward transfer to another third country; or to another entity within the same country it has been exported to.
• (c) In relation to Personal Data that is protected by the GDPR, Module One of the EU SCCs will apply completed as follows:

1. Clause 7: the optional docking clause does not apply;
2. Clause 11: the optional language does not apply;

• Clause 17: Option 2 does apply. Where the respective EU member state does not allow for third-party beneficiary rights, the law of Spain shall apply;

1. Clause 18(b): disputes shall be resolved before the courts of Barcelona;
2. Annex I A (List of Parties) shall be deemed completed with the information of the Parties to this DPA;
3. Annex I B (Description of Transfer) shall be deemed completed with the information set out in Appendix A to this DPA;

• Annex I C: The competent supervisory authority shall be the AEPD (Agencia Española de Protección de Datos), where Controller A is the Data Exporter, and the same when Controller B is the Data Exporter and
• Annex II shall be deemed complete with the information set out in Appendix B to this DPA.

1. In relation to Personal Data that is protected by the UK GDPR, the UK SCCs will apply completed where Controller A and Controller B are lawfully permitted to rely on the EU SCCs for transfers of Personal Data from the United Kingdom subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under  119A(1) of the Data Protection Act 2018, then:
   • The EU SCCs, completed as set out above and herein shall also apply to transfers of Personal Data, subject to sub-clause (B) below; and
   • The UK Addendum shall be deemed executed between Controller A and Controller B, and the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of such Personal Data.

• (e) in relation to Independent Controller Data that is protected by the Swiss Federal Act on Data Protection 1992 (including as amended or superseded) (“DPA”), the EU SCCs will apply as set out above ad herein are amended as follows:

• references to ‘Regulation (EU) 2016/679’ in the EU SCCs will be deemed to refer to the Swiss DPA;
• references to specific articles of ‘Regulation (EU) 2016/679’ will be deemed replaced with the equivalent article or section of the Swiss DPA;
• references to ‘EU’, ‘Union’ and ‘Member State’ will be deemed replaced with ‘Switzerland’;
• references to the ‘competent supervisory authority’ and ‘competent courts’ are replaced with the ‘Swiss Federal Data Protection Information Commissioner’ and ‘applicable courts of Switzerland’ (as applicable),
• in Clause 17, the EU SCCs will be governed by the laws of Switzerland; and
• in Clause 18(b), disputes shall be resolved before the competent courts of Switzerland;

• (f) in the event that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

1. In the event that the SCCs or UK Addendum are amended, replaced or repealed by the European Commission or under applicable Data Protection Laws, the Parties shall work together in good faith to enter into any updated version of the documents or negotiate in good faith a solution to enable a transfer of Personal Data to be conducted in compliance with Data Protection Laws.

Art. 5         Allocation of Costs

Each Party shall perform its obligations under this Addendum at its own cost.

Art. 6         Survival

This Addendum shall survive termination or expiration of the Insertion Order. Upon termination or expiration of the Insertion Order, Controller B may continue to process Personal Data received from Controller A provided that such use complies with the requirements of this Addendum and applicable Data Protection Laws.

Appendix A of DPA: Details of the Processing

The subject-matter of the Processing:

The subject-matter of the processing is the monetization of media Inventory through programmatic advertising as per the Insertion Order. 

The duration of the Processing:

The processing will follow the Term of the Insertion Order and shall be continuous during the Term.

The nature and purpose of the Processing:

The Parties shall process Personal Data for the Permitted Purposes.

The categories of Personal Data:

Unique or pseudonymous identifiers such as IP addresses, location, device ID, advertising ID, or cookie ID, as well as data associated to these identifiers which may include without limitation information about the actual or inferred demographics of the Data Subject, the device and/or browser that they are using and the context in which the advertising is delivered

Sensitive Data (if applicable):

Not Applicable – No sensitive data will be processed under the Parties’ Insertion Order

The categories of Data Subjects:

End users of the publisher websites, mobile applications, CTV and/or other platforms.

Appendix B of DPA: TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the Processing, and the risks for the rights and freedoms of natural persons.