TERMS AND CONDITIONS – DATA SEGMENTS

 

Subject to these Terms and Conditions and any terms and conditions set forth on the Order Form (“Order Form”, and together with these Terms and Conditions, the “Agreement”) Data Provider shall provide MediaMath with the Data Segments. Any capitalized terms used but not defined herein shall have the definitions ascribed to them in the Order Form.

WHEREAS, MediaMath owns and operates a software platform known as the TerminalOne Marketing OS® (“MediaMath Platform”) that, among other things, permits MM Clients to purchase advertising inventory across different channels including websites, mobile sites and mobile device applications and target Ads served onto those advertising inventory;

WHEREAS, Data Provider collects non Personally Identifiable Information regarding Visitors, maintains a database containing profiles of such Visitors and creates Data Segments of such Visitors to be used in the targeting of Ads;

WHEREAS, MediaMath would like to make Data Provider’s Data Segments available on the MediaMath Platform for use by MM Clients; and

NOW, THEREFORE, for good and valuable consideration, the sufficiency of which is hereby acknowledged, the parties agree as follows.

  1. Definitions. In addition to any other term defined in this Agreement, the following terms will have the following meanings:
    • Ads means a creative unit that is served by MediaMath onto Inventory.
    • Affiliate means, with respect to any Party, any entity that controls, is controlling, controlled by or under common control with, such Party. “Control” for the purposes of this definition, means direct or indirect ownership or control of more than 50% of the economic or voting interest of an entity.
    • Applicable Law means all applicable federal, state and local laws and regulations which apply to each party in connection with this Agreement including any data protection, privacy and data security laws and industry self-regulatory guidelines including, without limitation: (i) NAI Code; (ii) the DAA Code; (iii) the DAA’s Application of Self-Regulatory Principles of Transparency and Control to Data Used Across Devices; (iv) the Interactive Advertising Bureau Europe EU Framework for Online Behavioral Advertising; (v) Principles of the European Interactive Digital Alliance (“EDAA”); (vi) Internet Advertising Bureau UK; (vii) the Australian Digital Advertising Alliance’s Best Practice Guideline for Online Behavioral Advertising; (viii) the Asia-Pacific Economic Cooperation Privacy Framework and (ix) European Law and all obligations required under the aforementioned and in Section 7 and Annex hereof.
    • Audience Data Policy means MediaMath’s policies governing any Data Segment found at http://backup2020mm.test/legal/terms/audiencedata_policy/.
    • Custom Segment means a Data Segment that is compiled by Data Provider at the specific request of a MediaMath Client, which may be modelled off of data regarding certain Visitors provided by such MediaMath Client (“Client Seed Data“) and provided to MediaMath solely for that particular MediaMath Client’s use.
    • DAA Code means the set of Digital Advertising Alliance Self-Regulatory Principles for Multi-Site Data posted at http://www.aboutads.info/msdprinciples (or any successor site), including any official guidance provided by the Digital Advertising Alliance such as the Application of the Self-Regulatory Principles of Transparency and Control to Data Used Across Devices, and its applicable regional counterpart, if any.
    • Data Delivery Policy means MediaMath’s policies governing the delivery of data found at http://backup2020mm.test/legal/terms/datadelivery/.
    • Data Segment means a grouping of multiple MMUIDs or other consumer IDs based on shared characteristics, behavioral information, interests or attributions, and as used herein, refer collectively to Custom Data Segments and Standard Data Segments.
    • Deletion Request means a request received by MediaMath from an individual requesting deletion of their personal data held by MediaMath.
    • Digital Property means a website, web page, internet software application, mobile site or application.
    • EEA means the European Economic Area (which shall be deemed to include Switzerland and the United Kingdom throughout the Term of this Agreement).
    • European Law means: (i) Regulation (EU) 2016/679 (“GDPR”); (ii) Directive 2002/58/EC (as amended or replaced from time to time) and applicable laws implementing that Directive in European Union Member States; and (iii) any data protection and privacy laws in the United Kingdom from time to time. References in this Agreement to “Personal Data“, “Data Subject“, “Processor“, “Process/Processed/Processing” and “Supervisory Authority” shall have the meanings set out in the GDPR.
    • Intellectual Property Rights means, collectively, any patents, trade secrets, copyrights, trademarks, and all other intellectual property rights and proprietary rights, whether under the laws of the United States or other jurisdictions, in each case now existing or hereafter developed.
    • Inventory means elements of a Digital Property that a Digital Property owner designates for the placement of Ads.
    • MediaMath Data means as between Data Provider and MediaMath, all data of MediaMath and MediaMath Clients (including, its advertiser clients if applicable) received by Data Provider as a result of MediaMath’s use of the Data Segments, including: (i) any data regarding the advertising campaign of a MediaMath Client and its advertiser clients provided in the MM Report; (ii) any data provided by MediaMath to the Data Provider in connection with an ID Sync (e.g.,. consumer browser header, including IP address, time stamp, MMUID, collectively “ID Sync Data”) and (iii) Client Seed Data.
    • MMUID means any unique identifier which is created, assigned or retained by MediaMath and associated with an individual Visitor.
    • MediaMath Client means a customer of MediaMath.
    • NAI Code means the Code of Conduct promulgated by the Network Advertising Initiative, located at the following website, or any successor website: http://www.networkadvertising.org/sites/default/files/NAI_Code15encr.pdf
    • PII means information which identifies or could be used to identify a particular individual, as compared to a particular device, such as name, address, telephone number, email address, financial account numbers or government-issued identifiers.
    • Quality Standards means standards that: (i) ensure that the Data Segments contain accurate data; and (ii) otherwise meet the requirements of Applicable Law and industry standards.
    • SAR means a request received by MediaMath from an individual for a copy of their personal data held by MediaMath.
    • Sensitive Information means (i) any information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (ii) genetic data; (iii) biometric data for the purposes of uniquely identifying a natural person; (iv) data concerning health; (v) data concerning a natural person’s sex life or sexual orientation; (vi) any information about a minor under the age of 13; (vii) any financial account numbers or insurance plan numbers, (viii) any government-issued identifiers ; (x) any sensitive information as defined in MediaMath’s Audience Data Policy, as updated from time to time. In the Annex hereto the definition of Sensitive Information shall be as set forth above, except that it will also include any Personal Data about minors between the ages of 13 and 16.
    • Standard Data Segments means the Data Segments that are created for general use as further described hereto.
    • Underlying Data Provider means a data supplier from whom the Data Provider obtains Data Segments or any information included in the Data Segments in the first instance. For the avoidance of doubt, Underlying Data Providers shall not include MediaMath or MediaMath Clients;
    • Visitor means a visitor to, or the device such visitor uses to visit, a Digital Property;

To the extent that any Personal Data contained within MediaMath Data and/or Data Segments originate in the EEA, the Annex of this Agreement shall apply. In the event of any conflict, ambiguity or inconsistency between the terms of the Agreement and the Annex, the Annex shall take precedence.

  1. Description of Services; License.
    • Services and Uses.
      • Data Provider maintains a database with pre-existing Standard Data Segments and other consumer data that can be used to group Visitors into Custom Data Segments The Data Segments are (i) cookie-based and anonymous (i.e., there is no Personally Identifiable Information associated therewith) and (ii) represented as a number that is not human readable but can be utilized to target Ads on an advertising campaign and for related purposes, such as creating analytical reports.
      • MediaMath may incorporate the Data Segments into the MediaMath Platform and make the Data Segments available through the MediaMath Platform for the limited purposes of online campaign targeting and related analytics as selected by the MM Client.
      • In order to make the Data Segments targetable within the MediaMath Platform, during the Term, MediaMath will provide certain real-time data transfers (each, a “Pixel Sync”) to Data Provider to enable Data Provider to (x) associate and map an MMUID with an individual Visitor in a Data Segment. and (y) validate audience overlap with Data Provider’s existing Data Segments.
    • License. Data Provider hereby grants MediaMath a limited, non-exclusive, non-transferable (except as permitted in accordance with Section b license to access, view, display, distribute and use the Standard Data Segments and Custom Data Segments (if any) for use in targeting Ads. The access and use of Data Segments by MM Clients as contemplated herein is permitted by the foregoing license grant and shall not be deemed to constitute a sublicense or transfer of such Data Segments by MediaMath.
  1. Fees and Reporting.
    • MediaMath shall pay any sales, use or other taxes payable on the Fees; provided that such taxes are included in the invoice to MediaMath, but will not be responsible for any federal or state income tax imposed on the Data Provider.
    • MediaMath shall not be obligated to pay any invoices delivered to MediaMath later than sixty (60) days after the delivery of the MM Report.
  2. Obligations and Covenants.
    • Data Provider agrees that:
      • Each Standard Data Segment provided by Data Provider shall include the following information: (w) taxonomy, (x) description of the Data Segment, (y) Country of Visitors within the Data Segment and (z) with respect to any Custom Data Segments, the Custom Fee to be invoiced by MediaMath to the MM Client. Any Data Segment that do not have such information shall be rejected by MediaMath, will not be made available on the MediaMath Platform and may not be charged to MediaMath.
      • Data Provider may not provide MediaMath with any Data Segments comprised of consumers that are grouped on the basis of characteristics deemed sensitive under the NAI Code, including but not limited to (w) sensitive health conditions, (x) hyperlocal targeting, (y) websites, mobile sites or applications that might be directed towards children under the age of thirteen (13) or (z) sexual orientation without MediaMath’s prior written consent (email sufficient).
      • In addition to the characteristics set forth in Section a.ii above, if any Data Segments consisting of consumers in the European Union are grouped on the basis of characteristics deemed to be a special category of personal data under either Directive 95/46/EC of 24 October 1995 or the EU General Data Protection Regulation, including but not limited to: (w) race or ethnic origin, (x) political opinions, (y) health or sex life, or (z) trade union membership.
      • Data Provider will not directly or indirectly sell, lease, license, share, disclose or otherwise make available the data provided by MediaMath in connection with the Pixel Sync to any third party, and may not use such data for purposes other than as set forth herein, including to build audience profiles or lookalike profiles, other than as specifically directed by MM Client or MediaMath.
  1. Representations and Warranties.
    • Mutual Representations. Each party represents and warrants that: (i) it has the full corporate and contractual (if required) rights, power and authority to enter into this Agreement and perform the acts required hereunder; (ii) the execution of the Agreement and the performance of its obligations hereunder do not and shall not violate any other agreements to which it is a party; (iii) this Agreement constitutes a valid, legal and binding obligation of such Party when executed and delivered and (iv) any and all activities it undertakes in connection with this Agreement will be performed in compliance with all Applicable Laws.
    • Data Provider Representations. Data Provider represents and warrants that: (i) the Data Segments shall be free of any virus, trap door, Trojan Horse, worm, or other device or malicious code; (ii) the Data Segments have been and shall be collected and compiled in compliance with all Applicable Laws, including applicable privacy laws and regulations, including any self-regulatory industry standards and its privacy policies; (iii) it shall not provide or permit any third party to provide any Personally Identifiable Information or any Sensitive Information to MediaMath and shall not merge or otherwise associate Personally Identifiable Information with information collected through the MediaMath Platform unless such merger or association is conducted in accordance with Applicable Law; (iv) the Data Segments shall not contain any Visitors that have opted-out of interest based advertising; (v) it has obtained all consents necessary to provide the Data Segments and (vi) the Data Segments will be provided consistent with standard industry practices and in a professional and workmanlike manner.
  2. Confidential Information.
    • During the Term, each Party may disclose to the other Party certain information (either oral, written or digital) including but not limited to, research, product plans, products, services, pricing, customer lists or opportunities, processes, designs, drawings, technical data, know-how, financial data, marketing material or hardware configuration (collectively, “Confidential Information”). The recipient of the information (“Recipient”) shall hold the disclosing Party’s (“Discloser”) Confidential Information in confidence and shall not disclose Discloser’s Confidential Information to any third party and shall use it solely for the purpose of performing its obligations under this Agreement including responding to a SAR. Upon termination of this Agreement, Recipient shall either return all Confidential Information in its possession or destroy such Confidential Information and certify its destruction to the Discloser. Where applicable, Data Provider shall flow down its obligations under this section to protect Confidential Information to any Underlying Data Provider such that the confidentiality terms of the contract between Data Provider and the Underlying Data Provider are no less onerous than this Section 6.
    • “Confidential Information” shall not include information which (i) is in the public domain at the time of disclosure or enters the public domain following disclosure through no fault of the Recipient; (ii) the Recipient can demonstrate as already in its possession prior to disclosure hereunder or is subsequently disclosed to the Recipient in each case with no obligation of confidentiality by a third Party having the right to disclose it; or (iii) is independently developed by the Recipient without use of or reference to the Discloser’s Confidential Information. Recipient may disclose the Discloser’s Confidential Information upon the order of any competent court or government agency; provided that prior to disclosure the Recipient shall inform the Discloser of such order and if possible, the opportunity to oppose such order. Each Party agrees that its obligations in this Section 6 are necessary and reasonable in order to protect the Discloser and its business, and each Party agrees that the remedy of damages would be inadequate to compensate the Discloser for any breach by the  Recipient of  its  obligations set  out  under  this  Section 6.  Accordingly, each Party agrees that, in addition to any other remedies that may be available, the Discloser shall be entitled to seek injunctive relief against the threatened breach of this Section 6 or the continuation of any such breach by the Recipient, without the necessity of proving actual damages.
  3. Data and Privacy.
    • Each Party will post a privacy policy conspicuously on its respective web site that is in accordance in all material respects with all Applicable Law.  Data Provider shall ensure that Data Segments can be lawfully provided to, and used by, MediaMath and/or MediaMath Clients throughout the Term: (i) for the Permitted Uses; and/or (ii) to comply with statutory and regulatory obligations to which MediaMath and/or MediaMath Clients are subject. Where the information included in the Data Segments is collected by the Data Provider directly from Visitors, these measures shall include but not be limited to: (i) the communications to Visitors of comprehensive notice describing the categories of first and third-party cookies and cookie-like devices that may be used by the Data Provider on Data Provider’s web, mobile or other digital properties and the purposes for which they may be used including for targeted advertising both on and off of that Digital Property or other Digital Properties; (ii) providing the ability to opt out of advertising cookies or other tracking or similar technologies that store or access information stored on user devices, including without limitation in respect of the collection and processing of mobile IDs; (iii) providing such information to individuals as may be required by Applicable Law (e.g. a description of types of data that are collected for advertising purposes an explanation of how, and for what purpose, data will be used or transferred to third parties, the disclosures that may be made, and, if requested by MediaMath, identifying MediaMath by name and providing a link to MediaMath’s privacy policy); and (iv) obtaining any necessary consents to ensure that MediaMath and MediaMath Clients may lawfully use the Data Segments for the Permitted Uses, including without limitation any necessary consents in relation to the use of cookies or other tracking technologies, as requested by Applicable Law.
    • Where the Data Segments are obtained from an Underlying Data Provider, then the Data Provider shall procure that the Underlying Data Provider has complied with the requirements outlined in Section 7 and shall require the Underlying Data Provider to procure such compliance by any other third party from which it receives consumer data.
    • MediaMath shall respond to SARs or Deletion Requests including any associated Data Segment in such response.
  4. Term and Termination.
    • This Agreement shall commence as of the Effective Date and shall continue until the Order Form issued pursuant to it have expired or been terminated in accordance with Section 8
    • Either Party may terminate this Agreement immediately if the other Party materially defaults on its obligations hereunder and fails to cure (or commence a cure) within ten (10) business days after having been given notice of such default. Notwithstanding the foregoing, MediaMath may terminate this Agreement immediately without notice if Data Provider violates the consent requirement set forth in Section a on more than two (2) occasions.
    • In the event of termination, MediaMath may continue to provide any Data Segments currently in the MediaMath Platform for a period of thirty (30) days from the date of termination.
  5. Indemnification and Limitation of Liability.
    • Indemnification. Data Provider shall indemnify, defend and hold harmless MediaMath, its Affiliates and their respective officers, directors, employees and agents from and against all liabilities, claims, awards, judgments, settlements, damages and costs (including reasonable attorneys’ fees) arising out of any third party claim, action or demand based on (i) Data Provider’s breach of its representations and warranties set forth in Section b and (ii) an allegation that the Data Segments infringe upon a third party’s Intellectual Property Rights.
    • Limitation of Liability. Except with respect to a party’s indemnification obligations (as set forth in Section a above), liabilities relating to a breach of its representation and warranty under Sections 5.a.iv, or 5.b.ii, 5.b.iii or 5.b.v., Section 7, or damages resulting from a party’s gross negligence or intentional misconduct:
      • NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF INCOME, REVENUE OR PROFITS BUT NOT INCLUDING ANY FEES PAYABLE HEREUNDER), EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND
      • EACH PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY FOR DIRECT DAMAGES THAT ARISE OUT OF OR ARE RELATED TO THIS AGREEMENT SHALL BE LIMITED TO THE AGGREGATE FEES PAID AND PAYABLE UNDER THIS AGREEMENT FOR THE TWELVE (12) MONTH PERIOD PRECEDING THE DATE THE LIABILITY FIRST AROSE.
  6. Warranty Disclaimer.

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE DATA SEGMENTS PROVIDED PURSUANT TO THIS AGREEMENT BY DATA PARTNER ARE PROVIDED “AS IS” AND WITHOUT ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE. EACH PARTY DOES NOT MAKE, AND EXPRESSLY DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES OF ANY KIND OR NATURE, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, FITNESS FOR A PARTICULAR PURPOSE AND ANY IMPLIED WARRANTIES OF ANY KIND.

  1. Miscellaneous.
    • Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the state of New York without giving any effect to any conflict of law principles. For any disputes arising out of this Agreement, the parties consent to personal and exclusive jurisdiction of and venue in the state or federal courts within the state and county of New York.
    • Assignment. Neither party may transfer or assign this Agreement or its obligations hereunder, in whole or in part, without the prior written consent of the other Party (which consent shall not be unreasonably withheld, delayed or conditioned), except that a Party may assign all of its rights and obligations hereunder to a successor (whether by sale, acquisition, merger, operation of law or otherwise) if the successor agrees in writing to fulfill all of the assigning Party’s obligations hereunder. This Agreement will be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns. Any assignments in breach of this Section shall be void ab initio.
    • Notices. All notices hereunder shall be in writing and delivered electronically or by certified or registered mail to the addresses set forth above and shall be deemed delivered when received.
    • Severability. If any of the provisions of this Agreement is or becomes illegal, unenforceable or invalid, the remainder of this Agreement shall remain in full force and effect without being impaired or invalidated in any way.
    • Force Majeure. Neither Party shall be liable to the other Party for any delay or failure to perform any of its obligations set forth in this Agreement due to causes beyond its reasonable control, including to acts of nature, war, strikes, acts of terrorism, national disasters or unavailability of necessary utilities.
    • Independent Contractors. Nothing in this Agreement shall be construed to create a joint venture, partnership, employment or agency relationship between the Parties.
    • Publicity. Neither Party will issue any press releases regarding this Agreement without the other Party’s prior written consent; provided, however, that MediaMath may publicize the availability of the Data Segments and may use the applicable Data Provider mark for such purposes.
    • Audit: Data Provider shall keep, in paper and electronic form, at its normal place of business, accurate and up-to-date records containing evidence of compliance with Applicable Laws (the “Privacy Records”)  Data Provider shall permit MediaMath or its authorized representatives, on reasonable notice, during normal business hours, to gain physical and/or remote access to inspect the Privacy Records (and take copies of such Privacy Records) and to inspect compliance with Applicable Laws and Data Provider’s obligations under this Agreement.  Data Provider shall make available to MediaMath all information systems and staff necessary for MediaMath or its authorized representatives to conduct such audit.  Such audit rights shall continue for as long as MediaMath makes the Data Segments available via the MediaMath Platform.  Where applicable, Data Provider shall procure from any Underlying Data Provider a similar obligation to keep Privacy Records and a similar right of audit in favor of MediaMath or its authorized representatives.
    • Non-exclusivity. Subject to the confidentiality obligations set forth in Section 6, each Party acknowledges that nothing in this Agreement restricts the other Party from developing or offering similar products or services to any third party.

 

 

 

ANNEX

TERMS AND CONDITIONS – EUROPEAN LAW REQUIREMENTS AND PRIVACY SHIELD

 

  1. Definitions. For the purposes of this Annex, the following terms shall have the following meanings:
    • Controller Standard Contractual Clauses means the model clauses for the transfer of Personal Data to Controllers, being the clauses approved by the European Commission from time to time.
    • Privacy Shield means the EU-US Privacy Shield and the Swiss-US Privacy Shield as applicable.
    • Security Incident means in relation to MediaMath Data or Data Segments a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to MediaMath Data or Data Segments.
    • Processor Standard Contractual Clauses means the model clauses for the transfer of Personal Data to Processors, being the clauses approved by the European Commission from time to time.
  2. Scope. The rights and obligations in this Annex shall apply to the extent that any Personal Data contained within MediaMath Data and/or Data Segments originate in the EEA. For the purposes of this Annex references to: MediaMath Data shall mean any Personal Data incorporated in the MediaMath Data; Data Segments shall mean any Personal Data incorporated in the Data Segments
  3. Processing of MediaMath Data (excluding ID Sync Data). The parties acknowledge that for the purposes of European Law, Data Provider is appointed as MediaMath’s data processor in respect of MediaMath Data. Data Provider shall, in relation to any MediaMath Data processed in connection with the performance by Data Provider of its obligations under this Agreement (and, if applicable, shall procure that any Underlying Data Provider shall):
    • process that MediaMath Data only in accordance with MediaMath written instructions and in accordance with the level of protection required by the Privacy Shield Principles (and if Data Provider fails to do so, it will promptly notify MediaMath in writing and remedy the breach or MediaMath will have the right to suspend the processing and/or terminate the Agreement);
    • ensure that all personnel who have access to and/or process MediaMath Data are obliged to keep the MediaMath Data confidential;
    • transfer MediaMath Data out of the EEA solely in accordance with (i) its Privacy Shield registration (if applicable) and immediate notify MediaMath if its Privacy Shield registration expires or terminates for any reason; or (ii) in accordance with Processor Standard Contractual Clauses which shall be signed between MediaMath and the Data Provider at Data Provider’s request prior to any transfer taking place;
    • assist MediaMath, at the Data Provider’s cost, in responding to any request from a data subject and in ensuring compliance with its obligations under European Law with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
    • notify MediaMath within 24 hours on becoming aware of any confirmed Security Incident relating to the MediaMath Data;
    • provide MediaMath and/or MediaMath Clients with all such reasonable and timely assistance as MediaMath or the MediaMath Client (as the case may be) may require in order to conduct a data protection impact assessment and, if necessary, consult with its relevant Supervisory Authority;
    • upon written request of MediaMath, delete or return MediaMath Data and copies thereof to MediaMath on termination of this Agreement unless required by European Law to retain some or all of the MediaMath Data in which event Data Provider shall securely isolate and protect such MediaMath Data from any further processing except to the extent required by European Law until deletion is possible;
    • not appoint any subprocessors to process the MediaMath Data without the prior written consent of MediaMath and Data Provider flowing down substantially the same requirements to its subprocessor;
    • as soon as reasonably practicable, inform MediaMath if, in its opinion, an instruction of MediaMath infringes European Law;
  4. ID Sync Data. MediaMath shall disclose the ID Sync Data to Data Provider on an independent controller to controller basis.
    • Data Provider shall, in relation to the ID Sync Data:
      • transfer the ID Sync Data out of the EEA in accordance with (i) its Privacy Shield registration (if applicable) and immediately notify MediaMath if its Privacy Shield registration expires or terminates for any reason; or (ii) in accordance with Controller Standard Contractual Clauses which shall be signed between MediaMath and Data Provider at the Data Provider’s request prior to any transfer taking place;
      • ensure that all personnel who have access to and/or process the ID Sync Data are obliged to keep the ID Sync Data confidential;
      • notify MediaMath without undue delay on becoming aware of any Security Incident relating to ID Sync Data;
      • inform Data Provider of any request from a supervisory authority or regulator related to the processing conducted by MediaMath and cooperate as necessary to respond to such correspondence and fulfil each parties’ respective obligations under European Law; and
      • maintain accurate records and information to demonstrate its compliance with this clause 4 of this Annex.
    • The parties acknowledge that, in respect of ID Sync Data, neither MediaMath nor MediaMath Client shall be acting as joint controllers with the Data Provider for the purposes of European Law. Further, liabilities as between (i) MediaMath/MediaMath Clients on the one hand; and (ii) Data Provider on the other hand, in respect of any breach of European Law (or other applicable privacy/data protection laws), shall be several (not joint).
  5. Data Segments. Data Provider shall disclose the Data Segments to MediaMath on an independent controller to controller basis.
    • MediaMath shall, in relation to the Data Segments:
      • transfer the Data Segments out of the EEA in accordance with MediaMath’s Privacy Shield registration;
      • ensure that all personnel who have access to and/or process the Data Segments are obliged to keep the Data Segments confidential;
      • notify the Data Provider if its Privacy Shield registration expires or terminates for any reason;
      • inform Data Provider of any request from a supervisory authority or regulator related to the processing conducted by MediaMath and cooperate as necessary to respond to such correspondence and fulfil each parties’ respective obligations under European Law;
      • notify Data Provider without undue delay on becoming aware of any confirmed Security Incident relating to Data Segments; and
      • maintain accurate records and information to demonstrate its compliance with this clause 5 of this Annex.
    • Legal Basis. The Parties acknowledge that Data Provider is disclosing the Data Segments to MediaMath for onward disclosure to MediaMath Clients, and MediaMath is processing such Data Segments on the basis that the processing to be undertaken by MediaMath and/or MediaMath Clients is for the purposes of legitimate interests pursued by MediaMath and/or MediaMath Clients and is not unwarranted by reason of prejudice to the rights and freedoms of the individuals who are the subject of targeted advertising, in particular having regard to the consents obtained from individuals and the individuals’ ability to opt-out of advertising cookies or other tracking technologies.
    • The parties acknowledge that, in respect of Data Segments, neither MediaMath nor MediaMath Client shall be acting as joint controllers with the Data Provider for the purposes of European Law. Further, liabilities as between (i) MediaMath/MediaMath Clients on the one hand; and (ii) Data Provider on the other hand, in respect of any breach of European Law (or other applicable privacy/data protection laws), shall be several (not joint).
  6. Privacy Shield. Data Provider acknowledges that MediaMath may disclose this Agreement and any relevant privacy provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, European Data Protection authority, or any other US or EU judicial or regulatory body upon their request.