MediaMath Master Services Agreement 

 

This Master Services Agreement (“Agreement”) is effective as of the date indicated in the Order Form (the “Effective Date”), and is entered into by MediaMath, Inc. (“MediaMath”), a corporation incorporated under the laws of Delaware, for the benefit of itself and its Affiliates, and the entity identified in the Order Form incorporating this Agreement (“Client”).  This Agreement governs the (i) provision of services by MediaMath to Client facilitating the identification, request, purchase, monitoring and tracking of digital advertising transactions (each, a “Transaction”) in the form of campaigns run on behalf of Client (the “Services”), (ii) the performance by MediaMath  of the Services using its proprietary software known as the MediaMath Platform or any other software platform that MediaMath may operate to perform the Services (any such platform referred to herein as the “Service Platform”), (iii) the provision to Client of a limited right to access the Service Platform to facilitate the delivery of the Services by MediaMath.  Any conflict between this Agreement and an Order Form or SOW shall be resolved in favor of the Order Form or SOW with respect to the terms set forth therein. In consideration of the foregoing, the parties agree to the following terms and conditions:

 

1. Definitions: As used in this Agreement and in any Order Form or SOW, the following terms shall have the following meanings:

“Ad(s)” means the advertising content, including text, graphics, rich media, video and/or audio material (and combination thereof), that is displayed on digital media inventory.

“Ad Tag” means software code (e.g., HTML5) or a web beacon (e.g., pixel tag, clear GIF) that (i) collects data regarding a user’s actions in or on a Site or a user’s interaction with an Ad or (ii) requests the delivery of an Ad to a Site.

“Affiliate” means, with respect to a party, an entity that directly or indirectly controls, is controlled by or is under common control with such party. “Control” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the economic or voting interest of an entity.

“Applicable Laws” means all laws and regulations which apply to each party in connection with this Agreement, the performance and receipt of the Services, the use of the Service Platform and the processing of Client Data, MediaMath Data and any related personal data, to include without limitation European Law, Section 5 of the FTC Act, the CCPA and any other data protection legislation that is, on a geographic basis or otherwise, applicable to the parties or to their transactions pursuant to this Agreement. With respect to all applicable data protection legislation other than European Law, references in this Agreement to “personal data” shall have the meaning given to it or an equivalent terminology in such laws such as personal information as defined under the CCPA.

“Applicable Industry Regulations” means all applicable regulations promulgated by self-regulatory industry bodies, to include without limitation the NAI Code and the DAA Code.

“CCPA” means the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100-1798.199), as amended or replaced from time to time.

“CCPA Purposes” shall have the meaning set forth in Schedule B.

“Client Data” means all electronic data which is provided to MediaMath by or on behalf of Client (including from or through a Third Party Processor) in connection with its use of the Services or which is provided or made available to Client by MediaMath or its Affiliates in connection with Client’s receipt of the Services, including personal data contained therein (which shall include any data which is specific to Client), but excluding MediaMath Data.

“Client DSR” means a DSR which is received direct by MediaMath and refers explicitly to Client.

 “Controller Purposes” means “Client Controller Purposes” or “MediaMath Controller Purposes” as defined in Schedule A.

“DAA Code” means the set of Digital Advertising Alliance Self-Regulatory Principles posted at http://www.aboutads.info (or any successor site), including any official guidance provided by the Digital Advertising Alliance such as the Application of the Self-Regulatory Principles of Transparency and Control to Data Used Across Devices, and its applicable regional counterpart, if any.

“Data Subject Request or DSR” means a request from an individual exercising a Data Subject Right.

“Data Subject Right” means subject access rights, the rights to rectify, port personal data, object to the processing and automated processing of personal data and restrict the processing of personal data to the extent allowed under Applicable Laws.

“Europe” means the European Economic Area, Switzerland and the United Kingdom.

“European Law” means: (i) Regulation 2016/679 (GDPR); (ii) Directive 2002/58/EC (as amended or replaced from time to time) and applicable laws implementing that Directive in Member States; and  (iii) any data protection and privacy laws of the United Kingdom in effect from time to time  References in this Agreement to “controller”, “data subject”, “personal data”, “process”/”processed”/processing”, “processor” and “special categories of personal data” shall have the meanings given in European Law.

“MediaMath Data” means all data generated from Client’s use of the Services (and from other clients and partners of MediaMath and its Affiliates) (including all MMUIDs) that does not specifically identify or relate to Client; any data made available by MediaMath for targeting users with Ads, all data relating to any error by, issue with, or enhancement to the operation of the Services, and any data that MediaMath would have regardless of Client’s use of the Services.

“MediaMath DSR” means a DSR which is received direct by MediaMath and does not explicitly refer to Client.

“MediaMath Fees” means income earned and invoiced by MediaMath from the performance of the Services.

“MMUID” means any unique identifier which is created, assigned or retained by MediaMath in respect of each user who interacts with a Site.

“NAI Code” means the Code of Conduct promulgated by the Network Advertising Initiative (“NAI”), located at the following website, or any successor website: https://thenai.org/wp-content/uploads/2021/07/nai_code2020.pdf , including any official guidance provided by the NAI such as the NAI 2015 Guidance on Determining Whether Location is Imprecise.

“Order Form” means an order form or other similar document for placing orders for the Services hereunder that are entered into between Client and MediaMath or any of their respective Affiliates from time to time, including addenda and supplements thereto.  By entering into an Order Form hereunder, an Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto.  Order Forms shall be deemed incorporated herein by reference.

“Prohibited Information” means information that identifies or could be used to identify a particular individual, as compared to a particular device or browser, such as name, address, telephone number, email address, financial account numbers, or government-issued identifiers.

“Processing Activities” shall have the meaning set forth in Schedule A.

 “Professional Services” means the provision by MediaMath of campaign management, training, advisory or other customized services that may be specified in an Order Form or SOW.

“Security Incident” means a breach of security measures leading to accidental or unlawful destruction, loss, alteration, or unauthorized access to or disclosure of Client Data or MediaMath Data.

“Sensitive Information” means: (i) any information revealing race or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (ii) genetic data; (iii) biometric data for the purposes of uniquely identifying a natural person; (iv) data concerning health, which includes all individually identifiable health information that is subject to the Health Insurance Portability and Accountability Act or any other law or regulation that governs data related to a past, present or future physical or mental condition, provision of health care or payment for health care(“PHI”); (v) data concerning a natural person’s sex life or sexual orientation; (vi) any personal data regarding a minor under the age of 16, or if Applicable Laws or Applicable Industry Regulations of any jurisdiction otherwise define a child or a minor as another age, then personal data regarding a minor as thereby defined by the Applicable Laws or Applicable Industry Regulations; (vii) any financial account numbers or insurance plan numbers that can be used to identify an individual; (viii) any government-issued identifiers; or (ix) characteristics deemed sensitive or requiring opt-in consent under the NAI Code.  For the purposes of personal data subject to Schedule A, Sensitive Information will include any personal data about minors between the ages of 13 and 16.

“Site” means a digital property that is accessible by users (including websites, mobile sites and software applications).

 “SOW” means a document for placing orders for Professional Services that are entered into between Client and MediaMath or any of their Affiliates from time to time.

“Supplier” means a third party unaffiliated with MediaMath which is providing services through online digital means, such as the provision of digital media inventory, data products or technology services.

“Third Party Applications” means third party plug-in or add-on online applications that integrate, interoperate or are accessible through the Service Platform but are not provided by MediaMath and are not part of the Service Platform.

“Third Party Partner” means a third party who has been authorized by Client to provide Client Data directly to MediaMath, to whom MediaMath has been authorized by Client to provide Client Data, to whom Client has requested MediaMath to provide MediaMath Data, or who receives Client Data and/or MediaMath Data from Client’s Ad Tags at the request or facilitation of Client.

 

Schedule A attached hereto forms part of this Agreement. Any words or phrases which are defined in Schedule A which are used elsewhere in this Agreement shall have the meaning given to them in Schedule A. In the event of any conflict, ambiguity or inconsistency between the terms of this Agreement, and Schedule A, Schedule A shall take precedence.

 

Schedule B attached hereto forms part of this Agreement. In the event of any conflict, ambiguity or inconsistency between the terms of this Agreement, and Schedule B, Schedule B shall take precedence as relates to the subject matter therein.

 

2. Provision of Services. Subject to the terms and conditions set forth herein, MediaMath hereby grants Client a limited, non-exclusive, worldwide, non-transferable, non-sublicensable right and license to access the Service Platform as a communications portal to receive and process Client’s requests for, and to confirm the deliveries of, the Services and all Transactions.  Client shall be responsible for maintaining the confidentiality of any login credentials, of appropriately limiting dissemination of the login credentials to its employees, contractors or agents, and for using commercially reasonable efforts and appropriate technological and organizational measures to prevent unauthorized access to the Service Platform.  Client remains responsible for all acts and omissions of all individuals who use its login credentials.  Client may allow and create additional login credentials for its Affiliates, agents, advertiser clients, and subcontractors to access the Service Platform on Client’s behalf; provided, however, that Client will remain liable for such use by, and the acts and omissions (including the incurrence of costs and fees) of, such parties.  Client shall maintain current records of all individuals to whom it allows access to the Service Platform and shall provide identifying information regarding such individuals to MediaMath upon request. Client must obtain MediaMath’s prior written consent in order to (i) provide any competitor of MediaMath with access to the Service Platform for any purpose, or (ii) engaging in Transactions through the Service Platform while it or its Affiliate owns, is developing, or is maintaining a demand side platform substantially similar to the Service Platform.  MediaMath may require a third-party access agreement from Client’s agents or subcontractors prior to allowing their access to the Service Platform.

 

3. MediaMath Obligations. MediaMath shall: (i) provide basic technical support for the use of the Service Platform at no additional charge, (ii) use commercially reasonable efforts to make the Service Platform accessible and available 24 hours per day, 7 days per week, except for planned downtime or maintenance of the Service Platform and any unavailability caused by circumstances outside the control of MediaMath, and (iii) provide the Services in accordance with Applicable Laws.

 

4. Client Obligations.

a) Acceptable Use. Client agrees that its use of the Services, including the transfer or provision Client Data to MediaMath or collected, compiled, processed or transferred using the Service Platform (including any such data that is uploaded into the Service Platform), and the display of Ads, shall at all times be in compliance with all Applicable Laws, Applicable Industry Regulations, and MediaMath’s policies for use of the Services and Service Platform found at mediamath.com/legal/terms/policies (“User Policy”); provided, however, that if Client is not a member of the NAI, Client’s obligations under the NAI Code shall be limited to the rules governing transparency and notice, user control, use limitation, and data access, quality, retention and security.

b) Restrictions. Notwithstanding the foregoing or anything to the contrary herein (but subject always to the obligations set forth in Schedule A, this Section 4 and Section 9), neither party shall be liable to the other to the extent that any breach of Applicable Law or Applicable Industry Regulations by it is caused directly by an act or omission of the other party.  When using the Service Platform on a self-service basis, Client is solely responsible for: (i) distribution of its Ads and implementation of Ad Tags thereon, (ii) obtaining the intellectual property rights to display and distribute the Ads, and (iii) the placement of Ad Tags (specifically, event pixels) on various Sites.  Client shall be prohibited from (1) attempting to gain unauthorized access to the Service Platform or any related systems or networks, (2) directly or indirectly modifying, reverse engineering, reverse compiling or disassembling, or causing or permitting any other party to modify, reverse engineer, reverse compile or disassemble, any Services, (3) reselling or  making available to third parties any part or derivative of the Services or the Service Platform other than to parties authorized by Section 2 above, (4) unless otherwise authorized by MediaMath in writing, creating derivative products based upon the Service Platform or using MediaMath Data, (5) using the Services, any MediaMath Data, or any part thereof, to build or augment user profiles, or create or enhance any database, data product or  service for resale to a third party, (6) including in Client Data any data that is inaccurate, or data relating to individuals or households which have opted out of targeted advertising, (7) providing or permitting any third party to provide to MediaMath any Prohibited Information or Sensitive Information, except as permitted by the User Policy, or (8) merging any MediaMath Data with any Prohibited Information or otherwise re-identifying, or attempting to re-identify, an individual for targeted advertising unless accomplished in compliance with all Applicable Laws and Applicable Industry Regulations, including any obligations to  obtain specific opt-in consent.

c) Third Party Partner Liability. Client agrees that unless otherwise agreed in writing among it, MediaMath, and any Third Party Partner, Client shall be liable for all acts and omissions of its Third Party Partner, including such Third Party Partner’s: (i) use, disclosure or any other processing of Client Data or MediaMath Data, and (ii) compliance with all Applicable Laws and Applicable Industry Regulations relevant to its collection, disclosure, use or any other processing of Client Data.

5. Fees and Payment Terms. (a) Fees. MediaMath shall invoice, and Client shall pay to MediaMath, the MediaMath Fees and all other costs with respect to the Transactions consummated using the Service Platform. (b) Terms. Unless otherwise set forth in an Order Form, SOW or any other written agreement between the parties, all payments are due within thirty (30) days of the invoice date by wire transfer, check or other means expressly agreed to in writing by the parties.  Unless Client disputes any amounts prior to the due date of an invoice, Client shall be deemed to have accepted such invoice. (c)   MediaMath Fees for the provision of the Services, amounts collected for the Transactions consummated using the Service Platform and any other amount due pursuant to this Agreement do not include any taxes, levies, duties or similar governmental assessments of any nature, including value-added, sales, use or withholding taxes which are assessable by any jurisdiction whatsoever (collectively, “Taxes”).  Client is responsible for paying all Taxes associated with its purchases hereunder.  If MediaMath has the legal obligation to pay or collect Taxes for which Client is responsible, MediaMath will invoice Client and Client will pay that amount.  MediaMath is solely responsible for taxes assessable against it based on its net income, property and employees. (d) Late Payments. If Client fails to pay the invoiced amount (other than amounts disputed in good faith) by the due date, then without limiting MediaMath’s rights and remedies, MediaMath may suspend access to the Services upon five (5) days’ prior notice to Client until all outstanding amounts are paid in full or Client makes payment arrangements satisfactory to MediaMath. Any invoiced amounts not received by their due date will accrue interest at the lesser of 2% per month or the maximum interest allowed by law.

6. Intellectual Property and Data. (a) IP Rights. Apart from the limited licenses granted herein, and subject at all times to the restrictions set forth in Section 4 above, each party will retain their respective rights to their intellectual property. Client acknowledges that the Services, MediaMath Data, any derivative or subset of the foregoing, and all intellectual property and proprietary rights in and to the foregoing, are the sole and exclusive property of MediaMath and its licensors. MediaMath acknowledges that Client’s Ads, all Client Data and all intellectual property rights therein are the sole and exclusive property of Client.  (b) License to Client Data.  Client hereby grants MediaMath a non-exclusive, worldwide, royalty-free license and right to access, collect (including from Sites), and use Client Data in connection with the Services provided under this Agreement, including providing access to Client Data by Suppliers in order for Suppliers to use Client Data as may be necessary to provide their services.  (c) License to Ads.  Client hereby grants to MediaMath a non-exclusive, worldwide license to reproduce, distribute, display and transmit Client’s Ads in electronic form via the internet and third party networks in connection with Client’s use of the Services.  (d) Feedback. Client grants to MediaMath and its Affiliates a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into the Services any suggestion, enhancement request, recommendation, correction or other feedback from Client or its Affiliates regarding the Services or Service Platform.

 

7. Representations and Warranties. (a) Client. Client represents and warrants that (i) the natural person executing this Agreement, including any Order Forms and SOWs, has been duly authorized on behalf of Client to do so, and (ii) the execution, delivery and performance of this Agreement and the transactions contemplated herein does not and will not violate or conflict with any Applicable Laws, contractual obligations, or any other arrangements with third parties to which Client is bound. (b) MediaMath.  MediaMath represents and warrants that (i) it has validly entered into this Agreement and has the authority to do so, (ii) during the Term, the Services shall perform materially in accordance with the documentation provided in MediaMath’s “Knowledge Base,” accessible through the Service Platform, (iii) it will use commercially reasonable efforts to prevent the transmission of viruses, worms, Trojan horses or other malicious code to Client, and (iv) all Professional Services will be provided in a competent and workmanlike manner in accordance with an SOW.  For any breach by MediaMath of a warranty above, MediaMath will use commercially reasonable efforts to promptly cure such breach.  In the event that MediaMath is unable to do so within thirty (30) days, Client’s sole and exclusive remedy shall be to terminate this Agreement or any affected Order Forms or SOWs pursuant to Section 13(b)(i) below. Client must notify MediaMath in writing of any alleged failure by MediaMath to comply with the above warranties within thirty (30) days following delivery.  Upon receipt of such notice, MediaMath will either: (i) use commercially reasonable efforts to cure or correct the failure, or (ii) terminate the failed Services and issue a prorated refund for the terminated Services.  This Section 7, together with Section 11(a), set forth Client’s exclusive rights and remedies and MediaMath’s sole liability with respect to a breach of its warranties set forth above.

 

8. Confidentiality. For purposes of this Agreement, the term “Confidential Information” means non-public information that a party designates as being confidential or which, under the circumstances surrounding disclosure, reasonably ought to be treated as confidential, including without limitation the terms set forth in this Agreement, an Order Form or SOW, Client Data, MediaMath Data, information about the Services or derivatives thereof, and business or strategic development and marketing plans of either party. Confidential Information will not include information that: (a) was previously known, without obligation of confidentiality, by the receiving party, prior to any disclosure from the disclosing party, (b) is or otherwise becomes available to the public other than by breach of this Agreement by the receiving party, (c) was received without restriction from any person or entity that the receiving party reasonably believes was not in violation of any duty of non-disclosure, or (d) the receiving party developed independently of any disclosures of such information by the disclosing party. Neither party will disclose any Confidential Information to any third party; provided, however, that a party may disclose Confidential Information to its Affiliates, Suppliers, employees, professional advisors, agents and/or independent contractors to whom disclosure is reasonably required, so long as such individuals and entities have agreed to keep such information confidential in the same or a substantially similar manner as provided for in this Agreement, and MediaMath may disclose personal data forming part of Client Data in response to a DSR. Neither party will use any Confidential Information except as necessary to achieve the purposes of this Agreement. Each party will take reasonable security precautions, at least as great as the precautions it takes to protect its own confidential information of a similar nature (but not less than reasonable care), to keep confidential the Confidential Information. Notwithstanding anything herein to the contrary, a party may disclose Confidential Information in accordance with a judicial or other governmental order or as may be required by Applicable Law; provided, however, that a party so disclosing Confidential Information will give the other party as much advance notice as reasonably possible of any such disclosure so that such party may seek a protective order or other remedy. The disclosing party will comply with any protective order or equivalent relating to the Confidential Information. If there is no protective order, the disclosing party will use reasonable efforts to ensure that only the minimum portion of the Confidential Information necessary to comply with the law or order is disclosed. The parties agree that monetary damages for breach of confidentiality under this section will not be adequate and the non-breaching party shall be further entitled to seek injunctive relief.

 

9. Privacy. MediaMath shall maintain appropriate technical and organizational measures and commercially reasonable and appropriate administrative and physical measures designed to protect Client Data from a Security Incident. MediaMath shall respond directly to MediaMath DSRs, and Client authorizes MediaMath to respond directly to Client DSRs. At all times, in accordance with Applicable Laws and Applicable Industry Regulations, Client shall: (i) post a conspicuous privacy policy on the Site(s) owned and operated by it which discloses information to users, including, without limitation, a description of the types of personal data that are collected, an explanation of how and for which purpose(s) personal data will be used or transferred to third parties such as MediaMath (including for the Processing Activities, Controller Purposes and CCPA Purposes) and provide any other disclosures to Users as required by Applicable Law, or Applicable Industry Regulations including for MediaMath to be able to provide the Services; and (ii) provide the ability to opt out of advertising cookies or other tracking technologies. Additionally, if requested by MediaMath, within its privacy policy or other disclosures Client will identify MediaMath by name and provide a link to MediaMath’s privacy notice.  At all times, in accordance with Applicable Laws and Applicable Industry Regulations, Client shall secure specific consent to the use of cookies and other tracking or similar technologies that store or access information stored on user devices.  In the event that Client intends to provide Client Data to MediaMath that constitutes Prohibited Information, Client is responsible for encrypting such data in a manner which prevents it from being disassembled or reverse engineered in order to identify the individual to which it pertains prior to providing it to MediaMath, and such encrypted data shall then no longer be Prohibited Information.  To the extent that Client Data or MediaMath Data processed by Client or MediaMath or its Affiliates pursuant to this Agreement contains any personal data which originates in Europe,  or would otherwise be subject to European Law, Schedule A shall additionally apply. To the extent that Client Data or MediaMath Data processed by Client or MediaMath or its Affiliates pursuant to this Agreement contains any personal information (as defined by the CCPA) pertaining to a California consumer (as defined by the CCPA), Schedule B shall additionally apply.

 

10. Warranty Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN SECTION 7, MEDIAMATH AND ITS LICENSORS MAKE NO WARRANTIES OR REPRESENTATIONS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. MEDIAMATH DOES NOT MAKE ANY REPRESENTATION REGARDING THE BENEFIT THAT MAY BE OBTAINED FROM RECEIPT OF THE SERVICES, INCLUDING THE AVAILABILITY OR DESIRED VOLUME OF DIGITAL MEDIA INVENTORY MEETING CLIENT’S SELECTED CRITERIA, OR THAT CLIENT WILL BE THE SUCCESSFUL BIDDER ON SUCH INVENTORY.  MEDIAMATH DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

 

11. INDEMNIFICATION

a) By MediaMath. MediaMath shall defend Client and its officers, directors, employees and agents against any claim, demand, suit or proceeding made or brought against Client by a third party alleging that Client’s receipt of the Services or use of the Service Platform as permitted hereunder infringes or misappropriates a patent, copyright, trademark or trade secret of a third party (a “Claim Against Client”), and shall indemnify Client for any damages, reasonable attorney fees and costs finally awarded against Client as a result of, and for amounts paid by Client under a court-approved settlement of, a Claim Against Client; provided that Client (i) promptly gives MediaMath written notice of the Claim Against Client, (ii) gives MediaMath sole control of the defense and settlement of the Claim Against Client (provided that MediaMath may not settle or defend any Claim Against Client unless it unconditionally releases Client of all liability), and (iii) provides to MediaMath all reasonable assistance in defending such claim, at MediaMath’s expense.  In the event of a Claim Against Client or in the event that MediaMath reasonably believes any Service(s) may infringe or misappropriate a third party’s intellectual property rights, then at no cost to Client, MediaMath may in its sole discretion (a) modify the Service(s) so that it no longer infringes or misappropriates, without breaching MediaMath’s warranties above, (b) obtain a license for Client’s continued use of the affected Service in accordance with this Agreement, or (c) terminate the affected Service or this Agreement upon 30 days’ prior written notice and provide a refund of any prepaid fees applicable to any period following the effective date of termination.  The foregoing obligations do not apply to Claims Against Client arising out of or resulting from, either in whole or in part, (w) any Client or third party content, data, software, systems, tools, services or intellectual property, (x) any modification of the Services or Service Platform by Client or at its direction, (y) any combination of the Services with content, data, software, systems, tools, services or intellectual property provided by Client or at its direction where such claim would not exist but for such combination, or (z) use of the Services in breach of this Agreement.

b) By Client. Client shall defend MediaMath and its officers, directors, employees and agents against any claim, demand, suit or proceeding made or brought against MediaMath by a third party arising out of or relating to Client Data or Client’s use of the Services (a “Claim Against MediaMath”), and shall indemnify MediaMath for any damages, compensation claims under European Law, regulatory fines, reasonable attorney fees and costs finally awarded against MediaMath as a result of, and for amounts paid by MediaMath under a court-approved settlement of, a Claim Against MediaMath; provided that MediaMath (a) promptly gives Client written notice of the Claim Against MediaMath, (b) gives Client sole control of the defense and settlement of the Claim Against MediaMath (provided that Client may not settle or defend any Claim Against MediaMath unless it unconditionally releases MediaMath of all liability), and (c) provides to Client all reasonable assistance in defending such claim, at Client’s expense. The foregoing right to control the defense and settlement of a Claim Against MediaMath shall not apply to any claim made by a regulatory authority of a data subject.

c) Data Liability. With respect to any Prohibited Information or Sensitive Information provided to MediaMath by Client, Client shall be liable for any and all costs of its removal from the Service Platform and from Amazon Web Services.  MediaMath shall not be liable for any damages to third parties resulting from Client’s use of the Service Platform to collect, transmit, manage or process Sensitive Information.

d) Exclusive Remedy. Section 11(a) above states MediaMath’s sole liability, and Client’s exclusive remedy, for the type of claim described therein.

e) Damages.  For the sake of clarity, the parties agree that any special, incidental, punitive or consequential damages suffered by a third party which are an element of loss or damage subject to indemnification under this Section 11 shall be considered direct damages hereunder.

 

12. Limitation of Liability. EXCEPT FOR DAMAGES RESULTING FROM GROSS NEGLIGENCE OR WILLFUL MISCONDUCT  AND PURSUANT TO SECTION 11(d) ABOVE, IN NO EVENT SHALL A PARTY BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES, AGENTS OR SUBCONTRACTORS FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (including BUT NOT LIMITED TO damages for loss of revenue and/or profit AND whether OR NOT foreseeable), arising out of this agreement regardless of whether the liability is based on breach of contract, tort, strict liability, breach of warranties or otherwise, and even if the party has been advised of the possibility of those damages. Neither party shall be liable for any acts or omissions of third parties EXCEPT TO THE EXTENT SPECIFIED IN SCHEDULE A AND AS PROVIDED FOR BY APPLICABLE LAW.  EXCEPT FOR LIABILITY INCURRED BY A PARTY IN CONNECTION WITH A CLAIM MADE UNDER SECTION 11 OR RESULTING FROM GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, NEITHER PARTY’S TOTAL LIABILITY UNDER THIS AGREEMENT SHALL EXCEED THE AGGREGATE MEDIAMATH FEES PAID UNDER THIS AGREEMENT FOR THE SIX (6) MONTH PERIOD PRECEDING THE DATE LIABILITY FIRST AROSE.  NOTWITHSTANDING THE FOREGOING, CLIENT’S OBLIGATION TO: (I) PAY MEDIAMATH FEES AND ANY OTHER AMOUNTS DUE TO MEDIAMATH PURSUANT TO THIS AGREEMENT, AND (II) PAY FOR COSTS AND DAMAGES PURSUANT TO SECTION 11(C) SHALL BE EXCLUDED FROM ALL LIMITATIONS ON LIABILITY AND REMAIN INDEPENDENT OBLIGATIONS UNTIL PAID IN FULL.

 

13. Term and Termination. (a) Term. This Agreement commences on the Effective Date and shall continue until all Order Forms and SOWs issued pursuant to it have expired or been terminated in accordance with this Section 13. (b) Termination.  Either party may terminate any and all Order Forms and/or SOWs if: (i) the other party materially breaches its obligations hereunder and fails to cure such breach (if curable) within thirty (30) days following the receipt of a written notice specifying the nature of the breach from the party seeking to terminate, or (ii) the other party becomes insolvent, makes a general assignment for the benefit of creditors, or becomes the subject of any voluntary or involuntary proceeding in bankruptcy, liquidation, dissolution, receivership, attachment or composition. (c) Suspension.  Notwithstanding any other provision hereof, MediaMath shall have the right to immediately suspend provision of the Services or access to the Service Platform if MediaMath has reason to believe in good faith that Client has breached its obligations under Sections 4 or 9 or is creating a security vulnerability in Service Platform, and may terminate this Agreement and all Order Forms and/or SOWs upon determination that such breach is incapable of a cure. (d) Effect of Termination. Upon the effective date of termination of this Agreement, without prejudice to any rights or remedies of either party: (x) Client’s license to access the Service Platform or receipt of any Services shall be revoked and Client shall cease use of all MediaMath Ad Tags, and (y) Client shall promptly pay to MediaMath all amounts due in accordance with this Agreement.  Schedule A, Sections 5, 6, 8, 9, 11, 12, and 15 and any other terms or conditions which, by their nature, would, or are expressed to, survive termination shall do so.

 

14. Third Party Applications and Beta Products. (a) Third Party Applications. From time to time, Third Party Applications which are clearly designated as such may be made available within the Service Platform and may interoperate with the Service Platform in connection with the provision by MediaMath of the Services. Client acknowledges and agrees that the use of a Third Party Application (i) shall be governed by the terms of use of the Third Party Applications and that it shall be responsible for compliance in all respects with such terms, (ii) may be subject to additional fees, which shall clearly be designated, (iii) may permit the provider of Third Party Applications to access Client Data in the Service Platform, and (iv) is not monitored, controlled or endorsed by MediaMath and MediaMath has no liability whatsoever with respect thereto. (b) Beta Products. Client acknowledges that from time to time there may be opportunities to use products or services that are beta or not generally available. Such services are not “Services” hereunder and are subject to MediaMath’s policies regarding beta products which are part of the User Policy.

 

15. Miscellaneous Provisions. (a) Governing Law. This Agreement shall be governed, construed and enforced in accordance with the laws of the following, without reference to its conflict of law principle: (i) where Client is incorporated in the USA or Canada with the State of New York and New York County; (ii) where Client is incorporated in Europe or the Middle East or Africa with England & Wales and London, England; (iii) where Client is incorporated in Asia Pacific with Singapore and Singapore; (iv) where Client is incorporated in Latin America with Brazil and Sao Paulo, Brazil. (v) For any disputes arising out of this Agreement, the parties consent to personal and exclusive jurisdiction of and venue of the relevant jurisdiction indicated in this Section, except in relation to debt recovery actions which may be filed in any relevant jurisdiction. (b) Assignment. Except for an assignment of MediaMath’s duties and obligations to any of its Affiliates, neither party may assign its rights or obligations under this Agreement, whether voluntarily or by operation of law or otherwise, without the other party’s prior written consent. Notwithstanding the foregoing, either party may assign this Agreement to an entity that is not a direct competitor or an Affiliate of a direct competitor of the non-assigning party, in connection with an acquisition, sale or transfer of all or substantially all of its assets, stock or business by sale, merger, consolidation, reorganization, or similar transaction. Any purported assignment or transfer in violation of this section shall be void. Subject to the foregoing restrictions, this Agreement will bind and benefit the parties and their successors and permitted assigns. (c) Entire Agreement. This Agreement constitutes the entire agreement between the parties and supersedes any prior understandings or discussions relating to the subject matter of this Agreement. (d) Amendments.  Any amendments to this Agreement must be made in writing. (e) Waivers.  No failure or delay on the part of either party in exercising any right or remedy under this Agreement will operate as a waiver, nor will any single or partial exercise of any such right or remedy preclude any exercise of any other right or remedy. (f) Counterparts.  This Agreement (by way of Order Form) may be signed in multiple counterparts, and each such duly signed counterpart shall be deemed to be an original of this Agreement.  (g) Relationship.  Each party is an independent contractor with respect to the other party hereunder. This Agreement shall not be construed to (i) create any employment, partnership, joint venture, franchise, master-servant, or agency relationship between the parties, or (ii) authorize any party to enter into any commitment or agreement binding the other party. (h) Force Majeure.  No party shall be liable under this Agreement for (or deemed in breach of this Agreement by reason of) any failure, delay or interruption in performing any term or condition of this Agreement due to cause(s) entirely beyond the control of such party; subject however to the condition that such party promptly gives the other party written notice thereof and takes immediate action to cure such failure. The time for performance following a force majeure event shall be extended for a period equal to the duration of the event. Payment of the fees due under this Agreement shall not be subject to this provision. (i) Severability.  If any portion of this Agreement is determined to be or becomes unenforceable or illegal, then such portion shall be reformed or eliminated to the minimum extent necessary for this Agreement to be enforceable and legal, and this Agreement shall remain in effect in accordance with its provisions as modified by such reformation or elimination. (j) Notices. All notices pursuant to this Agreement shall be in writing and delivered either personally, by express courier, certified mail or e-mail and sent to the addresses set forth below a party’s signature below or to such other address as a party may later specify in writing. MediaMath may give notice by emailing Client’s billing contact as specified on an Order Form or SOW. All notices shall be deemed to have been given upon receipt. (k) Publicity. MediaMath may publicly disclose in writing the fact that Client is a client and may use Client’s trademarks or service marks solely for such purpose.

Schedule A
European Law Requirements

1. As used in this Schedule A, the following terms shall have the following meanings:

“Client Controller Purposes” means for the purposes of receiving the Services; and as is more particularly described at www.mediamath.com/legal/processingpurposes.

“Model Clauses” means the EU SCCs populated with the information described in the Annex to this Schedule A. References to “Module One” and “Module Two” have the meaning outlined in the Model Clauses.

“MediaMath Controller Purposes” means improving and enhancing the Services, including identifying, blocking and removing data considered to be unlawful or fraudulent; the bidding process; and as is more particularly described at www.mediamath.com/legal/processingpurposes.

“Privacy Shield” means the EU-US Privacy Shield and the Swiss-US Privacy Shield as applicable.

“Processing Activities” means processing Ad Tags placed by or on behalf of Client and as more particularly described at www.mediamath.com/legal/processingpurposes.

“SCCs” means: (i) the standard contractual clauses and its appendices in European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 relating to transfers of personal data to third countries pursuant to Regulation (EU) 2017/679 and any successor clauses issued from time to time by the European Commission, any applicable data protection authority, or other body with competent authority and jurisdiction, in each case, in relation thereto (the “EU SCCs”) and (ii) standard data protection clauses  issued by the UK Information Commissioner under section 119A(1) of the 2018 Data Protection Act referred to as the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 as may be updated from time to time (the “UK IDTA”).

2. The rights and obligations in this Schedule A apply to the collection, processing and sharing of personal data originating in the EEA by and between MediaMath, Client and certain third parties (e.g. subprocessors including Affiliates of MediaMath). For the purposes of this Schedule A references to Client Data shall mean any personal data incorporated in Client Data and references to MediaMath Data shall mean any personal data incorporated in MediaMath Data.

3. General Obligations.

a. Both parties will comply with all applicable requirements of European Law.

b. Client will ensure that it has all necessary and appropriate consents and notices in place to enable the lawful transfer of Client Data to MediaMath for the duration and purposes of this Agreement.

4. Appointment of MediaMath as Client’s Processor.

a) The parties acknowledge that for the purposes of European Law, Client is the data controller of Client Data and appoints MediaMath as its data processor for the Processing Activities.

b) MediaMath shall, in relation to any Client Data processed for the Processing Activities in connection with the performance by MediaMath of its obligations under this Agreement:

i) process that Client Data only in accordance with the Processing Activities (or as otherwise agreed in writing);

ii) ensure that all personnel who have access to and/or process Client Data are obliged to keep Client Data confidential;

iii) process Client Data transferred out of Europe in accordance with the Privacy Shield principles;

iv) assist Client, at Client’s cost, in responding to any DSR from a data subject received directly by the Client and in ensuring compliance with its obligations under European Law with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

v) notify Client without undue delay upon becoming aware of any confirmed Security Incident relating to Client Data;

vi) upon written request of Client, delete or return Client Data and copies thereof to Client on termination of the Agreement unless required by a judicial or other governmental order or by applicable law to retain some or all Client Data. This requirement shall not apply to Client Data MediaMath has archived on back-up systems; and

vii) maintain accurate records and information to demonstrate its compliance with this clause 4(b) of this Schedule A.

c. Client consents to MediaMath appointing subprocessors to process Client Data, such subprocessors will be listed at mediamath.com/legal/subprocessorswhich MediaMath shall update with any details of any changes at least 10 days prior to the change. MediaMath confirms that it has entered or (as the case may be) will enter with the subprocessor into a written agreement requiring it to protect Client Data to the standard required by European Law. As between Client and MediaMath, MediaMath shall remain fully liable for all acts or omissions of any subprocessor appointed by it pursuant to this clause 4(c) of this Schedule A. Client may object to the replacement of a subprocessor provided such objection is on reasonable grounds. If Client objects to such appointment and is unable to select an alternative subprocessor then Client may terminate the applicable Services provided in the EEA without prejudice to Client’s obligations to pay any fees under this Agreement due up to the date of termination of such Services (or subsequent pro-rated fees).

d. MediaMath uses external auditors to verify the adequacy of its security measures, including the security of the physical data centres from which the Services are provided. The audit: (a) will be performed at least annually; (b) will be performed according to SSAE 16 audit standard or such other alternative standard that is substantially equivalent to SSAE 16; (c) will be performed by independent third party security professionals at MediaMath’s selection and expense; and (d) will result in the generation of an audit report which will be MediaMath’s Confidential Information. MediaMath shall provide Client with a copy of the report upon written request.

e. Notwithstanding the commitment provided by MediaMath in clause 4(b)(iii) above, MediaMath and Client agree that for the purposes of any transfer of Client Data out of Europe, to MediaMath to process for the Processing Activities:

1. 1. 1. the Module Two Model Clauses shall be incorporated into this Agreement between them, and;
         1. the Module Two Model Clauses shall be interpreted in accordance with the details provided in Annex 1 to this Schedule A; and
         2.  the Module Two Model Clauses shall be amended by the UK IDTA, as interpreted with the details provided in Annex 2 to this Schedule A for the purpose of transfers from the UK.

5. Sharing of Personal Data between Client and MediaMath as Controller.

a. Client shall disclose Client Data to MediaMath on an independent controller to controller basis for the MediaMath Controller Purposes.

b. MediaMath shall, in relation to any Client Data processed for MediaMath Controller Purposes:

i) process Client Data only for the MediaMath Controller Purposes (or as otherwise agreed in writing) and in respect of any Client Data transferred out of the EEA, in accordance with the Privacy Shield principles;

ii) ensure that all personnel who have access to and/or process Client Data are obliged to keep Client Data confidential;

iii) promptly inform Client of any request from a supervisory authority or regulator related to the processing of Client Data conducted by MediaMath and cooperate as necessary to respond to such correspondence and fulfil each parties’ respective obligations under European Law;

iv) notify Client without undue delay on becoming aware of any confirmed Security Incident relating to Client Data; and

v) maintain accurate records and information to demonstrate its compliance with this clause 5(b) of this Schedule A.

vi) Notwithstanding the commitment provided by MediaMath in clause 5(b)(i) above, MediaMath and Client agree that for the purposes of the transfer of Client Data outside of Europe, to MediaMath to process for the MediaMath Controller Purposes:

vii) the Module One Model Clauses shall be incorporated into this Agreement between them;

viii) the Module One Model Clauses shall be interpreted in accordance with the details provided in Annex 1 to this Schedule A; and

ix) the Module One Model Clauses shall be amended by the UK IDTA, as interpreted with the details provided in Annex 2 to this Schedule A for the purpose of transfers from the UK.

6. Sharing of Personal Data between MediaMath and Client as Controller.

a. MediaMath will through performance of the Services make available MediaMath Data to Client on an independent controller to controller basis for Client Controller Purposes.

b. Client shall, in relation to any MediaMath Data processed for Client Controller Purposes:

i) process MediaMath Data only for Client Controller Purposes (or as otherwise agreed in writing) and in accordance with the level of protection required by European Law (and if Client fails to do so, it will promptly notify MediaMath in writing and remedy the breach or MediaMath will have the right to suspend the Services and/or terminate the Agreement);

ii) maintain appropriate technical and organizational measures and commercially reasonable and appropriate administrative and physical, measures for the security and confidentiality of MediaMath Data from a Security Incident;

iii) ensure that all personnel who have access to and/or process MediaMath Data are obliged to keep such MediaMath Data confidential;

iv) not process any MediaMath Data in a territory outside of the EEA unless it has taken such measures as are necessary to ensure the transfer is in compliance with European Law;

v) promptly inform MediaMath of any request from a data subject, supervisory authority or regulator related to the processing conducted by Client and cooperate as necessary to respond to such correspondence and fulfil each parties’ respective obligations under European Law;

vi) notify MediaMath without undue delay on becoming aware of any confirmed Security Incident involving MediaMath Data; and

vii) maintain accurate records and information to demonstrate its compliance with this clause 6(b) of this Schedule A.

c. MediaMath and Client agree that for the purposes of any processing of MediaMath Data outside of Europe, by Client for Client Controller Purposes:

i) The Module One Model Clauses shall be incorporated into this Schedule A between them;

ii) The Module One Model Clauses shall be interpreted in accordance with the details provided in Annex 1 to this Schedule A; and

iii) the Module One Model Clauses shall be amended by the UK IDTA, as interpreted with the details provided in Annex 2 to this Schedule A for the purpose of transfers from the UK.

7. Disclosures to Authorities.

MediaMath shall be entitled to provide a copy of this Schedule A and any other provisions of this Agreement to the US Department of Commerce, the Federal Trade Commission, any supervisory authority or regulator on their request (notwithstanding any other provision of this Agreement).

Annex 1 to Schedule A
Interpretation of Model Clauses

1. This Annex sets out the parties agreed interpretation of their respective obligations under the applicable Module One and Module Two Model Clauses for transfers incorporated between them by Schedule A (together the “Model Clauses”).
2. In the event that a competent supervisory authority or court of competent jurisdiction determines that any provision of this Annex conflicts with the requirements of the applicable Model Clauses, then the terms of the applicable Model Clauses shall prevail.
3. As between MediaMath and Client, any claims brought under the applicable Model Clauses or Schedule A shall be subject to the terms of the Agreement, including but not limited to, the exclusions and limitations set forth in the Agreement. In no event shall either MediaMath or Client limit or exclude its liability with respect to any data subject rights under the applicable Model Clauses.
4. The parties agree that for the purposes of transfers of Client Data to MediaMath under the Module One and Module Two transfers, in particular Annex I, Annex II and Annex III, the following details shall apply:

Data exporter:	Client, Contact details: as specified in an Order Form or SOW
Data exporter role:	Controller – as specified in the Processing Purposes Table.
Data importer:	MediaMath, Contact: DPO, Contact Details: 4 World Trade Center, New York, New York 10007, USA, +1 646-840-4200; privacy@mediamath.com
Data importer role:	Controller and Processor – as specified in the Processing Purposes Table.
Categories of data subjects:	Individuals who visit Client’s digital properties (websites or mobile advertising platforms) or are served with digital advertising on behalf of the data exporter through the use of MediaMath’s advertising technology platform.
Categories of data transferred:	As described in Column 3 of MediaMath’s processing purposes table https://www.mediamath.com/legal/processingpurposes/ (the “Processing Purposes Table”) (no special category or sensitive data).
Purposes of the transfer(s):	The activities undertaken by MediaMath on behalf of the Client are set out in column 4 and 5 of the Processing Purposes Table.
Frequency	Daily in response to Client site and impression events.
Retention	Retained in accordance with Client and MediaMath’s respective data retention policies.
Governing law and Competent Supervisory Authority:	The competent supervisory authority, in accordance with Clause 13 of the EU SCCs will be, for Data protected by the EU GDPR the Berlin Commissioner for Data Protection and Freedom of Information of the German Data Protection Authorities (German DPAs) and for Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner (FDPIC). With respect to UK data, the competent supervisory authority is the Information Commissioners Office (the “ICO”).
Technical and organisational security measures:	A description of the technical and organisational security measures implemented by the MediaMath are set out at https://www.mediamath.com/legal/terms/information-security/
Recipients and Subprocessors	MediaMath, its affiliates and its subprocessors engaged by the data importer to support its digital advertising services in accordance with Article 28 GDPR and its partners where necessary in connection with its digital advertising services. Additional subprocessors as listed at https://www.mediamath.com/legal/subprocessors/

 

5. The parties agree that for the purposes of transfers of MediaMath Data to Client under the Module One Model Clauses, in particular Annex I, Annex II and Annex III, the following details shall apply:

Data exporter:	MediaMath, Contact: DPO, Contact Details: 4 World Trade Center, New York, New York 10007, USA, +1 646-840-4200; privacy@mediamath.com
Data exporter role:	Controller – as specified in the Processing Purposes Table.
Data importer:	Client, Contact details: as specified in an Order Form or SOW
Data importer role:	Controller – as specified in the Processing Purposes Table.
Categories of data subjects:	Individuals who visit the digital properties (websites or mobile advertising platforms) of MediaMath’s clients or served ads through the data exporter’s advertising technology platform.
Categories of data transferred:	As described in Column 6 of the Processing Purposes Table (no sensitive or special category data).
Purposes of the transfer(s):	For Client to process the MediaMath Data as an independent controller for certain Client Controller Purposes as more particularly described in Column 7 of the Processing Purposes Table.
Frequency	Daily
Retention	Retained in accordance with Client and MediaMath’s respective data retention policies.
Competent Supervisory Authority:	The competent supervisory authority, in accordance with Clause 13 of the EU SCCs will be, for Data protected by the EU GDPR the Berlin Commissioner for Data Protection and Freedom of Information of the German Data Protection Authorities (German DPAs) and for Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner (FDPIC). With respect to UK data, the competent supervisory authority is the ICO.
Technical and organisational security measures:	Client’s processing of MediaMath Data shall take place in accordance with its privacy policy and shall be subject to appropriate technical and organisational security measures which provide protection equivalent to the MediaMath information security standards outlined at https://www.mediamath.com/legal/terms/information-security/
Recipients and Subprocessors	Client, its affiliates and its subprocessors engaged by the Client to support its digital advertising services in accordance with Article 28 GDPR and its partners where necessary in connection with its digital advertising services.

 

6. Model Clauses

In addition to the above, the parties agree that the Model Clauses for Module One and Module Two transfers will be interpreted as follows:

a) In Clause 7, the optional docking clause will apply;

b) in Clause 9, Option 2 will apply, and the time period for prior notice of sub-processor changes shall be 10 days;

c) in Clause 11, the optional language will not apply;

d) in Clause 17, Option 1 will apply, and the EU SCCs shall be governed by the laws of Berlin, Germany;

e) in Clause 18(b), disputes shall be resolved before the courts of Berlin, Germany;

f) For the purposes of Clause 8.5(a), (b) and (c), as well as Annex II of the EU SCCs, the parties agree to the security measures described in the relevant table above;

g) For the purposes Clause 8.6(a), as well as Annex II of the EU SCCs, the parties agree to the security provisions contained in the relevant table above.

h) For the purposes of Clause 8.5 (d), (e) and (f), where MediaMath is required by a respective clause in the EU SCCs or is otherwise legally compelled to notify the data subjects or the competent supervisory authority of a personal data breach, MediaMath will first provide Client with the details of the notification permitting Client to have prior written input into the respective notification, where Client desires to do, and without delaying the timing of the notification unduly.

 

7.  In relation to MediaMath Data or Client Data that is protected by the UK GDPR, the EU SCCs as implemented in accordance with Schedule A above shall apply as amended by the UK IDTA and interpreted in accordance with Annex 2 to Schedule A.

8. In relation to Data that is protected by the Swiss Federal Data Protection Act of 19 June 1992 and its corresponding ordinances (“Swiss DPA”), the EU SCCs as implemented in accordance with Schedule A above will apply provided that references in the EU SCCs to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA, references to “EU”, “Union” and “Member State law” shall be interpreted as references to Swiss law, and references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the relevant data protection authority and courts in Switzerland.

9.Transfer Impact Assessment between the EU and the UK to the USA. MediaMath are not subject to EO 12333, because EO12333 only applies to US federal agencies. However, like all businesses that provide computer processing services anywhere in the world and that are subject to the jurisdiction of the United States, MediaMath is subject to FISA Section 702, which the US government relies upon to access data related to national security issues without regard to the physical location of the data (for example, data stored in the EU is subject to disclosure under FISA Section 702). Although the US government in theory could seek access to data by serving a FISA warrant on MediaMath, the US government typically serves FISA warrants on telecommunications companies or providers of services or equipment designed specifically to facilitate communications (for example, AT&T, Verizon, Facebook, Twitter, etc.). To that point, MediaMath have never received a FISA warrant and does not anticipate being compelled to disclose any data pursuant to FISA Section 702. MediaMath hereby confirms that due to the nature and architecture of its Platform, it is not feasible to limit processing services to a data centre located in the EU. MediaMath will monitor updated guidance from data protection authorities and incorporate such guidance as appropriate into a robust privacy and security program that evolves with the changing legal and regulatory landscape.

10. The Model Clauses shall be treated as Confidential Information for the purposes of this Agreement, and may not be disclosed by MediaMath or Client to any third party except where and to the extent permitted by the Agreement. This shall not prevent disclosure of the Model Clauses to a data subject or a supervisory authority pursuant to the Model Clauses.

11. In the event that Client wishes to terminate the Model Clauses, then Client shall endeavour to provide notice to MediaMath and provide MediaMath with thirty (30) days to cure the non-compliance (“Cure Period”). If after the Cure Period, MediaMath has not or cannot cure the non-compliance, then Client may terminate the Agreement immediately in accordance with the termination provisions of this Agreement. Client shall not be required to provide such notice in circumstances where it considers there is a material risk of harm to data subjects or their personal data.

12. The audit provisions at section 4(d) of Schedule A (“Audit Provisions”), shall also govern audit rights under the Model Clauses. In the event that Client wishes to exercise its audit rights under the Model Clauses, provided that this section does not conflict with Clause 13(b) of the Model Clauses for Module One and Module Two, then the Audit Provisions will exclusively govern Clients’ and MediaMath’s obligations with respect to such audits

13. The sub-contracting provisions set out in Schedule A (“Sub-Contracting Provisions”), shall also govern subcontracting rights under the Model Clauses. In the event that MediaMath wishes to engage a sub-processor under the Model Clauses then, provided that MediaMath complies with the requirements of the Sub-Contracting Provisions, Client shall deem MediaMath to have complied with its sub-processing obligations of the Model Clauses.

14. MediaMath shall be deemed to have complied with the Model Clauses to the extent that it shall (on a confidential basis), if requested by Client, provide to Client all information it reasonably can in connection with any onward subprocessing agreement it concludes under the Model Clauses.

15. For the purposes of the Model Clauses, the parties acknowledge that Client Data may be archived by MediaMath on back-up systems for security and business continuity purposes. Deletion of such archived Client Data shall be in accordance with MediaMath’s standard archival procedures, provided that MediaMath warrants that it will guarantee the confidentiality of the relevant Client Data and will not actively process it anymore.

 

Annex 2 to Schedule A
Interpretation of UK IDTA

1. This Annex 2 sets out the parties agreed interpretation of the UK IDTA, and its amendments to the operation of the EU SCCs for transfers of personal data to and from the United Kingdom.
2. In the event that the UK Information Commissioner or courts of England and Wales determines that any provision of this Annex 2 conflicts with the requirements of the UK IDTA, then the terms of the UK IDTA shall prevail.
3. As between MediaMath and Client, any claims brought under the UK IDTA or Schedule A shall be subject to the terms of the Agreement, including but not limited to, the exclusions and limitations set forth in the Agreement. In no event shall either MediaMath or Client limit or exclude its liability with respect to any data subject rights under the UK IDTA.
4. The parties agree that for the purposes of Table 1 of the UK IDTA, the parties and their operation as either Controller or Processor shall be as set out in Annex 1.
5. The parties agree that for the purposes of Table 1 of the UK IDTA, the nominated contacts shall be:

a) For MediaMath, the Data Protection Officer with email address privacy@mediamath.com; and

b) For Client, as specified in an Order Form or SOW.

6. The parties agree that Table 2 of the UK IDTA shall be interpreted as set out in paragraphs 6(a) and 6(b) of Annex 1, and that personal data received from the Exporter may be combined with personal data collected by the Importer limited to the extent required for the provision of the Services and as further described at http://www.mediamath.com/legal/processingpurposes/.
7. The parties agree that for the purposes of Table 3 of the UK IDTA the “Appendix Information” shall be interpreted as set out in paragraphs 4 and 5 of Annex 1.
8. The parties agree that Part 2 “Mandatory Clauses” of the UK IDTA shall apply and that the “Alternative Mandatory Clauses” shall be disregarded.

Schedule B

DPA – US States Privacy Law Requirements

1. Definitions.

“Advertising Purposes” means all Restricted Purposes in addition to (i) activities that constitute Targeted Advertising or Cross-Context Behavioral Advertising under State Privacy Laws, including any processing that involves displaying ads to a Consumer that are selected based on the Consumer’s cross-context behaviors, (ii) creating or supplementing user profiles for such purposes.

“Applicable State Privacy Laws” means CCPA as amended and Applicable State Privacy Laws (EC).

“Applicable State Privacy Laws (EC)” means, as applicable, the (i) CAPDP; (ii) CPA; (iii) UCPA; or (iv) VCDPA, depending on which law applies pursuant to Section 3.1, but excluding the CPRA.

“Business/Third Party Purposes” means any use or processing of personal information by MediaMath for Advertising Purposes as a Business, or Third Party, as more particularly described at, www.mediamath.com/legal/CCPA/

“CCPA as amended” means the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”), and any statute, regulation, order, decree, or other legal requirement that is or has been enacted, promulgated, issued, or taken by any governmental entity, including judicial bodies, in connection with the same.

“CTDPA” means the Connecticut Act Concerning Personal Data Privacy and Online Monitoring of 2022 as changed, supplemented, amended, or replaced.

“Choice Mechanisms” means as applicable Choice Mechanism (EC) or Choice Mechanism (CCPA as amended).

“Choice Mechanism (EC)” means, with respect to a Consumer that Client determines is a resident of an applicable jurisdiction (EC), a clear and conspicuous method (e.g., a link) that enables the Consumer to Opt-Out of the Sale of Personal Information and Opt-Out of the Processing of Personal Information for the purpose of Targeted Advertising, and that complies with Applicable State Privacy Laws (EC).

“Choice Mechanisms (CCPA as amended)” means a “Do Not Sell or Share My Personal Information” link or alternate Opt-Out link that enables the Consumer to Opt-Out of both Selling and Sharing Personal Information, and that complies with CCPA as amended.

“CPA” means the Colorado Privacy Act and any regulations promulgated thereunder, as changed, supplemented, amended, or replaced.

“Impression Data” means data related to an impression delivered on a site for Client.

“Joint Service Provider” means a Service Provider jointly contractually engaged by a Client and one or more Businesses that jointly determine the purposes and means of the Processing of Personal Information to  Process Personal Data in a manner that requires combining Personal Data collected across such Businesses, such as for certain measurement activities or capping the frequency of ads shown to a Consumer across sites or services not owned or controlled by the same Business.

“MSPA” means the IAB Multi-State Privacy Agreement available at https://www.iabprivacy.com/mspa.html or any successor site.

“Opt Out” means a Consumer’s election (either directly or through the Consumer’s authorized representative) to opt out of the Sale or Sharing of such Consumer’s Personal Information as set forth in CCPA as amended.

“Opted-Out Impression Data” means Personal Information related to the delivery of an impression for Client on a Site for which the Consumer for which the Consumer has exercised an Opt-Out.

“Publisher” means the owner of a digital property where an impression is served an advertisement.

“Restricted Processing Purposes” means advertising-related Processing that qualifies as a Business Purpose, including Processing for purposes of auditing; security and integrity; debugging; short term, transient uses; analytics; providing advertising or marketing services that do not include Cross-Contextual Behavioral Advertising, Targeted Advertising, or profiling; internal research; and efforts to improve quality and safety.  Restricted Processing Purposes includes first-party advertising, contextual advertising, frequency capping, measurement, fraud detection and prevention, and ensuring and measuring viewability, each only to the extent such activity (i) is permissible for a Processor to perform under the applicable State Privacy Laws; and (ii) does not result in a Sale or Sharing of Personal Data or constitute Processing of Personal Data for Targeted Advertising purposes and includes any use or processing of personal information by MediaMath as (1) a Processor under Applicable State Privacy Laws (EC) as more particularly described at  www.mediamath.com/legal/processingpurposes; (2) or as a Service Provider or Joint Service Provider under CCPA as amended each as more particularly described at, www.mediamath.com/legal/CCPA/

“UCPA” means the Utah Consumer Privacy Act of 2022 and any regulations promulgated thereunder, as changed, supplemented, amended, or replaced.

“VCDPA” means the Virginia Consumer Data Protection Act and any regulations promulgated thereunder, as changed, supplemented, amended, or replaced.

References in this Schedule B to “Business”, “Business Purpose” “Consumer”, “Controller”, “Cross-Contextual Behavioral Advertising”, “Personal Data”, “Personal Information”, “Processor”, “Sell”, “Share”, “Service Provider”, “Targeted Advertising” and “Third Party” shall have the meanings given in Applicable State Privacy Laws.

2. Scope.  The rights and obligations in this Schedule B take effect on the Applicable State Privacy Laws’ effective and/or enforcement dates and apply to the collection, processing, disclosure and sale and/or sharing of Personal Information from Consumers by and between MediaMath, Client and certain Third Parties.  For the purposes of this Schedule B, references under the Agreement to “disclosures to Users required by Applicable Law”, or otherwise similar disclosure requirements, shall mean applicable Choice Mechanisms, as defined above.
3. Obligations of Client.

(a) Disclosure and Notice. Client shall comply with the minimum notice requirements required under Applicable State Privacy Laws.   Client shall not collect categories of Personal Information other than those disclosed in its notice at collection.  If Client sells to, or shares with, MediaMath any Personal Information, Client shall provide  explicit notice to such Consumer  using plain language describing  (i) the categories of parties to which Client sells or shares Personal Information and that such categories of parties may re-sell or re-share it for the purpose of delivering Ads tailored to such Consumer’s interests; and (ii) that the Consumer has the right to Opt Out of the re-sale or re-sharing of the Consumer’s Personal Information via a California Consumer Choice Mechanism.

(b) Choice Mechanisms: Client shall include a Choice Mechanism on the Client Sites to the extent required by Applicable State Privacy Laws.  In addition, Client may provide the Consumer a means to provide an Opt-Out override.

4. MediaMath as Business or Third Party. Where MediaMath processes Client Data solely as a Third Party (a) Client makes the Client Data that is  Personal Information available to MediaMath only for the limited and specified purposes set forth in this Agreement, (b) MediaMath may use the Client Data solely for the Business/Third Party Purposes in accordance with the license of Client Data to MediaMath under the Agreement (c) MediaMath will provide the same level of privacy protection as required of a Business by the CCPA as amended, (d) Client has the right to take reasonable and appropriate steps to ensure that MediaMath uses Client Data in a manner consistent with the Client’s obligations under the CCPA as amended, (e) Client has the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of the Client Data, and (f) MediaMath will notify Client if it can no longer meet its obligations under the CCPA as amended.
5. MediaMath as Service Provider. (a) When a Consumer has exercised an Opt Out with Client, any Client Data that is Personal Information will not be used, disclosed, or retained by MediaMath for any purposes other than (i) processing the request to opt-out of the sale/sharing, and (ii) processing the Client Data as a Service Provider subject to the Restricted Data Processing Purposes. (b) As a Service Provider MediaMath shall not: (i) sell and/or share such Personal Information; (ii) retain, use or disclose such Personal Information for any purpose other than for the Restricted Data Processing Purposes; (iii) retain, use or disclose such Personal Information outside of the direct business relationship between the parties; or (iv) combine the Client Data with Personal Information that it receives from or on behalf of another person or persons, or collects from MediaMath’s own interaction with the Consumer, provided that MediaMath may combine Personal Information to the extent it is designated as a Joint Service Provider under this Agreement. (c) Client acknowledges that this shall not preclude MediaMath from disclosing Client Data to another Service Provider (i) of Client on Client’s behalf or (ii) of MediaMath in connection with performing the Services for Client, and that any such disclosure shall be within the direct business relationship between MediaMath and Client. (d) MediaMath hereby certifies that it understands its obligations under this Section 5 and will comply with them.
6. MediaMath as Processor under Applicable State Privacy Laws (EC). The parties acknowledge that for certain Restricted Processing Purposes subject to Applicable State Privacy Laws (EC), Client is the Controller of Client Data and appoints MediaMath as its Processor for the processing purposes as set out at www.mediamath.com/legal/processingpurposes. The provisions of the Agreement and Schedule A relating to Client’s obligations as a Controller, and MediaMath’s obligations as a Processor shall apply.
7. Audit. The audit provisions at Section 4(d) of Schedule A, shall also govern audit rights under this Schedule B and if required under Applicable State Laws.
8. Impression Data. Where Client receives any Opted-Out Impression Data from MediaMath where MediaMath acts as a Business or Third Party, Client hereby appoints MediaMath as a Joint Service Provider subject to the following:

(a) Client is a direct signatory to MSPA.  Client will (i) promptly notify MediaMath in writing (email sufficient) when Client signs up and registers as a participant to the MSPA, and (ii) the Opted-Out Impression Data will be treated as a Covered Transaction (as defined under the MSPA) by MediaMath acting as a Joint Service Provider under the terms of the MSPA. Client will also notify MediaMath if Client subsequently terminates its registration as a participant in the MSPA in which case Section 8 (b) below will apply.

(b) Client is not a direct signatory to MSPA.   Subject to Publishers, SSPs and other supply side, measurement and data partners being signatories to the MSPA, where Client receives any Opted Out-Impression Data that is subject to the MSPA and Client is not a direct signatory to MSPA, Client hereby acknowledges that MediaMath is limited solely to processing data as a Service Provider to Client for Restricted Data Processing Purposes.