Data Processing Agreement

1. Scope and Purpose

This Data Processing Agreement ("DPA") is entered into between YieldMaximizer, Inc. ("YieldMaximizer," "we," "us," or the "Processor") and the client entity that uses our advertising services (the "Client" or the "Controller"). It forms part of, and supplements, the agreement between the parties governing those services, together with any order forms, statements of work, or supplemental terms (the "Principal Agreement"). Capitalized terms not defined in this DPA have the meanings given to them in the Principal Agreement.

This DPA applies where YieldMaximizer processes personal data on behalf of Client. For that processing, Client is the controller (or a processor acting on its own controller's behalf) and YieldMaximizer is the processor. The DPA is written to satisfy the requirements of Article 28 of the General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and, to the extent it applies, the California Consumer Privacy Act as amended (CCPA).

Certain processing that YieldMaximizer carries out for its own purposes as an independent controller, such as fraud detection across our platform, security and abuse prevention, service improvement, and compliance with legal obligations, is governed by our Privacy Policy rather than by this DPA. Our GDPR roles and commitments as a controller are described on our GDPR Compliance & Consent Management page.

2. Definitions

In this DPA, the following terms have the meanings set out below. Terms drawn from the GDPR have the same meaning in this DPA wherever the UK GDPR or the Swiss FADP applies an equivalent concept.

3. Data Processing Obligations

Reflecting Article 28(3) of the GDPR, YieldMaximizer undertakes, with respect to personal data processed under this DPA, to:

• Process the personal data only on Client's documented instructions, including with regard to transfers to a third country, and to notify Client without undue delay if an instruction appears to infringe applicable data protection law.
• Ensure that personnel authorized to process the personal data have committed themselves to confidentiality and are appropriately trained.
• Take the technical and organizational security measures described in Section 5.
• Assist Client in responding to data subject requests as described in Section 7.
• Assist Client with data protection impact assessments and prior consultations as described in Section 9.
• Delete or return the personal data at the end of the services, at Client's choice, as described in Section 12.
• Make available the information and permit the audits necessary to demonstrate compliance, as described in Section 11.
• Engage Sub-Processors only in accordance with Section 6.

4. Processing Instructions

Client's documented instructions under this DPA are as follows.

Subject Matter

The subject matter of the processing is the provision of YieldMaximizer's advertising services to Client under the Principal Agreement, including ad serving, participation in header bidding and real-time bidding, campaign analytics and measurement, and invalid traffic and fraud detection performed for Client.

Duration

The processing continues for the term of the Principal Agreement, plus the period reasonably needed to return or delete personal data in accordance with Section 12.

Nature and Purpose

The processing consists of the delivery and rendering of advertising for Client campaigns, the measurement and reporting of campaign performance, the prevention of fraud and invalid traffic affecting those campaigns, and associated support activities.

Categories of Data Subjects

The data subjects are the end users of Client's websites, applications, and media properties, including visitors to those properties and the audiences reached by Client campaigns.

Categories of Personal Data

If YieldMaximizer determines that an instruction from Client infringes applicable data protection law, we will promptly notify Client. We may suspend the affected instruction or processing until the instruction is confirmed, changed, or withdrawn, or until we are required to act by applicable law.

5. Security Measures

YieldMaximizer maintains technical and organizational measures designed to provide a level of security appropriate to the risk, in line with Article 32 of the GDPR. Current measures include:

• Pseudonymization of identifiers and encryption of personal data in transit over public networks and at rest.
• Resilience measures, regular backups, and tested procedures to restore access to personal data after a physical or technical incident.
• Multi-factor authentication and role-based access controls for administrative and operational access.
• Firewalls, network segmentation, and intrusion detection and prevention systems.
• Regular vulnerability scanning and periodic penetration testing, with remediation tracked to closure.
• Security awareness training for personnel with access to personal data.
• Physical and environmental security at facilities that host personal data.
• An incident response plan covering detection, containment, investigation, and notification.
• Logging and monitoring of systems that process personal data.

We may update or replace these measures to address new risks or improved practices, provided that any replacement does not result in a material reduction in the overall level of protection.

6. Sub-Processors

Client generally authorizes YieldMaximizer to engage Sub-Processors that are approved as of the effective date of this DPA. We make the current list of Sub-Processors available to Client on request. The following terms apply to changes and to our responsibility:

• We give Client at least 30 days' prior written notice before authorizing a new Sub-Processor, during which Client may object on reasonable data protection grounds.
• If Client objects and the parties cannot reach a resolution within a reasonable period, Client may terminate the affected part of the services, or the Principal Agreement as it relates to those services, without penalty.
• Each Sub-Processor is bound by written data protection obligations that are, in substance, no less protective than this DPA.
• YieldMaximizer remains fully liable to Client for the performance of each Sub-Processor's data protection obligations.

7. Data Subject Rights

YieldMaximizer cooperates with Client in handling requests and communications from Data Subjects as follows:

• If we receive a request, complaint, or other communication from a Data Subject that relates to personal data we process for Client, we notify Client promptly, and in any event without undue delay, unless prohibited by law.
• We do not respond directly to the Data Subject unless Client instructs us to do so or applicable law requires it.
• We provide reasonable cooperation and assistance so that Client can fulfill its obligations toward Data Subjects, including through technical measures such as identifier lookup and suppression where they are available and permitted.

8. Data Breach Notification

YieldMaximizer notifies Client without undue delay after becoming aware of a Personal Data Breach affecting personal data processed for Client. The notification includes, to the extent known at the time:

• The nature of the breach, including where possible the categories and approximate numbers of Data Subjects and personal data records concerned.
• Our Data Protection Officer as the contact point for further information.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its possible adverse effects.

We provide follow-up information as it becomes available. Notification under this Section is not an acknowledgment of fault or an admission of liability by YieldMaximizer. We also document each breach as required by Article 33(5) of the GDPR and assist Client with any notifications Client must make to Supervisory Authorities or Data Subjects.

9. Data Protection Impact Assessments

YieldMaximizer provides reasonable assistance to Client with data protection impact assessments under Article 35 of the GDPR and with prior consultations with Supervisory Authorities under Article 36, to the extent the assistance relates to our processing and the information available to us is sufficient. This assistance can include descriptions of our processing operations, a summary of the security measures in Section 5, an overview of our Sub-Processing chain, and the data flows relevant to Client's assessment.

10. International Data Transfers

YieldMaximizer does not transfer personal data processed under this DPA out of the European Economic Area, the United Kingdom, or Switzerland, and does not give a third party located in another country access to it, unless a valid transfer safeguard under Chapter V of the GDPR applies. The safeguards we rely on include:

• The SCCs, including, where appropriate, the module for processor-to-processor transfers.
• Coverage by the EU-U.S. Data Privacy Framework, the UK Extension, or the Swiss-U.S. Data Privacy Framework, where the recipient participates and the Framework applies to the transfer.
• An adequacy decision that covers the recipient country.
• Binding corporate rules that have been approved for the recipient group.

The SCCs are incorporated into this DPA by reference for transfers that rely on them, with the selections, annexes, and party details set out in the order documentation or as otherwise notified to Client in writing.

11. Audit Rights

Client may verify YieldMaximizer's compliance with this DPA in the following way:

• We maintain and make available current third-party certifications and audit reports, such as a SOC 2 Type II report, which may satisfy Client's verification obligations without a separate audit.
• Where a further audit is reasonably necessary, Client may conduct one, or appoint an independent auditor to conduct one, on at least 30 days' prior written notice, during normal business hours, and no more than once in any 12-month period. Additional audits may be carried out following a Personal Data Breach or where required by a Supervisory Authority.
• Audits are at Client's cost unless they reveal a material breach of this DPA by YieldMaximizer, in which case we bear the reasonable cost of the audit.
• Audits must not compromise the security or confidentiality of personal data we process for other clients, and audit findings and reports are confidential information of both parties.

12. Data Deletion and Return

On termination or expiry of the Principal Agreement, or at any time on Client's documented instruction, YieldMaximizer will, at Client's choice:

• Return the personal data in a commonly used, machine-readable format and then delete existing copies; or
• Delete all personal data and existing copies.

We complete the return or deletion within 30 days of the triggering event or instruction and provide written certification of deletion on request. Where applicable law requires us to retain specific personal data, for example tax or accounting records, we retain only that data, isolate it from further processing, continue to protect it under this DPA, and delete it when the retention requirement expires.

13. Confidentiality

Personal data processed under this DPA is confidential information of Client. YieldMaximizer restricts access to personnel who need it to provide the services, and each such person is subject to confidentiality obligations that continue after their engagement ends. We do not disclose personal data to any third party except as permitted by the Principal Agreement, as required to provide the services in accordance with this DPA, or as required by law.

14. Liability

Each party's liability arising out of or relating to this DPA, including the processing it governs, is subject to the limitations and exclusions of liability in the Principal Agreement. Nothing in this DPA limits or excludes any liability to Data Subjects, or any other liability, that cannot be limited or excluded under applicable law.

15. Term and Termination

This DPA takes effect on the effective date of the Principal Agreement and continues for as long as YieldMaximizer processes personal data for Client, including any period needed to return or delete personal data under Section 12. It terminates when the Principal Agreement terminates, subject to that section.

The obligations in this DPA relating to data deletion and return, confidentiality, and security survive termination. Where personal data is retained under the legal retention exception in Section 12, the obligations relating to transfers, audits, and breach notification continue to apply to that retained data for as long as it is retained.

16. CCPA Service Provider Addendum

To the extent the CCPA applies to processing under this DPA, YieldMaximizer acts as a service provider processing personal information on Client's behalf, and we certify that we understand the following restrictions and will comply with them:

• We will not sell or share personal information, as those terms are defined in the CCPA.
• We will not retain, use, or disclose personal information for any purpose other than the specified business purposes described in Section 4, or for any other commercial purpose, other than providing the services permitted for a service provider under the CCPA.
• We will not retain, use, or disclose personal information outside of the direct business relationship between Client and YieldMaximizer.
• We will not combine personal information that we receive from or on behalf of Client with personal information from other sources, except as permitted by the CCPA and its regulations for service providers.
• We will notify Client if we determine that we can no longer meet our obligations under the CCPA, and Client may, after providing notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of personal information.

17. Contact Information

For questions about this DPA, its application to your data, or our data protection program:

Our Offices

• San Francisco (Headquarters): YieldMaximizer, Inc., 517 California Street, Suite 4800, San Francisco, CA 94104, USA
• New York: 374 Park Avenue, Suite 2607, New York, NY 10152, USA
• London: 22 Bishopsgate, Level 34, London EC2N 4BQ, United Kingdom
• Singapore: Marina Bay Financial Centre, 8 Marina Boulevard, #05-02, Singapore 018981