THIS DATA PROCESSING AGREEMENT (“DPA”) forms part of the Platform Provider Agreement (“Agreement”) between Xapads Media Pvt Ltd or any other entity that directly or indirectly controls, is controlled by, or is under common control with Xapads Media Pvt Ltd.(“Xapads”), and Publisher (collectively the “Parties”) where by Xapads will use commercially reasonable efforts to provide its digital advertising services to Publisher (the “Services”). This DPA reflects the Parties’ responsibilities and obligations with respect to the terms governing the processing of Personal Data during the performance of the Agreement. This DPA is incorporated into to the Agreement and is subject to its terms and conditions. In the event of any conflict between the terms of the Agreement and the terms of this DPA, the relevant terms of this DPA shall take precedence. This DPA shall be effective for the Services Period established under the Agreement. Any capitalized terms not defined here in shall have the respective meanings given to them in the Agreement.
Data Controller means the entity that determines the purposes and means of the Processing of Personal Data.
Data Processor means the entity which Processes Personal Data on behalf of the Data Controller.
Data Protection Laws means all laws and regulations, including laws and regulations of the European Union,
applicable to the Processing of Personal Data under the Agreement.
Data Subject means the individual to whom Personal Data relates.
Personal Data means any information relating to an identified or identifiable person. The types of Personal Data and categories of Data Subjects Processed under this DPA include but are not limited to the following: IP addresses, location data, interest segments, device data, retargeting data, advertising data, browser generated data, and online identifiers of the end users of digital properties.
Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction (“Process”, “Processes” and “Processed” shall have the same meaning).
Security Breach has the meaning set forth in Section 7 of this DPA.
Sub-processor means any entity engaged by Xapads to Process Personal Data in connection with the Services.
TOMs, or Technical and Organizational Measures, as defined in Article 32 of the General Data Protection Regulation (GDPR).
2.1 Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Publisher is the Controller and Xapads is the Data Processor.
2.2 Publisher’s Processing of Personal Data. Publisher shall, in its use of the Services and provision of instructions, Process Personal Data in accordance with the requirements of applicable Data Protection Law. Publisher shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Publisher acquired Personal Data. If Xapads believes or becomes aware that any of Publisher’s instructions conflicts with any Data Protection Laws, Xapads shall inform Publisher. Publisher shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Publisher obtained the Personal Data.
2.3 Xapads Processing of Personal Data. As Publisher’s Processor, Xapads shall only Process Personal Data for the following purposes: (i) Processing required to provide the Services in accordance with the Agreement; and (ii) Processing to comply with other reasonable instructions provided by Publisher that are consistent with the terms of the Agreement. Xapads acts on behalf of and on the instructions of Publisher in carrying out all Processor responsibilities. Xapads shall process Personal Data in accordance with the requirements of the Data Protection Laws and Publisher will ensure that its instructions for the Processing of Personal Data shall comply with the Data Protection Laws.
2.4 Appointment of Sub-processors. The Parties agree and acknowledge that sub-processors may be retained in the provision of the Services. A current list of all sub-processors is listed at “Sub Processors” . In addition, Publisher agrees that Xapads may engage new third-party sub-processors, from time to time, in connection with the provision of the Services provided that Publisher will be given prior notice and an opportunity to object to the appointment. To the extent that Publisher objects to a proposed appointment, Xapads will use reasonable efforts to provide the Publisher with opportunity of excluding such Sub-processor from the Publishers data. In addition, as a condition to permitting a third-party sub-processor to Process Personal Data, sub-processor shall (a) agree in writing to process Data in accordance with documented instructions; (b) implement appropriate TOMs to protect the Data against a Security Breach; (c) otherwise provide sufficient guarantees that they will process the Data in a manner that will meet the requirements of Data Protection Laws. Publisher may request a list of active sub-processors at any time for auditing purposes.
Data Subject Requests. Xapads shall, to the extent legally permitted and as may reasonably be expected, promptly notify Publisher if it receives any requests from a Data Subject to exercise the following Data Subject rights: access, rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, or to not be subject to an automated individual decision making (each, a “Data Subject Request”). To the
extent Publisher, in its use or receipt of the Services, does not have the ability to action on a Data Subject Request, as required by Data Protection Laws, Xapads shall promptly comply, if in a position to do so, with all reasonable requests by Publisher to facilitate such actions to the extent Xapads is legally permitted and reasonably able to do so. To the extent legally permitted, Publisher shall be responsible for any costs arising from Xapads’ provision of such assistance, including any fees associated with provision of additional functionality.
Xapads shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and are subject to obligations of confidentiality. Xapads shall ensure that access to Personal Data is limited to those personnel who require such access to fulfill its obligations under the Agreement.
5.1 Controls for the Protection of Customer Data. Xapads shall maintain appropriate TOMs for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Data), confidentiality and integrity of Customer Data. Xapads will not materially decrease the overall security of the Services during the term of the Agreement.
5.2 Third-Party Certifications and Audits. Xapads may from time to time obtain a third-party certification or audit to ensure that its privacy practices meet or exceed applicable Data Protection Laws. Upon Publisher’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Xapads shall make available to Publisher, verification of the most recent third-party audit or certification, as may be applicable.
Audit Request. Publisher may request an audit, up to once per year, of Xapads’s procedures relevant to the protection of Personal Data but only as required under applicable Data Protection Laws. Publisher shall reimburse Xapads for any time expended for any such audit. The amount of reimbursement shall be based on the personnel and time required to perform the audit. Before the commencement of any such on-site audit, Publisher and Xapads shall mutually agree upon the scope, timing, and duration of the audit, in addition to the reimbursement for which Publisher shall be responsible. Publisher shall promptly notify Xapads with information regarding any perceived noncompliance discovered during the course of an audit, and Xapads shall use commercially reasonable efforts to address any confirmed non-compliance.
7.1 Incident Management. If Xapads becomes aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to any Personal Data transmitted, stored or otherwise Processed on Xapads’s equipment or in Xapads’s facilities (“Security Breach”), Xapads will promptly: (i) notify Publisher of the Security Breach in accordance with Section 7.2 below; (ii) investigate the Security Breach and provide Publisher with all relevant information about the Security Breach; and (iii) take all steps to mitigate the effects and to minimize any damage resulting from the Security Breach. Xapads documents its Security Breach Management Plan within its TOMs, which Publisher may review subject to confidentiality considerations.
7.2 Notification. Xapads shall promptly provide notification of a Security Breach to Publisher’s designated contact:
Notification(s) of Security Breaches, if any, will be delivered to Publisher’s business, technical or administrative contacts by any means Xapads selects, including via email. It is Publisher’s sole responsibility to ensure it maintains accurate contact information with Xapads’s at all times.
Upon termination of the Services for which Xapads is Processing Personal Data, Xapads shall, upon Publisher’s request, and subject to the limitations described in the Agreement, return all Publisher Data and copies of such data to Publisher or securely destroy them and demonstrate to the satisfaction of Publisher that it has taken such measures, unless applicable law prevents it from returning or destroying all or part of the Customer Data. In addition, upon the termination of Services, Publisher agrees to immediately remove all Xapads tags (including applicable code). To the extent that Publisher fails to immediately remove this information as requested, Publisher shall be legally liable for any and all damages that may or might occur as a result of their inaction.
Each party’s liability, taken together in the aggregate, arising out of or related to this DPA, including DPAs associated with Sub-processors, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs combined.
Except as otherwise required by law, Xapads will promptly notify Publisher of any subpoena, judicial, administrative or arbitral order of an executive or administrative agency, regulatory agency, or other governmental authority (“Demand”) that it receives, and which relates to the Processing of Personal Data. At Publisher’s request, Xapads will provide Publisher with reasonable information in its possession that may be responsive to the Demand and any assistance reasonably required for Publisher to respond to the Demand in a timely manner. Publisher acknowledges that Xapads has no responsibility to interact directly with the entity making the Demand.
Xapads shall maintain administrative, physical and technical safeguards designed for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data), confidentiality and integrity of Personal Data, in accordance with best practices.
Nothing in this DPA shall confer any benefits or rights on any person or entity other than the parties to this DPA.
Xapads and Publisher mutually represent and warrant that (i) the person executing this DPA on its respective behalf has the legal authority to bind such party, and (ii) it has right, power, and authority to (a) enter into this DPA, (b) make the representations and warranties contained herein, and (c) commit to and perform the respective duties, obligations and covenants set forth hereunder. Without limiting the foregoing, the choice of law and venue clause section clause of the Master Agreement will apply to any disputes arising out this DPA.
Entire Agreement; Amendment; Severability. This Agreement constitutes the entire Agreement between the parties with respect to the subject matter of this Agreement. This Agreement supersedes all previous agreements between the parties relating to the subject matter hereof. No provision of this Agreement will be deemed waived, amended or modified by either party, unless such waiver, amendment or modification is made in writing and signed by both parties. If any provision of this Agreement is invalid or unenforceable for any reason in any jurisdiction, including but not limited to a change in law(s), such provision will be construed to have been adjusted to the minimum extent necessary to cure such invalidity or unenforceability. If any provision of this Agreement is found by a proper authority to be unenforceable or invalid, such unenforceability or invalidity will not render this Agreement unenforceable or invalid as a whole and such provision will be changed and interpreted so as to best accomplish the objectives of such unenforceable or invalid provision within the limits of applicable law or applicable court decisions.
