Data Processing Agreement

1. Scope and purpose

This DPA applies where OnlyMedia, the Processor, processes personal data on behalf of a client, the Controller, to deliver the advertising services in the principal agreement: ad serving, the unified auction and real-time bidding, header bidding, reporting, fraud detection and brand safety. Where we act as an independent controller instead, for our own site, accounts, marketing or platform improvement, our Privacy Policy governs.

2. Definitions

Terms such as personal data, processing, controller, processor and data subject carry the meanings in the applicable Data Protection Laws: the GDPR, UK GDPR, Swiss FADP, the CCPA and CPRA, and other applicable privacy statutes. Subject matter and duration follow the principal agreement plus the deletion window in section 12. Data categories include online identifiers, IP addresses, device information, ad-interaction data, approximate geolocation and audience segments; data subjects are end users of the client's properties.

3. Data processing obligations

We process personal data only for the agreed services, keep records of processing, and do not use it for any other purpose. We never sell it, never pass it to third parties outside the roles this DPA defines, and never combine it across clients in a way the CCPA prohibits.

4. Processing instructions

We process on the client's documented instructions, which these terms and the principal agreement constitute, together with any additional written instructions agreed through the account channel. If we believe an instruction infringes Data Protection Laws, we will say so promptly before acting.

5. Security measures

Art. 32 measures in force: pseudonymisation of identifiers; encryption in transit with TLS and at rest for stored data; multi-factor and role-based access control; firewalls, network segmentation and intrusion detection; vulnerability scanning and penetration testing; employee training and confidentiality commitments; physical security for infrastructure; incident response with logging and monitoring. We may update measures as the platform evolves, provided protection is never materially reduced.

6. Sub-processors

Clients give general written authorisation to our sub-processors for hosting, storage, infrastructure, support and measurement. We maintain a current list, give thirty days' notice of additions, accept reasonable objections and work to resolve them, flow down equivalent obligations, and remain fully liable for sub-processor performance. Objections and the current list: [email protected].

7. Data subject rights

We notify the client promptly of any data subject request we receive and do not respond directly unless instructed. We provide commercially reasonable assistance, including technical capability, so the client can fulfil access, deletion, correction and objection requests within their own deadlines.

8. Data breach notification

After becoming aware of a personal data breach affecting client data we notify the client without undue delay, describing the nature and scope, the likely consequences, our Data Protection Officer contact and the remediation steps. We cooperate in the investigation. Notification is not an admission of fault or liability.

9. Data protection impact assessments

We provide reasonable assistance with Art. 35 and Art. 36 assessments and consultations, limited to the processing we perform, including descriptions of data flows, retention and safeguards.

10. International data transfers

No EEA, UK or Swiss personal data is transferred without Chapter V safeguards. Where transfers occur they rest on the EU Standard Contractual Clauses 2021/914, the UK International Data Transfer Addendum, Swiss-addendum terms, adequacy findings or other approved mechanisms, incorporated into this DPA by reference, with supplementary technical measures. A copy of the mechanism is available on request.

11. Audit rights

Clients may audit our relevant compliance once per twelve months on thirty days' notice, during business hours, subject to confidentiality and with the client bearing its own costs unless a material breach is found. Where authorities or a breach require more, we cooperate. We may satisfy audit requests through independent certifications or audit reports covering the same subject matter.

12. Data deletion and return

On termination the client chooses return in a machine-readable format or certified deletion of processor-role personal data, completed within thirty days, except where law requires retention, in which case protections continue until deletion is lawful.

13. Confidentiality

Personnel authorised to process personal data are bound by contractual or statutory confidentiality, and access is limited to those who need it to perform the services.

14. Liability

Liability under this DPA follows the limitations of the principal agreement. Nothing limits liability toward data subjects where the Data Protection Laws so provide.

15. Term and termination

This DPA runs for the life of the principal agreement. Deletion, confidentiality, security and audit provisions survive termination until completed.

16. CCPA service provider addendum

For California personal information we act as a service provider: no selling or sharing; no retention, use or disclosure outside the business purposes in the direct business relationship; no combining with data from other sources except as the CCPA permits; the same level of protection the CCPA requires; notice to the client if we can no longer meet our obligations; and cooperation with the client's own audit duties.

17. Contact information

Legal department and countersigned copies: [email protected]. Data Protection Officer: [email protected]. Privacy team: [email protected]. OnlyMedia, Attn: Legal Department, 420 W 19th, Cheyenne, WY 82001, United States.