ROKT® UK and European Data Processing Agreement for Advertisers on IAB Terms
This UK and European Data Processing Agreement (“DPA”) is effective as of the date Agency and Media Company execute an IO that incorporates the Standard Terms and Conditions for Internet Advertising for Media Buys One Year or Less, Version 3.0 (“Terms”). Agency, on behalf of Advertiser, agrees to be bound by this DPA. All capitalized terms not defined herein shall have the meaning ascribed to them in the Terms, and the following terms shall have the meaning given to them under European Privacy Law or UK Privacy Law (as appropriate): “controller”, “processor”, “personal data”, “data subject” and “processing”.
1. Background
In connection with Media Company’s provision of Deliverables under an IO, Media Company will have access to and process certain personal data on Advertiser’s behalf (“Advertiser Personal Data”) and will collect and process Media Company Data. The Advertiser Personal Data is described in Annex A to this DPA. Each party shall comply with its obligations under this DPA with respect to the European Personal Data that it processes and according to its responsibilities as a controller, joint controller or processor (as appropriate) for the relevant European Personal Data. In particular: (i) Media Company shall be a “controller” of Media Company Data; (ii) Advertiser shall be a “controller” of Media Company Data to the extent only that Advertiser (or Agency on Advertiser’s behalf) receives such Media Company Data in connection with the Deliverables; (iii) Advertiser shall be a “controller” of Advertiser Personal Data; and (iv) Media Company shall be a “processor” of Advertiser Personal Data to the extent only that Media Company receives such Advertiser Personal Data in connection with the Deliverables. If any party would have a different role with respect to any Media Company Data or Advertiser Personal Data under European Privacy Law or UK Privacy Law according to the way in which it makes use of such data, then that party will comply with the relevant obligations under this DPA according to that role.
Agency enters into this DPA as agent for Advertiser. Any instructions, notices, requests, objections, elections or audit rights of Advertiser under this DPA may be given or exercised by Agency on Advertiser’s behalf, and any notice or information that Media Company provides to Agency under this DPA shall be deemed provided to Advertiser.
2. Security
Each party shall implement appropriate technical and organisational measures to protect the European Personal Data from: (i) accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to, the European Personal Data (a “Security Incident”). Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons and, in the case of Media Company, shall include the security measures described in Annex B (Minimum Security Measures) to this DPA.
3. Controller obligations
3.1. Whenever a party is acting in a capacity as a “controller” in relation to European Personal Data, it shall comply in all respects with European Privacy Law and UK Privacy Law (as appropriate), including by processing such European Personal Data fairly and lawfully. Without limiting the foregoing, the controller shall obtain all consents as required under European Privacy Law and UK Privacy Law in relation to the personal data processing contemplated by the Terms and this DPA. The other party shall be entitled to periodically audit or obtain adequate assurances of the controller’s compliance with these compliance obligations.
3.2. A controller shall provide assistance reasonably requested by the other party (and at that other party’s cost) in order for that other party to comply with European Privacy Law and UK Privacy Law (as appropriate), including with respect to data subject access requests and privacy notices.
3.3. The parties agree that they do not intend to act as “joint controllers” with respect to any European Personal Data. However, if and to the extent that the parties are acting as joint controllers with each other in relation to any European Personal Data, they shall each provide all assistance reasonably required by the other party in order for that other party to comply with its obligations under European Privacy Law and UK Privacy Law (as appropriate), including with respect to data subject access requests, and cooperate to ensure that each data subject is given any notices that are required under European Privacy Law or UK Privacy Law (as appropriate) with respect to the processing that each of the parties undertakes.
3.4. Advertiser represents and warrants that it is authorised to disclose the Advertiser Personal Data to Media Company (directly or through Agency) in accordance with its own privacy notice and European Privacy Law and UK Privacy Law (as appropriate), and that it has a lawful basis for, and has obtained any consents required for, such disclosure and for the processing of the Advertiser Personal Data by Media Company as contemplated by this DPA.
4. Processor obligations
Whenever Media Company is acting in a capacity as a “processor” of Advertiser Personal Data on behalf of Advertiser, the following provisions shall apply:
4.1. Purpose limitation: Media Company shall process the Advertiser Personal Data as necessary to provide the Deliverables under the IO, for such other purposes as may be described in this DPA (including Annex A) and strictly in accordance with Advertiser’s documented instructions (which may be given by Agency on Advertiser’s behalf) (the “Permitted Purpose”), except where otherwise required by any applicable law. Media Company shall immediately inform Agency if, in its opinion, an instruction infringes European Privacy Law or UK Privacy Law (as appropriate).
4.2. Confidentiality of processing: Media Company shall ensure that any person that it authorises to process the Advertiser Personal Data (including Media Company’s staff, agents and subcontractors) (an “Authorised Person”) shall be subject to a strict duty of confidentiality (whether a contractual duty or a statutory duty), and shall not permit any person to process the Advertiser Personal Data who is not under such a duty of confidentiality.
4.3. Subprocessing: Media Company may subcontract its processing of the Advertiser Personal Data to a third party subprocessor without the prior written consent of Agency or Advertiser. Media Company shall, however, inform Agency when it adds to or removes sub-processors (which may be done via a website link notified to Agency) in order to give Advertiser (through Agency) the opportunity to object to the appointment of the subprocessor. If Agency, on behalf of Advertiser, makes such an objection, then Agency may elect to suspend or cancel the affected IO without penalty. Notwithstanding anything to the contrary in the foregoing, Agency, on behalf of Advertiser, consents to and authorises Media Company to use the subprocessors listed at https://rokt.com/rokt-subprocessors/ in its provision of the Deliverables and performance under the Terms.
4.4. Cooperation and data subjects’ rights: Media Company shall provide all reasonable and timely assistance (including by appropriate technical and organisational measures) to Advertiser (and to Agency on Advertiser’s behalf) to enable Advertiser to respond to: (i) any request from a data subject to exercise any of its rights under European Privacy Law or UK Privacy Law (as appropriate); and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Advertiser Personal Data. In the event that any such request, correspondence, enquiry or complaint is made directly to Media Company, Media Company will inform Agency of same.
4.5. Data Protection Impact Assessment: If Media Company becomes aware that its processing of the Advertiser Personal Data is likely to result in a high risk to the data protection rights and freedoms of data subjects, it shall promptly inform Agency and provide Advertiser (or Agency on Advertiser’s behalf) with all such reasonable assistance as Advertiser may request in order to conduct a data protection impact assessment.
4.6. Security incidents: Upon becoming aware of a Security Incident affecting Advertiser Personal Data, Media Company shall inform Agency without undue delay and shall provide all such timely information and cooperation as Advertiser (or Agency on Advertiser’s behalf) may require in order for Advertiser to fulfil its data breach reporting obligations under (and in accordance with the timescales required by) European Privacy Law or UK Privacy Law (as appropriate).
4.7. Deletion or return of Advertiser Personal Data: Upon termination or expiry of the Terms, Media Company shall (at Advertiser’s election, which may be communicated by Agency) destroy or return to Advertiser or Agency all Advertiser Personal Data (including all copies of such Advertiser Personal Data) in its possession or control (including any Advertiser Personal Data subcontracted to a third party for processing), unless storage of such Advertiser Personal Data is required by Union or Member State law or the domestic law of the United Kingdom (as applicable).
4.8. Records: Where required by European Privacy Law or UK Privacy Law (as appropriate), Media Company shall maintain a record of all categories of processing activities carried out on behalf of Advertiser (“Processing Records”) and shall make available the Processing Records to Agency or Advertiser within five (5) working days following receipt of a request for such Processing Records.
4.9. Audit: Media Company shall permit Advertiser (or Agency on Advertiser’s behalf, or their appointed third party auditors) to audit Media Company’s compliance with this clause 4, and shall make available all information, systems and staff necessary to conduct such audit. Agency or Advertiser (as applicable) must give Media Company reasonable prior written notice of its intention to conduct any such audit, conduct the audit during normal business hours, and take all reasonable measures to prevent unnecessary disruption to Media Company’s operations. Agency and Advertiser will not together exercise audit rights more than once in any twelve (12) calendar month period, except (i) if and when required by instruction of a competent data protection authority; or (ii) where Advertiser reasonably believes that an audit is necessary due to a Security Incident suffered by Media Company.
5. International transfers
5.1. In the event that a transfer from one party to another involves a Restricted Transfer, then the Relevant Transfer Agreement shall be deemed entered into (and incorporated into this DPA by this reference) between the transferring Data Exporter and the Data Importer and shall be completed as follows:
- (a) where the transfer involves the processing of personal data subject to European Privacy Law between the Data Exporter as controller and the Data Importer as a separate and independent controller, the EU SCCs will be completed as follows:
- (i) Module One will apply;
- (ii) in clause 7, the optional docking clause will apply;
- (iii) in clause 11, the optional language will not apply;
- (iv) in clause 17 (Option 1), the EU SCCs will be governed by Irish law;
- (v) in clause 18(b), disputes shall be resolved before the courts of Ireland; and
- (vi) Annex I will be deemed completed with the information set out in Annex A to this DPA, and Annex II will be deemed completed with the security measures set out in Annex B to this DPA;
- (b) where the transfer involves the processing of personal data subject to UK Privacy Law between the Data Exporter as controller and the Data Importer as a separate and independent controller, the UK Addendum will be completed as follows:
- (i) the EU SCCs, completed as set out above in clause 5.1(a) of this DPA, shall apply and the EU SCCs shall be deemed amended as specified by Part 2 of the UK Addendum in respect of such transfer; and
- (ii) tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed with the information set out above at clause 5.1(a), in Annex A and in Annex B (as applicable), and table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting “neither party”;
- (c) where the transfer involves the processing of personal data subject to European Privacy Law between the Data Exporter as controller and the Data Importer as processor, the EU SCCs will be completed as follows:
- (i) Module Two will apply;
- (ii) in clause 7, the optional docking clause will not apply;
- (iii) in clause 9, Option 2 will apply, and the time period for prior notice of subprocessor changes shall be as set out in clause 4.3 of this DPA;
- (iv) in clause 11, the optional language will not apply;
- (v) in clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;
- (vi) in clause 18(b), disputes shall be resolved before the courts of Ireland; and
- (vii) Annex I will be deemed completed with the information set out in Annex A to this DPA, and Annex II will be deemed completed with the security measures set out in Annex B to this DPA; and
- (d) where the transfer involves the processing of personal data subject to UK Privacy Law between the Data Exporter as controller and the Data Importer as processor, the UK Addendum will be completed as follows:
- (i) the EU SCCs, completed as set out above in clause 5.1(c) of this DPA, shall apply and the EU SCCs shall be deemed amended as specified by Part 2 of the UK Addendum in respect of such transfer; and
- (ii) tables 1 to 3 in Part 1 of the UK Addendum shall be deemed completed with the information set out above at clause 5.1(c), in Annex A and in Annex B (as applicable), and table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting “Data Exporter”.
In the event that any provision of this DPA contradicts, directly or indirectly, the Relevant Transfer Agreement, the Relevant Transfer Agreement shall prevail.
5.2. Where any party receives any European Personal Data and subsequently wishes to undertake a Restricted Transfer, then that party shall ensure it has lawful grounds to do so under European Privacy Law or UK Privacy Law (as appropriate).
5.3. Each party agrees that if it wishes to participate in a Restricted Transfer of the European Personal Data, including to any of its Affiliates (whether as an importer or exporter), it may only do so where the Restricted Transfer is made in full compliance with European Privacy Law and/or UK Privacy Law (as applicable) and pursuant to the Relevant Transfer Agreement implemented between the relevant exporter and importer of the European Personal Data.
6. Definitions
In this DPA:
(i) “Data Exporter” means Media Company, Advertiser or Agency (as applicable) where it discloses European Personal Data to another of them in connection with the Terms or an IO;
(ii) “Data Importer” means Media Company, Advertiser or Agency (as applicable) where it receives European Personal Data from another of them in connection with the Terms or an IO;
(iii) “EU Adequacy Finding” means a decision by the European Commission under European Privacy Law in relation to a country, territory or international organisation or one or more specified sectors that ensures an adequate level of protection for personal data;
(iv) “European Personal Data” means Advertiser Personal Data and Media Company Data to the extent that: (a) Media Company, Agency or Advertiser is established in the European Economic Area or the United Kingdom; (b) such data contains personal data of individuals in the European Economic Area or the United Kingdom; or (c) European Privacy Law or UK Privacy Law otherwise applies to such data;
(v) “European Privacy Law” means the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”);
(vi) “Media Company Data” means: (a) all data or other information supplied by Media Company to Agency or Advertiser in relation to the Deliverables, an Ad or any campaign, end customer or customer, including Performance Data; and (b) Network Interactions;
(vii) “Network Interactions” means all datasets, analyses, and data that are captured, derived, or collected by Media Company in connection with: (a) an end customer’s engagement (e.g., an impression, click, or other desired action) with an Ad or other Media Company-powered offer presented on a Site or other digital property within Media Company’s network; (b) the subsequent outcomes of such engagement (e.g., aggregated conversion signals), and statistical insights from transaction events and audience signals, used for measurement, analytics, and network optimisation; and (c) site events captured during an end customer’s conversion path or otherwise in connection with the operation of Media Company’s technology on Advertiser’s website or application;
(viii) “Relevant Transfer Agreement” means: (a) in the case of a Restricted Transfer subject to European Privacy Law, the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Decision (EU) 2021/914, as amended, re-enacted, replaced or superseded from time to time (“EU SCCs”); and (b) in the case of a Restricted Transfer subject to UK Privacy Law, the standard contractual clauses or a form of international data transfer agreement for the transfer of personal data to third countries approved under the regulations in the United Kingdom, specifically the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner’s Office under s.119A(1) of the UK Data Protection Act 2018, as amended, re-enacted, replaced or superseded from time to time (“UK Addendum”);
(ix) “Restricted Transfer” means circumstances where a party transfers or processes European Personal Data: (a) that is subject to European Privacy Law in a territory or sector which is not subject to an EU Adequacy Finding; or (b) that is subject to UK Privacy Law in a territory or sector that is not subject to a UK Adequacy Finding;
(x) “UK Adequacy Finding” means any regulations made by the Secretary of State under Section 17A of the Data Protection Act 2018 that a country, territory, international organisation or sector ensures an adequate level of protection for personal data; and
(xi) “UK Privacy Law” means: (a) the EU General Data Protection Regulation (Regulation 2016/679) as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (b) the Data Protection Act 2018 [; and (c) the Privacy and Electronic Communications (EC Directive) Regulations 2003].
7. Relationship with the Terms
This DPA forms part of each IO between Agency and Media Company. In the event of any conflict or inconsistency between this DPA and the Terms or an IO with respect to the processing of European Personal Data, this DPA shall prevail to the extent of such conflict or inconsistency.
ANNEX A TO DPA
Data Processing Description
This Annex A forms part of the DPA and describes the processing that Media Company will perform on behalf of Advertiser with respect to Advertiser Personal Data.
ANNEX B TO DPA
Minimum Security Measures