This Privacy and Data Protection Addendum (“Addendum”) is incorporated into and is subject to the terms and conditions of the agreement (“Agreement”) entered into between BidMachine, Inc. (“BidMachine”) and the Demand Partner indicated in the Agreement (the “Company”) or the disclosing of personal data through Company’s use of the services provided by BidMachine in accordance with the Agreement (“Services”). This Addendum is effective as of the Agreement Effective Date. In this Addendum, both the BidMachine and the Company may be collectively referred to as the "Parties" or individually as a "Party".
To the extent you are using the Services, you shall be deemed to have accepted this Addendum upon acceptance or execution of the applicable Agreement.
1. DEFINITIONS
In addition to the terms defined in the Agreement and above, the following terms shall have the following meanings for the purposes of this Addendum:
a. “Affiliates” means with respect to a party, all entities which, directly or indirectly, control, are being controlled by, or are under common control with such party.
b. “BidMachine Privacy Policy” means the privacy policy available at BidMachine’s official website: https://bidmachine.io/home/privacy-policy/
c. “Data Protection Laws” means the relevant data protection, data security, data retention, and data privacy laws, rules and regulations to which the Personal Data are subject. With respect to EU Personal Data, “Data Protections Laws” shall include the EU General Data Protection Regulation 2016/679 (hereinafter “GDPR”).
d. “Ad Partners” any supply-side partner or demand-side partner involved to provide the Services.
e. "Shared Personal Data" means Personal Data that is processed by one Party, provided that such Party received such Personal Data from the other Party as part of their obligations under the Agreement. A Party is also considered to have "received" Personal Data from the other Party when is granted access to the Personal Data.
f. “Standard Contractual Clauses” means the Standard Contractual Clauses as annexed to Commission Implementing Decision (EU) 2021/914 (the "EU SCCs"). The Parties acknowledge that the provided link to access the current version of the EU SCCs may change or become unavailable in the future. In such cases, the Parties shall make reasonable efforts to identify and use an alternative official source or platform designated by the European Commission to access the applicable and up-to-date version of the EU SCCs.
For clarity, “Controller”, “Data Subject”, “Personal Data”, “Data Transfer”, “Data Breach”, “Processing” (and “Process”) and “Processor" shall have the meanings given in the GDPR.
2. ROLES. Company and BidMachine acknowledges that each party Processes the Shared Personal Data under or in connection with the Agreement as separate Data Controllers. Each Controller will individually determine the purposes and means of its Processing of the Shared Personal Data and is responsible for processing Shared Personal Data in accordance with applicable Data Protection Laws.
The Parties shall process the Shared Personal Data for the purposes described in the Agreement (or as otherwise agreed in writing by the Parties) (the “Permitted Purposes”).
3. COMPLIANCE WITH LAWS/LIABILITY. Each Party complies and will continue to comply with its obligations relating to the Shared Personal Data under applicable Data Protection Laws, including:
a. In its role as an independent Controller of the Shared Personal Data, each Party must apply an appropriate legal ground for processing the Shared Personal Data and, whenever necessary according to the Data Protection Laws, acquire all required permissions and consents from the relevant Data Subjects to lawfully authorize the Processing of Shared Personal Data.
b. Each Party is responsible for providing appropriate notices to Data Subjects in accordance with Data Protection Laws regarding the lawful Processing of the Shared Personal Data, in case of BidMachine, the BidMachine Privacy Policy. Company, in compliance with Data Protection Laws, must disclose its use of the Services and how BidMachine Processes Personal Data in its privacy policy.
c. Each Party must establish and uphold the necessary mechanisms to comply with Data Subject Rights as outlined by Data Protection Laws and respond to inquiries from competent data protection authorities, without prejudice to the obligations outlined in Section 6 of this Addendum.
d. Company is prohibited from disclosing Shared Personal Data to any third parties unless expressly permitted under the Agreement. Additionally, the Company must promptly delete the Shared Personal Data under the following circumstances: (i) when the Company does not win the bid for an impression associated with that Shared Personal Data, or (ii) after the Company provides an advertisement in response to an ad request related to that Shared Personal Data, whether directly or indirectly through a third-party ad server. Furthermore, the Company and any third party are prohibited from using the Shared Personal Data for profiling, tracking end users, mobile platforms, or publishers.
e. Neither Party may process the Shared Personal Data for any purpose other than what is specified in their respective privacy policies, unless such Processing is also authorized under Data Protection Laws.
f. Each Party must ensure that all employees or other authorized users involved in the Processing of the Shared Personal Data adhere to the terms of this Addendum.
g. Each Party must implement technical and organizational security measures to prevent accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access to the Shared Personal Data, as well as any other security incidents that qualify as a "personal data breach" under Data Protection Laws. This will include limiting access to the Shared Personal Data to those personnel who require such access only as necessary to fulfill such Party’s obligation under the Agreement.
h. Both Parties agree that any agreement with a subprocessor must comply with Data Protection Laws.
4. LIMITATION ON USE AND COMPLIANCE WITH LAWS AND REGULATIONS.
a. Each Party shall only use or otherwise process the Personal Data in accordance with thisAddendum and with all applicable Data Protection Laws. Each Party shall be individually and separately responsible for complying with the obligations under applicable Data Protection Laws that apply to it as independent Controller.
b. To the extent permitted under applicable Data Protection Laws, neither Party shall be liable (whether jointly or severally) for any compensation, damages, losses, fees, or costs resulting from the other party’s Processing of the Personal Data.
c. If either Party receives the Shared Personal Data of the other Party in hashed or otherwise obfuscated format intended to conceal the identities of DataSubjects to whom it relates, such Party shall: (i) not attempt to reverse engineer or otherwise try tore-identify Data Subjects to whom the de- identified Personal Data relates unless instructed to do so by the other Party or in the cases established by Data Protection Laws; and (ii) only share the Shared Personal Data in the format it received it from the other Party. If a Party does not receive the Shared Personal Data in de- identified format, but the other Party instructs the receiving Party to only share the Shared Personal Data in a de- identified format, the receiving Party shall ensure it is de-identified (in accordance with industry standards) before it is shared with third parties.
5. SECURITY INCIDENTS. Each party shall provide the other party prompt written notice, without undue delay and within the time frame required by Applicable Data Protection Laws, if the notifying party knows or suspects that a security incident has occurred with respect to the Personal Data within a reasonable time (72 hours). If a security incident affects both parties, the parties agree to coordinate with respect to any communications or notifications that are sent to the Data Subject regarding such security incident.
6. ASSISTANCE. Both Parties are obligated to promptly notify each other, unless prohibited by applicable Data Protection Law, of any received requests to exercise Data Subject rights related to the Shared Personal Data. These notifications should be made in accordance with the requirements of Data Protection Law, ensuring that the Parties are informed of any such requests without any unreasonable delay. Each Party will provide the other Party with all necessary assistance, in connection with such requests by Data Subjects.
In the event of a dispute or claim brought by a Data Subject or any regulatory authority concerning the Processing of Personal Data against either or both Parties, the Parties will inform each other about any such disputes or claims and will cooperate with a view to resolving them within a reasonable time.
7. AUDIT. Each Party will make available all information necessary to demonstrate their compliance with this Addendum and will permit and contribute to any data audits reasonably required by the other Party upon prior written request and advanced notice. The auditing party will not exercise its audit rights more than once in any twelve-month period, unless when required by a data protection authority or if the auditing party reasonably believes a further audit is necessary due to a Data Breach or other data protection grounds.
8. STANDARD CONTRACTUAL CLAUSES. The Parties agree to use the EU SCC as the adequacy mechanism supporting the Data Transfer and Processing of the Shared Personal Data, if the Processing of the Shared Personal Data is subject to EU Data Protection Law. For the purposes of the SCCs:
a. Module 1 (controller to controller) will apply;
b. the optional docking clause in Clause 7, will apply;
c. The optional language within clause 11(a) of the SCCs will not apply;
d. Option 1 of clause 17 will apply and the SCCs will be governed by the laws of Spain;
e. Pursuant to clause 18(b) of the SCCs, the Parties shall resolve disputes under the SCCs before the courts of Barcelona (Spain);
f. Annex 1 shall be deemed to incorporate the information in Exhibit A;
g. Annex II shall be deemed to incorporate the information in Exhibit B.
9. MISCELLANEOUS. Any alteration or modification of this Addendum is not valid unless made in of the provisions under Addendum will not affect the remaining provisions. Invalid provisions will be replaced to the extent possible by those valid provisions which achieve essentially the same objectives. BidMachine acknowledges that Company and/or its Affiliates may disclose this Addendum and any relevant privacy provisions in the Agreement to any supervisory authority, regulator or other competent authority, to the extent required by applicable law. Such disclosure will not constitute breach of Company’s confidentiality obligation under the Agreement.
Each Party mutually represent and warrant that (i) the person executing this Addendum on its respective behalf has the legal authority to bind such party, and (ii) it has right, power, and authority to (a) enter into this Addendum, (b) make the representations and warranties contained herein, and (c) commit to and perform the respective duties, obligations and covenants set forth hereunder.
This Addendum shall be incorporated into and form part of the Agreement. In case of any conflict between a provision of the Addendum and the Agreement, as it relates to Personal Data, the provision of the Addendum shall prevail. Capitalized terms used herein and not defined herein will have the meaning set forth in the Agreement and/or the applicable Data Protection Laws.
Signature and date: Deemed signed and effective as of the date set forth in the Agreement.
Data Exporter: BidMachine, Inc
Address: 1640 Boro Place, 4th Floor McLean, Virginia 22102, USA
Emails: dpo@bidmachine.io
Role: Controller
Data Importer: Company (As specified in the Agreement)
Role: Controller
Activities relevant to the data transferred under the Addendum and the EU SCC
The Services as set out in the Agreemen
Data subjects
The personal data transferred concern the following categories of data subjects:
For the Advertising Service:
Purposes of the transfer(s)
The transfer is made for the following purposes:
For the Advertising Service:
Categories of data
The personal data transferred concern the following categories of data:
For the Advertising Service:
For the Website :
Recipients
The personal data transferred may be disclosed only to the following recipients or categories of recipients:
Sensitive data (if appropriate)
The personal data transferred concern the following categories of sensitive data:
Additional useful information (storage limits and other relevant information)
The transfer is made for the following purposes:
Identify the competent supervisory authority/ies in accordance with Clause 13
AEPD (Agencia Española de Protección de Datos)
Exhibit B - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE SHARED PERSONAL DATA
The technical and organizational security measures implemented by BidMachine include:
_HighPerformer_HighPerformer%201.png)
