StartApp Data Processing Agreement (Advertising)

This Data Processing Agreement (“DPA“) is an integral part of an Insertion Order between StartApp Inc. and Advertiser (“Advertiser Agreement”), and available at: https://www.startapp.com/startapp-dpa-advertising/. Each of StartApp and Advertiser may be referred to as a ”Party”, and together as the ”Parties”.

  1. Definitions

1.1.     “Data Protection Law” means any and all applicable privacy and data protection laws and regulations (including, where applicable, EU Data Protection Law) as may be amended or from time to time.

1.2.     “Controller“, “Processor“, “Data Subject“, “Personal Data“, “Processing” (and “Process“), “Personal Data Breach” and “Special Categories of Personal Data” shall have the meanings given in EU Data Protection Law.

1.3.     “StartApp Data” means data collected by StartApp (including without limitations, IDs) and shared with the Advertiser subject to the Advertiser Agreement and for the purpose of providing the Services.

1.4.     “StartApp Privacy Policy” means StartApp End User Privacy Policy available at: https://www.startapp.com/policy/privacy-policy/, as may be amended by StartApp from time to time.

1.5.     “EU Data Protection Law” means the (i) EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”); (ii) the EU e-Privacy Directive (Directive 2002/58/EC), as amended (e-Privacy Law); (iii) any national data protection laws made under, pursuant to, replacing or succeeding (i) and (ii); and (iv) any legislation replacing or updating any of the foregoing.

1.6.     “ID” means: (i) a unique identifier stored on an end-user’s device, (ii) a unique identifier generated on the basis of device information, or (iii) a resettable advertising ID associated with a mobile device or an application.

1.7.     “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data of the other party. For the avoidance of doubt, any Personal Data Breach of the other Party’s Personal Data will comprise a Security Incident.

  1. Applicability

This DPA applies to the extent that EU Data Protection Law applies to the Processing of Personal Data under the Advertiser Agreement, including if: (a) the Processing is in the context of the activities of an establishment of either party in the European Economic Area (“EEA”); or (b) the Personal Data relates to Data Subjects who are in the EEA and the Processing relates to the offering to them of goods or services or the monitoring of their behavior in the EEA by or on behalf of a party. Notwithstanding the above, this DPA and the obligations hereunder do not apply to aggregated reporting or statistics information a party may collect from end users or provide to the other party.

  1. Relationship of The Parties

The Parties agree and acknowledge that under the performance of their obligations set forth in the Agreement, and with respect to the Processing of Personal Data, StartApp is the Data Controller and Advertiser is the Data Processor on behalf of StartApp. Provided however that, when placement of an Ad uses and/or is based only on data received by StartApp within a respective request through RTB, then StartApp is only a Processor for the purpose of such action and Advertiser is the Data Sub-Processor on behalf of StartApp

Each party shall be individually and separately responsible for complying with the obligations that apply to it subject to the Data Protection Law.

The subject-matter and duration of the Processing carried out by the Processor in connection with the Advertiser Agreement, the nature and purpose of the Processing, the type of Personal Data and categories of Data Subjects are described in Annex A.

  1. Processing and Protection of Personal Data

4.1.     Each party shall Process Personal Data in compliance with applicable Data Protection Law, industry standards and its obligations herein.

4.2.     In respect of the Processing of Personal Data by Advertiser in connection with the Advertiser Agreement where EU Data Protection Law applies, the Advertiser is responsible for and shall comply with applicable Data Protection Law and agrees that it shall: (a) cooperate as requested by StartApp and implement appropriate technical and organizational measures to enable StartApp to comply with any exercise of rights by a Data Subject under applicable Data Protection Law in respect of Personal Data processed by StartApp under the Advertiser Agreement (including, without limitation, deletion of a Data Subject’s Personal Data); (b) not access or transfer outside the EEA any Personal Data without the prior written consent of StartApp; (c) provide StartApp with reasonable resources and assistance as are required by StartApp pursuant to Articles 32 to 36 of the GDPR; (d) by StartApp’s sole discretion, delete all StartApp Data following the completion of the Processing, and delete existing copies unless European Union or Member State law requires storage of such; and (e) make available to StartApp at its request all information necessary to demonstrate compliance with the obligations herein and under Article 28 of the GDPR, including without limitation, provide StartApp with a written description of the technical and organizational methods employed by Advertiser and its Sub- Processors (if any) for the Processing of Personal Data.

  1. Notification of Security Incident

The Advertiser will notify StartApp without undue delay, and, in any event within forty-eight (48) hours, upon becoming aware that an actual Security Incident has occurred. The Advertiser will, as soon as possible, provide StartApp with at least the following information with respect to the Security Incident: (a) a description of the cause and nature of the Security Incident including the categories and approximate numbers of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the measures being taken to contain, investigate and remediate the Security Incident; (c) the likely consequences and risks for StartApp and its Data Subjects as a result of the Security Incident; and (d) any mitigating actions taken and a proposed plan to mitigate any risks for Data Subjects as a result of the Security Incident. Further, the Advertiser shall (i) immediately and without delay, take necessary steps to contain, remediate, minimize any effects of the Security Incident and to identify its cause; (ii) co-operate with StartApp and provide StartApp with applicable assistance and information as it may reasonably require in connection with the mitigation of the Security Incident; and (iii) immediately notify StartApp in writing of any request, inspection, audit or investigation by a Supervisory Authority.

  1. Technical and Organizational Measures

StartApp has implemented appropriate technical and organizational measures to protect the Personal Data as detailed herein: www.startapp.com/security. The Advertiser shall implement and maintain the technical and organizational measures and take all other measures required pursuant to Article 32 of the GDPR including all organizational and technical security measures necessary to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of StartApp Data, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing, and in any event, with respect to StartApp Data the security measures implemented are at least as strict as StartApp’s.

  1. Sub-Processors

Advertiser may share StartApp Data with Sub-Processors provided that (a) it will notify StartApp in advance in writing with respect to these Sub-Processors (including replacement or any change with respect to these Sub-Processors; email notification to StartApp DPO at: dpo@startapp.com shall be sufficient). StartApp may reasonably object in writing a proposed Sub-Processor within thirty (30) days of receipt of the email notification (in which case Advertiser shall not use or replace the Sub-Processor concerned in relation with StartApp Data); (b) each Sub-Processor will guarantee to meet the requirements of the GDPR and this DPA and ensure the protection of the rights of Data Subjects, through a legally binding contract between Advertiser and Sub-Processor, with the same data protection obligations as set out in this DPA; and (c) if any Sub-Processor fails to fulfil its obligations in the contract between the Advertiser and Sub-Processor, Advertiser shall remain fully liable to StartApp for the performance of the Sub-Processor’s obligations.

  1. Audit

Upon reasonable request of StartApp, the Advertiser will submit its data processing facilities, data files and documentation as reasonably needed by StartApp for the purpose of auditing or inspecting the Advertiser to ensure compliance with the warranties and undertakings under this DPA (“Audit”). The Audit will be conducted (i) by StartApp or any independent or impartial inspection agents or auditors agreed between the parties; and (ii) by providing reasonable notice and during regular business hours. The request will be subject to the extent permitted under applicable law.

  1. Conflict

During the performance of the Agreement, StartApp may share with or transfer Personal Data to the Advertiser. It is acknowledged by the Parties that the Personal Data has been or is Processed by StartApp for the Purpose only, and pursuant to StartApp End User Privacy Policy, available at: https://www.startapp.com/policy/privacy-policy/(“StartApp Privacy Policy”). Advertiser is fully responsible (i) for its data collection and/or Process practices and its compliance with any applicable laws; and (ii) to analyze or verify its rights or lawful basis to Process Personal Data considering the consents, authorizations or permissions granted by or obtained from End Users within the scope of StartApp Privacy Policy or otherwise.

In the event of a conflict or discrepancies between the terms and conditions of this DPA and the terms and conditions of StartApp Privacy Policy, StartApp Privacy Policy shall prevail. In the event of a conflict between the terms and conditions of this DPA and the Advertiser Agreement, this DPA shall prevail. Except as set forth herein all of the terms and conditions of the Advertiser Agreement shall remain in full force and effect.

* * *

ANNEX A (to Appendix B)

DETAILS OF PROCESSING ACTIVITIES

Subject Matter

Processing carried out for the purpose of providing the Services as detailed in the Advertiser Agreement and specifically for the purpose of placing advertisement within the Inventory (digital assets of StartApp’s partners; i.e., publishers, suppliers, etc.).

Categories of data

(a)     Personal Data of the Data Subjects in the EEA that have installed a mobile application that contains StartApp SDK in which the Advertiser will display advertisement.

(b)     Personal Data of the Data Subjects in the EEA that shared with StartApp in its capacity as Processor by third parties which, directly or indirectly, develop, operate, own or licensee of mobile applications or advertisement space at mobile applications, in which the Advertiser will display advertisement.

Types of Personal Data

IDs.

Special categories of data

N/A

Duration

Solely for the purpose of providing the Service and shall be deleted by Advertiser thereafter.

Last update: June 5, 2019