Event Partner Data Processing Addendum

Dated: December 1, 2022

This Event Partner Data Processing Addendum (“DPA“) is entered into by and between PubMatic, Inc. (“PubMatic“) and the Event Partner, and forms part of all agreements between the parties relating to the subject matter of this Addendum (“Agreement“). In the event of a conflict between the Agreement and this DPA, this DPA shall control to the extent of the conflict with respect to the Event Partner’s Processing and disclosure of any Data (including Personal Data).

1. Any capitalized terms used but not defined in this DPA shall have the meaning set forth in the Agreement.
   1. “Data Protection Laws” means any privacy and/or data protection laws, regulations and binding guidance that apply to the Processing of Personal Data under this DPA and/or to the privacy of electronic communications, including (but not limited to) European Data Protection Law.
   2. “European Data Protection Law” means as applicable: (i) Regulation 2016/679 (the European General Data Protection Regulation (“GDPR”); (ii) the EU e-Privacy Directive (Directive 2002/58/EC) (“e-Privacy Directive”); (iii) all national implementations of (i) and (ii); (iv) the Swiss Federal Data Protection Act of 19 June 1992 and its corresponding ordinances (“Swiss DPA“); and (v) in respect of the United Kingdom, GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 the (together, “UK Privacy Law“); in each case, as may be amended, superseded or replaced from time to time.
   3. “Controller” shall have the meaning given to it under the GDPR.
   4. “Data Subject” shall have the meaning given to it in the GDPR.
   5. “Personal Data” shall mean any information that directly or indirectly identifies an individual, including any information that is “personal data”, “personal information” or “personally identifiable information” under Data Protection Laws.  For the avoidance of doubt, information about an individual in the business context is considered Personal Data. For example, business contact information is considered Personal Data.
   6. “Processing” shall have the meaning given to it in the GDPR and “process“, “processes” and “processed” shall be interpreted accordingly.
   7. “Restricted Transfer” means: (i) where the GDPR applies, a transfer of Personal Data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; (ii) where the UK Privacy Law applies, a transfer of personal data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.
   8. “Security Breach” means a potential or confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the Data Processed under or in connection with the Agreement.
   9. “Standard Contractual Clauses” means Module 1 (Controller to Controller) of the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 located at: https://eur-lex.europa.eu/eli/dec_impl/2021/914 .
   10. “UK Addendum” means the International Data Transfer Addendum (version B1.0) to the EU Commission Standard Contractual Clauses issued by UK Information Commissioners Office under S.119(A) of the UK Data Protection Act 2018, as amended, superseded or replaced from time to time.

2. Relationship of the Parties: The parties acknowledge and agree that pursuant to the Agreement (including this DPA), Event Partner will disclose the Personal Data described in Annex A (“Data”) to PubMatic for processing. The parties acknowledge and agree that Event Partner is a Controller of such Data and that PubMatic will process the Data as a separate and independent Controller for the purposes described in Annex A (or as otherwise agreed in writing by the parties) (the “Permitted Purpose“). In no event will the parties process the Data as joint Controllers.
3. Data Protection Obligations
   • Compliance with law: Without prejudice to Event Partner’s obligations under Section 2 of this DPA, each party agrees that it shall be individually and separately responsible for complying with the obligations that apply to it as a Controller under Data Protection Laws. Event Partner represents and warrants to PubMatic that it is a Controller of the Data under Data Protection Laws and that it is lawfully entitled to process, and has (and, to the extent that Event Partner has obtained the Data from third party sources (“Sources“), procures that all Sources have) provided all required notices and obtained all necessary and valid  consents, approvals, and authorizations (including, without limitation meeting the consent standard (where applicable) set by Data Protection Laws) from the relevant Data Subjects to: (i) process and share the Data in accordance with this Agreement; and (ii) to enable PubMatic to lawfully process the Data for the purposes contemplated by this Agreement, including the Permitted Purposes. Event Partner acknowledges that PubMatic does not have a direct relationship with the Data Subjects whose Personal Data is Processed under this DPA and accordingly accepts responsibility for the provision of notice and obtaining of consent (where applicable) in accordance with the foregoing.

• Consent Records.Event Partner shall maintain (and procure that all Sources maintain) a record of all consents obtained from Data Subjects pursuant to Section 3.1 above as required by Data Protection Laws, including the time and date on which consent was obtained, the information presented to Data Subjects in connection with their giving consent, and details of the mechanism used to obtain consent. Event Partner shall make these records available to PubMatic promptly upon written request.

• Form of Notice and Consent. Without limitation to Section 3.1 above, Event Partner agrees that where and to the extent it is responsible for providing any notice and obtaining any consents on behalf of PubMatic pursuant to this DPA or where otherwise reasonably requested by PubMatic: (a) it must obtain (and procure that all Sources obtain) PubMatic’s prior written approval of the form and method of the notice, choice and/or consent mechanism(s) used to notify data subjects and obtain their consent or exercise choice (as applicable) with respect to the processing of their personal data for the purposes contemplated by this Agreement; and (b) Event Partner agrees to make (and procure that all Sources make) any changes to such notices, choice and consent mechanisms, including with respect to form, method of delivery, or otherwise, as reasonably requested by PubMatic. If Event Partner (or any of its Sources) is unable to comply with its notice and consent obligations under this Section 3, Event Partner shall promptly notify PubMatic.

4. Assistance and Cooperation.

In the event that either party receives any correspondence, enquiry or complaint from a Data Subject, regulator or other third party related to the disclosure of the Data by Event Partner to PubMatic for the Permitted Purpose; or that relates (or also relates) to the business of the other party (“Correspondence“), it shall promptly inform the other party giving full details of the same, and the parties shall cooperate reasonably and in good faith in order to respond to the Correspondence in accordance with any requirements under Data Protection Laws.

5. Both parties shall implement and maintain an information security program (which shall include appropriate technical and organizational measures, policies, and processes) to protect against Security Breaches and to ensure the security, availability, integrity, resilience and confidentiality of the systems storing and Processing the Data.
6. Data Transfers.
   • Subject to Section 6.2, the parties agree that when the transfer of Data from Event Partner (as exporter) to PubMatic (as importer) is a Restricted Transfer and European Data Protection Law applies, the transfer shall be subject to the Standard Contractual Clauses, which shall be deemed incorporated into and shall form part of this DPA, as follows:

(a) in relation to transfers of Data protected by the GDPR, the Standard Contractual Clauses shall apply, completed as follows: (i) in Clause 7, the optional docking clause will apply, (ii) in Clause 11, the optional language will not apply; (iii) in Clause 17, Option 1 will apply, and the Standard Contractual Clauses will be governed by laws of Ireland; (iv) in Clause 18(b), disputes shall be resolved before the courts of Ireland; (v) Annex I of the Standard Contractual Clauses shall be deemed completed with the information set out in Annex A to this DPA; and (vii) Annex II of the Standard Contractual Clauses shall be deemed completed with the information set out in Annex B to this DPA;

(b) in relation to transfers of Data protected by UK Privacy Law, the Standard Contractual Clauses shall also apply completed in accordance with paragraph (a) above, but as modified and interpreted by Part2: Mandatory Clauses of the UK DPA, which shall be deemed executed by the parties and incorporated into and form an integral part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK DPA shall be completed respectively with the information set out in Annexes A and B of this DPA and Table 4 in Part 1 shall be deemed completed by selecting “neither party”; and

(c) in relation to transfers of Data protected by the Swiss DPA, the Standard Contractual Clauses shall also apply completed in accordance with paragraph (a) above, with the following modifications: (i) references to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA; (ii) references to specific Articles of “Regulation (EU) 2016/679” shall be replaced with the equivalent article or section of the Swiss DPA; (iii) references to “EU”, “Union”, “Member State” and “Member State law” shall be replaced with references to “Switzerland”, or “Swiss law”; (iv) the term “member state” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland); (v) Clause 13(a) and Part C of Annex A are not used and the “competent supervisory authority” is the Swiss Federal Data Protection Information Commissioner; (vi) references to the “competent supervisory authority” and “competent courts” shall be replaced with references to the “Swiss Federal Data Protection Information Commissioner” and “applicable courts of Switzerland”; (vii) in Clause 17, the Standard Contractual Clauses shall be governed by the laws of  Switzerland; and (viii) Clause 18(b) shall state that disputes shall be resolved before the applicable courts of Switzerland.

(d) It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses. Accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement, including this DPA, the Standard Contractual Clauses shall prevail to the extent of such conflict.

• The terms of the Standard Contractual Clauses will not apply where and to the extent PubMatic (as data importer) and the applicable transfer of Data are covered by an alternative, suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection or appropriate safeguards for Personal Data provided that it is deemed legally valid in jurisdictions subject to European Data Protection Law (an “Adequacy Mechanism“), in which case PubMatic shall process the Personal Data in compliance with the Adequacy Mechanism and the Standard Contractual Clauses shall not apply.
• The parties agree that if Data Protection Laws no longer allow the lawful transfer of Data under the Standard Contractual Clauses and/or a relevant regulator or court of competent jurisdiction requires the parties to adopt additional measures (“Additional Measures“) or an alternative data export solution (“Alternative Transfer Mechanism“) to enable the lawful transfer of Data outside of the European Economic Area, United Kingdom or Switzerland and such requirements are not satisfied by an Adequacy Mechanism in line with Section 6.2 above (if applicable), both parties agree to cooperate and agree any Additional Measures or Alternative Transfer Mechanism that may be required (but only to the extent such Additional Measures or Alternative Transfer Mechanism extend to the territories to which Data is transferred).

• Indemnity
  • Event Partner shall indemnify PubMatic from and against all loss, cost, harm, expense (including reasonable legal fees), liabilities or damage (“Damage“) suffered or incurred by PubMatic as a result of Event Partner’s breach of the data protection provisions set out in this Agreement or Data Protection Laws, and provided that: (i) PubMatic gives Event Partner prompt notice of any circumstances of which it is aware that give rise to an indemnity claim; and (ii) PubMatic takes reasonable steps and actions to mitigate any ongoing Damage it may suffer as a consequence of Event Partner’s breach.

• Miscellaneous
  • Annexes to this DPA will be deemed to be an integral part of this Agreement to the same extent as if they had been set forth verbatim herein.
  • This DPA may be executed in counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument.
  • Event Partner shall notify PubMatic of an individual within its organisation authorised to respond from time to time to enquiries regarding the Data and shall deal with such enquiries promptly. The individual within PubMatic authorised to respond from time to time to enquiries regarding the Data and who shall deal with such enquiries promptly can be contactable here: dpo@pubmatic.com(or such other contact as may be communicated to Event Partner from time to time).
  • In the event that there is a change in the Privacy Requirements that apply to the processing of Data, that would, in the reasonable opinion of a party, require changes to the terms and conditions of this DPA,  that party reserves the right  (acting reasonably) to request such changes; provided that, to the extent possible, the party requesting the change will provide at least thirty (30) days prior written notice (including by email) of such changes and agrees to discuss such changes in good faith.
  • Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between any provision in this DPA and any provision in the Agreement, this DPA controls and takes precedence.  With effect from the effective date, this DPA is part of, and incorporated into the Agreement.  To the extent there are any prior agreements with regard to the subject matter of this DPA, this DPA supersedes and replaces such prior agreements. This DPA shall survive termination or expiry of the Agreement.  Upon termination or expiry of the Agreement PubMatic may continue to process the Data provided that such processing complies with the requirements of this DPA.
  • This DPA may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement.  This DPA may be executed via a recognized electronic signature service or delivered by facsimile transmission, or may be signed, scanned and emailed, and any such signatures shall be treated as original signatures for all applicable purposes.

Annex A

Description of the Transfer

1. List of Parties

Controller/ Data exporter:

Controller / Data importer:

1. Description of Transfer

Defined terms are as set out in the Data Processing Addendum agreed between the parties.

1. Competent Supervisory Authority

The competent supervisory authority will be (i) for Personal Data protected by the GDPR, determined in accordance with Clause 13 of the Standard Contractual Clauses; (ii) for Personal Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner (“FDPIC”); and (iii) for Personal Data protection by UK Privacy Law, the Information Commissioners Office (the “ICO”).

Annex B

Technical and Organizational Measures

The technical and organisational measures implemented by the PubMatic as data importer (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

For further information, please see generally our privacy policy  at https://pubmatic.com/legal/privacy-policy/