DATA PROTECTION TERMS AND CONDITIONS (FOR MEDIA INVENTORY SUPPLIERS)
These Data Protection Terms and Conditions (“Terms”) form an integral part of any commercial agreement entered into between Subset Digital Pvt. Ltd., a company incorporated under the laws of India with its registered office at B-94, Sector-105, Noida, Uttar Pradesh, India – 201306 (“Advertiser”), and its media company client (“Media Company”) regarding the processing of personal data in connection with the services provided by Subset Digital Pvt. Ltd. to the Media Company (“Services”).
1. DEFINITIONS
1.1 In these Terms, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:
1.1.1 “Process/Processing”, “Data Controller”, “Data Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, and “Special Categories of Personal Data” shall have the same meaning as defined in applicable Data Protection Laws.
1.1.2 “Data Protection Laws” means, with respect to any Personal Data processed under these Terms:
(i) the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”);
(ii) the UK Data Protection Act 2018;
(iii) the California Consumer Privacy Act, 2018 (“CCPA”); and
(iv) any other applicable privacy or data protection laws, regulations, or guidelines, including amendments or replacements thereof.
1.1.3 “EEA” means the European Economic Area.
1.1.4 “Personal Data” means any data provided by the Media Company to the Advertiser under the Agreement that relates to an identified or identifiable individual, including, but not limited to, demographic, behavioural, contextual, query string, or other targeting data.
1.1.5 “Services” means the digital advertising and media services provided by the Advertiser to the Media Company under the Agreement.
1.1.6 “Sites” means the digital properties (such as websites or mobile applications) associated with the Services or through which Personal Data used in the delivery of Services is collected.
1.1.7 “Standard Contractual Clauses” refers to the clauses approved by the European Commission for the lawful transfer of Personal Data to countries outside the EEA, as amended or replaced from time to time.
1.1.8 “Sub-processor” means any third party appointed by the Advertiser to process Personal Data on behalf of the Media Company.
2. SCOPE OF PROCESSING
2.1 The Media Company instructs the Advertiser to process Personal Data as reasonably required to provide the Services.
2.2 The Advertiser may collect or receive data (including Personal Data) relating to end users via cookies, device identifiers, pixels, or similar tracking technologies, in connection with the provision of Services on or through the Sites.
3. COMPLIANCE WITH DATA PROTECTION LAWS
3.1 Each party shall comply with applicable Data Protection Laws and the provisions of these Terms in the performance of the Agreement.
3.2 Both parties shall cooperate and provide reasonable assistance to each other to ensure compliance with Data Protection Laws.
3.3 Where consent is required under applicable laws for the use of cookies or processing of Personal Data, the Media Company shall ensure that such valid, informed, and freely given consent is obtained from each Data Subject for the processing carried out by the Advertiser and its partners.
3.4 The Media Company shall ensure that its Sites contain appropriate and transparent privacy notices, in accordance with applicable Data Protection Laws, explaining the use and purpose of processing by the Advertiser or its partners, and offering mechanisms for consent withdrawal and opt-out options where required.
4. ADVERTISER PERSONNEL
The Advertiser shall ensure that all personnel authorized to process Personal Data are bound by confidentiality obligations, whether contractual, professional, or statutory.
5. SECURITY
The Advertiser shall implement appropriate technical and organizational measures (“TOMs”) to ensure the security, integrity, and confidentiality of Personal Data, taking into account the state of the art, cost of implementation, and nature and scope of processing.
6. SUBPROCESSING
6.1 The Advertiser may engage Sub-processors in connection with the Services, provided that:
(a) such Sub-processors are bound by written agreements imposing data protection obligations that are no less protective than those set out in these Terms; and
(b) the Advertiser maintains and updates a list of Sub-processors and provides the Media Company an opportunity to object to additions on reasonable grounds.
6.2 The Advertiser shall remain fully responsible for the performance of its Sub-processors.
7. DATA SUBJECT RIGHTS
7.1 The Advertiser shall promptly notify the Media Company if it receives a request from a Data Subject exercising rights under applicable Data Protection Laws.
7.2 The Advertiser shall reasonably assist the Media Company in fulfilling its obligations with respect to such requests.
7.3 If, after due cooperation, the Advertiser determines that a Data Subject’s request is valid, it may respond directly to the Data Subject to comply with applicable laws, notifying the Media Company where appropriate.
8. PERSONAL DATA BREACH
In the event of a Personal Data Breach, the affected party (“Data Breaching Party”) shall:
(a) notify the other party (“Non-Data Breaching Party”) without undue delay and, in any case, within 48 hours of becoming aware of the breach;
(b) provide all relevant details, including nature, scope, likely impact, and mitigation steps; and
(c) cooperate with the other party to comply with notification obligations to supervisory authorities and/or Data Subjects, as required under applicable law.
9. DATA PROTECTION IMPACT ASSESSMENT
The Advertiser shall assist the Media Company, where reasonably possible, in fulfilling its obligations to conduct data protection impact assessments or consult with regulatory authorities as required by applicable Data Protection Laws.
10. DELETION OR RETURN OF PERSONAL DATA
10.1 Upon termination or expiration of the Agreement, the Advertiser shall delete or, upon written request, return all Personal Data processed under these Terms.
10.2 Where retention is required by law, the Advertiser shall ensure that the retained data remains confidential and is processed only as required by such legal obligation.
11. AUDIT RIGHTS
11.1 Upon reasonable request, the Advertiser shall make available to the Media Company information necessary to demonstrate compliance with these Terms and applicable Data Protection Laws.
11.2 Any audit shall be conducted on reasonable notice (at least four weeks) and in a manner that does not disrupt the Advertiser’s operations. The Media Company shall bear its own costs and the Advertiser’s reasonable costs, unless material non-compliance is discovered.
11.3 The Advertiser shall notify the Media Company if it believes an audit instruction infringes Data Protection Laws.
12. INTERNATIONAL TRANSFERS
12.1 Transfers of Personal Data outside the EEA or other restricted jurisdictions shall only be carried out under lawful transfer mechanisms, such as Standard Contractual Clauses or Binding Corporate Rules, as permitted under Data Protection Laws.
12.2 Where no adequate safeguards exist, the Advertiser shall execute appropriate Standard Contractual Clauses with the Media Company or implement an equivalent lawful transfer mechanism.
13. GENERAL TERMS
13.1 Each party shall promptly notify the other of any claim or complaint received in relation to the processing of Personal Data.
13.2 In the event of any change to applicable Data Protection Laws affecting these Terms, the parties shall cooperate in good faith to make any necessary updates. If compliance materially alters the nature or cost of Services, either party may terminate the Agreement with written notice.
13.3 In case of inconsistency between these Terms and any other provisions of the Agreement, these Terms shall prevail regarding data protection matters.
13.4 If any provision of these Terms is held invalid or unenforceable, the remainder shall remain in full force and effect, and the invalid provision shall be interpreted to best achieve the intent of the parties.
13.5 The Advertiser may amend these Terms by publishing an updated version on its website. If the Media Company objects to the changes within 30 days of publication, it may terminate the Agreement for the affected services without penalty.