Index Marketplaces Data Processing Terms
These data processing terms (Data Terms) apply to any Personal Data processing between you and Index Exchange Inc. (Index) related to Index’s ‘Marketplace Platform’ (Marketplace Terms).
Definitions from the Marketplace Terms apply in these Data Terms. Additionally, in these Data Terms:
(a) Applicable Privacy Laws means all applicable global privacy laws, regulations, and guidance (as amended and/or replaced from time to time) relating to data protection, including, but not limited to, European Data Protection Laws, U.S. Data Protection Laws, and any modification, extension, or re-enactment of the above from time to time;
(b) European Data Protection Laws means: (i) the European Union (EU) General Data Protection Regulation (GDPR) (Regulation 2016/679); (ii) the EU e-Privacy Directive (Directive 2002/58/EC); (iii) national data protection laws made pursuant to (i) or (ii), including the United Kingdom (UK) GDPR, the UK Data Protection Act, 2018, and the Swiss Federal Act on Data Protection), and any modification, extension, or re-enactment of the above from time to time;
(c) The terms Controller, Data Subject, Personal Data, Personal Data Breach, Processor, and Processing (or Process or Processed) will have the same meanings as given to them in the GDPR or other relevant Applicable Privacy Laws; Third Party and Business will have the same meaning as given to them in the CCPA; provided, however: (i) to the extent the CCPA or other privacy law is applicable, the definition of Personal Data includes Personal Information; and (ii) the definition of Data Subject includes Consumer;
(d) Framework Signal(s) means technical privacy signals developed by Industry Standard bodies, including the Network Advertising Initiative (NAI) opt-out for tailored advertising, the International Advertising Bureau (IAB) Transparency and Consent Framework, the IAB U.S. Privacy String, the Children’s Online Privacy Protection Act (COPPA) flag, and any other signal(s) whether now known or hereafter created that transmit affirmative action by a Data Subject with respect to their Personal Data Processing;
(e) Industry Standards means any industry guidelines to which the Party is or has agreed to be bound (as applicable), including from the IAB and the NAI, as amended or superseded;
(f) Third-Party Property means any website, mobile site, or application for which Publisher has the authority to sell Ad Inventory or otherwise use the Services, but which is not owned and/or operated by Publisher; Third-Party Owner means the owner and operator of the Third-Party Property; and
(g) U.S. Data Protection Laws means United States of America state or federal privacy laws, including, but not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020), and its implementing regulations, including any amendments thereto (collectively, the CCPA), and any modification, extension, or re-enactment of the above from time to time.
The Parties acknowledge and agree that any Personal Data Processed by Index in connection with the Marketplace Terms may only be used to: (a) deliver and receive the Marketplace Services, which include, but are not limited to, facilitating targeted advertising and delivery of Ads, fraud detection, and honouring Data Subject preferences expressed through the Framework Signals that Index receives, as applicable; (b) provide reporting to the parties to a transaction on the Exchange (including, without limitation, advertiser, Buyer(s), Marketplace Owner and/or you), where: (i) the disclosure of Personal Data is limited to the extent necessary to provide information on the transaction; and (ii) such reporting is kept strictly confidential and is never disclosed beyond the parties to a transaction or shared publicly except to the extent necessary to be disclosed to advisors (i.e. lawyers, advisors, auditors) who are bound to confidentiality terms at least as restrictive as outlined in the MSA; (c) to respond to a court order or a request from a governmental agency, or to comply with applicable law or Industry Standards; and (d) improve the Marketplace Platform and the Marketplace Services (subsections (a) – (d), collectively, the Purpose).
Under Applicable Privacy Laws, pursuant to the Marketplace Terms, Index is an independent Controller and Third Party, and Publisher is an independent Controller and Business. Each Party acknowledges no provision of the Marketplace Terms will be interpreted as a joint-controllership or co-controllership between the Parties.
(a) Index will: (i) process or share Personal Data in connection with the Marketplace Terms only for the Purpose; (ii) contractually require its partners to comply with Applicable Privacy Laws; (iii) notify you without undue delay upon becoming aware of a Personal Data Breach in connection with the Marketplace Terms; and (iv) notify you without undue delay if Index makes a determination that it can no longer meet its obligations under the CCPA or other Applicable Privacy Laws.
(b) Each Party will: (i) comply with its obligations under Applicable Privacy Laws and Industry Standards; (ii) notify the other Party without undue delay if a Data Subject makes a specific inquiry about their Personal Data Processing that directly identifies the other Party (for example, if a Data Subject makes a request to Publisher about Index’s Processing of Personal Data); (iii) implement appropriate technical and organizational security measures to protect Data Subjects’ Personal Data, consistent with Applicable Privacy Laws; (iv) assist the other Party in complying with data security obligations; and (v) cooperate in demonstrating its compliance with Applicable Privacy Laws.
Upon reasonable written notice and not more than once per calendar year, you agree that you may review and audit, at your expense, Index’s privacy, and security program specific to its compliance with its obligations in these Data Terms. Any audit is subject to a mutually agreed-upon plan that ensures the use of an independent third party auditor and restricts the scope of the audit to what is relevant to you. You agree, to the extent permitted by law or regulation, to keep confidential any information or findings related to the audit. In addition, the parties agree that third party auditors are subject to confidentiality obligations no less stringent than those within the Marketplace Terms.
If you share Personal Data of Data Subjects from a Third-Party Property, you will ensure that the Third-Party Owner complies with terms at least as stringent as those in this Schedule. You are responsible for any breach of this Schedule caused by such Third-Party Owner, as if you had caused such breach.
Upon reasonable written request from you (email to suffice), Index will provide an up-to-date list of all Processors involved in the Processing of Personal Data in connection with the Marketplace Terms and any reasonable information relevant to such Processing.
Where Applicable Privacy Laws require supplementary measures to protect the international transfers of Personal Data, each Party will ensure the transfer occurs in compliance with such supplementary measures, as confirmed by the European Commission.
For each Framework Signal you send to Index (provided they are transmitted correctly), Index will: (a) action the Framework Signal(s) in accordance with the Industry Standard to which the Framework Signal(s) applies; and (b) also pass the signal to downstream partners (as appropriate). Index is not responsible for any Personal Data that may be Processed due the incorrect technical transmission of a Framework Signal(s) (e.g. if Index does not receive a Framework Signal from Publisher).
In the event of any conflict or discrepancy between Applicable Privacy Laws, these Data Terms together with the Marketplace Terms and the MSA, the following order of precedence will apply: (a) Applicable Privacy Laws; (b) these Data Terms together with the Marketplace Terms with respect to the Marketplace Platform and the Marketplace Services; and (c) the MSA in all other respects.