Effective Date: January 31, 2025
For information on our processing of personal information that is subject to the California Consumer Privacy Act (“CCPA”), please see Section 10 – Supplemental CCPA Privacy Notice.
EXHIBIT A – SUPPLEMENTAL TERMS FOR THE STANDARD CONTRACTUAL CLAUSES
This Wurl Advertising and Media Services Privacy Notice (“Privacy Notice”) applies to personal information processed by WURL, LLC and WURL NETWORK UK, LTD (“Wurl,” “we,” “us,” and “our”) through our performance marketing services, supply-side platform (SSP) services, content curation and/or recommendation services, e.g., WurlBits and/or TVBits, or related services (our “Advertising and Media Services”).
Advertising Services
Overview: Wurl provides a supply-side platform to publishers of online video content (i.e., Internet delivered video content) and a demand-side platform to buyers of digital advertising inventory displayed on online video content (i.e., advertisements/commercials displayed during the viewing of Internet delivered video content). Wurl’s Advertising Services help its publisher and advertiser clients achieve their monetization and advertising goals.
How it works: When a publisher that offers online video content wants to provide video advertisements to viewers of its content, it can work with supply-side platforms (e.g., Wurl) to reach potential advertisers. To do this, the publisher of this video content (which could be a streaming app or a channel/content provider within a streaming app) will share certain device level data about the device with the supply-side platforms when someone is viewing the publisher’s video content. The supply-side platforms then make this device level data available to demand-side platforms (e.g., Wurl and other demand-side platforms) in the form of “bid requests” (i.e., a request to bid on displaying an advertisement to the viewer of online video content).
Once a demand-side platform receives a bid request, it will help its advertiser clients decide how much to bid on displaying an advertisement based on a variety of factors.
When an advertiser has the highest bid to display an advertisement, it will win the bid request and video content viewer will see the advertiser’s advertisement displayed on the device.
Media Services
Overview: Wurl partners with streaming platforms and content companies to deliver short-form video channels based on a variety of genres. These channels are collectively referred to as “TVBits”.
How it works: When a viewer selects a TVBits channel, TVBits will deliver short-form content to the viewer based on the genre the viewer selects or such other category which may vary depending on the streaming platform. The viewer may interact with the content that is displayed and TVBits will curate and/or create subsequent TVBits content and/or channels and make recommendations based on the viewers’ interactions, feedback, and engagement. Viewers may also be shown advertisements while watching TVBits, which will follow the model described in the Advertising Services section above.
A Quick Note: Before we describe the types of information collected by the Advertising and Media Services, it is important to understand that all information processed by the Advertising and Media Services is solely at the device level and cannot, by itself, be used to identify a natural person in the real world. However, certain privacy and data protection laws still consider this device level data to be “personal information” which is why we use this terminology in our Privacy Notice.
Advertising Services
Below are the types of information which may be collected by the Advertising Services:
Bid Request Data. When Wurl receives a bid-request from one of its publisher clients or another supply-side platform, we collect device level data contained in the bid-request which may include:
Data Collected by Wurl’s Advertiser Clients. Wurl’s advertiser clients may provide us with device level data that they have collected about users of their services. This information provides insight into interests of our advertiser client’s users. Wurl uses this information to create models that help the advertiser client determine what sort of users it should target with advertisements and how much it should spend on advertisements. Wurl is a “processor” or “third party” of event data and may only use this data in accordance with our advertiser client’s written instructions.
Impression Data. When an advertiser client wins a bid and has its advertisement displayed on the device to the viewer of video content, Wurl may collect information in connection with delivering the ad including ad viewing and usage data through the use of beacons, tags, or pixels.
Media Services
Below are the types of information which may be collected by the Media Services:
TVBits Viewer Data. When Wurl receives an API call from the TVBits device, we collect device level data contained in the request which may include:
We use personal information for a variety of business purposes, including: (i) to perform and provide the Advertising and Media Services, (ii) for Wurl’s product development, implementation, and improvement purposes, (iii) for pursuing legitimate interests, such as marketing, fraud prevention, quality control, and security, and (iv) to generate aggregated and/or de-identified data, including for reporting and analytics purposes.
We may share personal information with the following categories of third parties:
Supply-Side Platforms and Demand-Side Platforms. Where we act as a supply-side platform on behalf of our publisher clients, we may share bid request data and data about impressions served with other supply-side platforms and demand-side platforms so that they, or parties they work with, can bid on and deliver advertisements.
Any personal information we provide to the supply-side platform and/or the demand-side platform will also be subject to such party’s privacy policy (and potentially the privacy policy of other third-party recipients that they disclose personal information to). Supply-side platforms, demand-side platforms, and any third parties they work with are not our service providers or subprocessors. We are not responsible for the processing of personal information by supply-side platforms, demand-side platforms, and/or any third parties they work with.
Advertiser Clients. If we, acting as a demand-side platform, deliver an advertisement to a viewer of video content on behalf of an advertiser client, we may share information related to that transaction with our advertiser client.
Any personal information we provide to the advertiser client will also be subject to the advertiser client’s privacy policy. We are not responsible for the advertiser client’s processing of personal information.
Service Providers. We may share any personal information we collect about you with our third-party service providers that help us provide the Advertising and Media Services.
Reporting Recipients. We may create and share aggregated and/or de-identified reporting based on viewer data, bid request data, and transaction data with our partners, including, but not limited to, advertiser clients and agencies, supply-side platforms, demand-side platforms, publishers, content companies, and service providers we work with.
Affiliates. We may share personal information with Wurl’s affiliated entities.
Disclosures to Protect Us or Others. We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.
Disclosure in the Event of Merger, Sale, or Other Asset Transfer. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.
All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States and other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.
If we transfer personal information which originates in the European Economic Area, Switzerland, and/or the United Kingdom to a country that has not been found to provide an adequate level of protection under applicable data protection laws, one of the safeguards we may use to support such transfer is the EU Standard Contractual Clauses.
For more information about the safeguards we use for international transfers of your personal information, please contact us as set forth below.
You may be able to limit the collection and/or use of your personal information by Wurl and other supply-side and demand-side platforms involved in the Advertising and Media Services by adjusting your preferences as your device or application permits or by contacting us as set forth in “Contact Us” below. For more details about how to manage your preferences on some Internet connected TVs, read the instructions found here. In addition, you may opt out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. For the most effective and up-to-date “limit ad tracking” methods, you should consult instructions provided by your device manufacturer or application/browser provider.
The online advertising industry also provides websites from which you may opt out of receiving targeted ads from organizations that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.
Please note you must separately opt out on each device and in each browser.
You may also manage your consent preferences related to the “sharing” of personal information for “cross-context behavioral advertising” by navigating to the “Your Privacy Choices” button located at the bottom of Wurl’s website.
Your Privacy Rights. In accordance with applicable law, you may have the right to:
If you would like to exercise any of these rights, please contact us as set forth in “Contact Us” below. We will process such requests in accordance with applicable laws.
To protect your privacy, we will take steps to reasonably verify your identity before fulfilling requests submitted under applicable privacy laws. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your personal information. If your personal information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent using the information found in “Contact Us” below and ask us for additional instructions.
Please note that we are unable to authenticate any individuals whose device level data we receive from publishers of online video content and/or other supply-side partners. As a result, we may not be able to fulfill data subject requests that we receive.
Some laws may allow you to appeal our decision if we decline to process your request. If applicable laws grant you an appeal right and you would like to appeal our decision with respect to your request, you may do so by informing us of this and providing us with information supporting your appeal.
If your personal information is subject to the applicable data protection laws of the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority if you believe our processing of your personal information violates applicable law.
We store the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, provide our Advertising and Media Services, resolve disputes, establish legal defenses, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
To determine the appropriate retention period for personal information, we may consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, certain risk factors, the purposes for which we process your personal information, and whether we can achieve those purposes through other means.
This Supplemental CCPA Privacy Notice supplements our Privacy Notice and only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (as amended from time to time) (“CCPA”).
NOTICE AT COLLECTION
At or before the time of collection, California residents have a right to receive notice of our privacy practices. California residents can find this information below.
CATEGORIES OF SOURCES FROM WHICH PERSONAL INFORMATION IS COLLECTED
We collect personal information that you provide to us, personal information we collect automatically when you use the Advertising and Media Services, and personal information from third-party sources.
OVERVIEW OF PERSONAL INFORMATION COLLECTED, DISCLOSED, AND/OR SHARED
The CCPA provides California residents with the right to know what categories of personal information Wurl has collected about them, whether Wurl disclosed that personal information for a business purpose (e.g., to a service provider), and whether Wurl “shared” that personal information for “cross-context behavioral advertising” in the preceding twelve months. California residents can find this information below:
| Category of Personal Information Collected by Wurl | Category of Third Parties To Whom Personal Information is Disclosed to for a Business Purpose | Category of Third Parties Personal Information To Whom Personal Information is Shared for “Cross Contextual Business Advertising” |
| Identifiers | · Service providers | · Supply side platforms and/or demand side platforms · Advertiser clients |
| Commercial information | · Service providers | · Supply side platforms and/or demand side platforms · Advertiser clients |
| Internet or other electronic network activity | · Service providers | · Supply side platforms and/or demand side platforms · Advertiser clients |
| Inferences drawn from other personal information to create a profile about a consumer | · Service providers | · Supply side platforms and/or demand side platforms · Advertiser clients |
USES OF PERSONAL INFORMATION
We may use and disclose the personal information that we collect for the following business and commercial purposes:
The categories of sources from which we collect personal information and our business and commercial purposes for using and disclosing personal information are set forth in “Personal Information We Collect”, “How We Use Personal Information”, and “How We Disclose Personal Information” above, respectively. We will retain personal information in accordance with the time periods set forth in “Retention of Personal Information.”
The CCPA defines “share” to mean disclosing a consumer’s personal data for cross-context behavioral advertising, also known as tailored advertising. Tailored advertising is when we use information about your use of the Advertising and Media Services to tailor ads to be more relevant to you.
Additional Privacy Rights for California Residents
Opting Out of “Sharing” for Cross-Context Behavioral Advertising under the CCPA. California residents have the right to opt out of the “sharing” of personal information for “cross-context behavioral advertising.” To the extent Wurl’s processing of personal information is considered “sharing”, California residents may exercise these rights by contacting us as set forth in “Contact Us” below or by navigating to the “Your Privacy Choices” button located at the bottom of Wurl’s website.
For more details about how to manage your preferences on some Internet connected TVs, read the instructions found here. In addition, you may opt out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. For the most effective and up-to-date limit ad tracking methods, you should consult instructions provided by your device manufacturer or application/browser provider.
Disclosure Regarding Individuals Under the Age of 16. Wurl does not have actual knowledge of any “sale” of personal information of minors under 16 years of age. Wurl does not have actual knowledge of any “sharing” of personal information of minors under 16 years of age for “cross-context behavioral advertising.”
Disclosure Regarding Sensitive Personal Information. Wurl does not knowingly collect any sensitive
personal information via the Advertising and Media Services.
Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.
The Advertising and Media Services are not directed to children under 16 (or other age as required by local law outside of the United States), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.
Third-Party Services. The Advertising and Media Services may contain links to, be compatible, or receive personal information from third-party websites, applications, devices, or services (each a “Third-Party Service”) and other Third-Party Services may reference, link to, or interface with our Advertising and Media Services. These Third-Party Services are not controlled by us. We encourage our users to read the privacy policies of each Third-Party Service with which they interact. We do not endorse, screen or approve, and are not responsible for, the practices or content of such other Third-Party Services. Interacting with Third-Party Services is at your own risk.
Transparency and Consent Framework. Wurl participates in the IAB Europe Transparency & Consent Framework and complies with its Specifications and Policies. Wurl’s identification number within the framework is 1262.
We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you by posting an updated notice online.
Wurl is the controller of the personal information we process under this Privacy Notice.
If you have any questions about our privacy practices or this Privacy Notice, please contact us at:
WURL, LLC
1100 Page Mill Rd
Palo Alto, CA 94304
United States of America
EU and UK Privacy Representatives
We have appointed Prighter Group as our privacy representatives in the EU and UK. You can contact us through our privacy representatives at the following addresses:
For residents of the EU:
PrighterGDPR-Rep by Maetzler Rechtsanwalts GmbH & Co KG
c/o Wurl, LLC
Schellinggasse 3/10
1010 Vienna
Austria
For residents of the UK:
PrighterUK-Rep by Prighter Ltd.
c/o Wurl, LLC
20 Mortlake Mortlake High Street
London, SW14 8JN
United Kingdom
Additional information regarding our privacy representatives can be found at the following links:
Exhibit A – Supplemental Terms for the Standard Contractual Clauses
If you are a Wurl customer that has entered into a commercial agreement with Wurl (“Agreement”), and the Agreement incorporates by reference Module One’s obligations set forth in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“Standard Contractual Clauses”), this Exhibit A forms part of the Agreement and supplements the Standard Contractual Clauses.
Wurl and the applicable Wurl customer agree that the following terms will supplement the Standard Contractual Clauses:
A. List of Parties
Data Exporter:
Name: The applicable Wurl customer.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.
Role: Controller.
Data Importer:
Name: Wurl.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.
Role: Controller.
B. Description of the Transfer
Categories of data subjects whose personal data is transferred
As set forth in Wurl’s Advertising and Media Services Privacy Notice.
Categories of personal data transferred
As set forth in Wurl’s Advertising and Media Services Privacy Notice.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
To Wurl’s knowledge, no sensitive data is transferred.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Personal data is transferred on a continuous basis by virtue of the Wurl customer’s use of the Services.
Nature of the processing
As set forth in the Agreement and Wurl’s Advertising and Media Services Privacy Notice.
Purpose(s) of the data transfer and further processing
As set forth in the Agreement and Wurl’s Advertising and Media Services Privacy Notice.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Personal data will be retained in accordance with Wurl’s Advertising and Media Services Privacy Notice.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Those subprocessors contemplated by Wurl’s Advertising and Media Services Privacy Notice.
C. Competent Supervisory Authority:
The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.
D. Additional Data Transfer Impact Assessment Questions:
Will data importer process any personal data under the Clauses about a non-United States person that is “foreign intelligence information” as defined by 50 U.S.C. § 1801(e)?
Not to data importer’s knowledge.
Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Clauses? For example, FISA Section 702. If yes, please list these laws:
As of the effective date of the Clauses, no court has found data importer to be eligible to receive process issued under the laws contemplated by this question, including FISA Section 702, and no such court action is pending.
Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain:
No.
Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain:
No.
E. Data Transfer Impact Assessment Outcome:
Taking into account the information and obligations set forth in the Agreement and, as may be the case for a party, such party’s independent research, to the parties’ knowledge, the personal data originating in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the Clauses to a country that has not been found to provide an adequate level of protection under applicable data protection laws is afforded a level of protection that is essentially equivalent to that guaranteed by applicable data protection laws.
3. Annex II. Annex II shall read as follows:
Data importer will use commercially reasonable efforts to implement and maintain reasonable administrative, technical, and physical safeguards designed to protect personal data.
4. Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:
The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.
5. Signature Each party’s signature to the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.