Wurl Advertising Services Privacy Notice

Wurl Advertising Services Privacy Notice

Effective Date: November 9, 2021

SCOPE
ABOUT WURL’S ADVERTISING SERVICES
PERSONAL INFORMATION WE COLLECT
HOW WE USE PERSONAL INFORMATION
HOW WE DISCLOSE PERSONAL INFORMATION
INTERNATIONAL DATA TRANSFERS
YOUR CHOICES
YOUR PRIVACY RIGHTS
RETENTION OF PERSONAL INFORMATION
SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS
SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS
CHILDREN’S INFORMATION
OTHER PROVISIONS
CHANGES TO OUR PRIVACY NOTICE
CONTACT US

EXHIBIT A – SUPPLEMENTAL TERMS FOR THE STANDARD CONTRACTUAL CLAUSES

1. SCOPE

This Privacy Notice applies to personal information processed by Wurl, Inc. (“Wurl,” “we,” “us,” and “our”) through our AdPool and Wurl Perform advertising services (“Advertising Services”).

2. ABOUT WURL’S ADVERTISING SERVICES

Overview: Wurl provides a supply-side platform to publishers of online video content (i.e., Internet delivered video content) and a demand-side platform to buyers of digital advertising inventory displayed on online video content (i.e., advertisements/commercials displayed during the viewing of Internet delivered video content). Wurl’s Advertising Services help its publisher and advertiser clients achieve their monetization and advertising goals.

How it works:When a publisher that offers online video content wants to provide video advertisements to viewers of its content, it can work with supply-side platforms (e.g., Wurl) to reach potential advertisers. To do this, the publisher of this video content (which could be a streaming app or a channel/content provider within a streaming app) will share certain device level data about the device with the supply-side platforms when someone is viewing the publisher’s video content. The supply-side platforms then make this device level data available to demand-side platforms (e.g., Wurl and other demand-side platforms) in the form of “bid requests” (i.e., a request to bid on displaying an advertisement to the viewer of online video content).

Once a demand-side platform receives a bid request, it will help its advertiser clients decide how much to bid on displaying an advertisement based on a variety of factors.

When an advertiser has the highest bid to display an advertisement, it will win the bid request and video content viewer will see the advertiser’s advertisement displayed on the device.

3. PERSONAL INFORMATION WE COLLECT

A Quick Note: Before we describe the types of information collected by the Advertising Services, it is important to understand that all information processed by the Advertising Services is solely at the device level and cannot, by itself, be used to identify a natural person in the real world. However, certain privacy and data protection laws still consider this device level data to be “personal information” which is why we use this terminology in our Privacy Notice.

Below are the types of information which may be collected by the Advertising Services:

Bid Request Data. When Wurl receives a bid-request from one of its publisher clients or another supply-side platform, we collect device level data contained in the bid-request which may include:

An advertising ID or similar device ID about the device that is consuming online video content;
Details about the video content being viewed;
Details about the device such as the TV make and model;
Details about the application on the device through which the video content is being viewed;
Details about the user supplied permissions associated with the bid request (e.g., user opt out or consent preferences);
Country, time zone, and locale settings (country and preferred language);
City- and/or country-level geolocation data; and
IP address.

Data Collected by Wurl’s Advertiser Clients. Wurl’s advertiser clients may provide us with device level data that they have collected about users of their services. This information provides insight into interests of our advertiser client’s users. Wurl uses this information to create models that help the advertiser client determine what sort of users it should target with advertisements and how much it should spend on advertisements. Wurl is a “processor” or “service provider” of event data and may only use this data in accordance with our advertiser client’s written instructions.

Impression Data. When an advertiser client wins a bid and has its advertisement displayed on the device to the viewer of video content, Wurl may collect information in connection with delivering the ad including ad viewing and usage data through the use of beacons or pixels.

4. HOW WE USE PERSONAL INFORMATION

We use personal information for a variety of business purposes, including:

Providing the Advertising Services (including simultaneously acting as a supply-side platform and a demand-side platform, as applicable);
Sharing bid request data with demand-side platforms;
Developing profiles and insights about devices that view online video content;
Developing machine learning models;
Serving tailored ads on behalf of our advertiser clients;
Measuring the performance of and optimizing advertising campaigns on behalf of our clients;
Analyzing trends;
Deriving insights;
Pursuing legitimate interests, such as marketing, fraud prevention, frequency capping, research and development (including marketing research), and network and information security;
Generating de-identified and/or aggregated data;
Improving the Advertiser Services;
Developing new products and services;
Ensuring internal quality control and safety;
Enforcing our agreements;
Complying with our legal obligations; and
As you otherwise consent.

5. HOW WE DISCLOSE PERSONAL INFORMATION

We may share personal information with the following categories of third parties:

Demand-Side Platforms. Where we act as a supply-side platform on behalf of our publisher clients, we may share bid request data and data about impressions served with other demand-side platforms so that they can bid on and deliver advertisements. Any personal information we provide to the demand-side platform will also be subject to the demand-side platform’s privacy policy. Demand-side platforms are not our service providers or subprocessors. We are not responsible for the demand-side platform’s processing of personal information.

Advertiser Clients. If we, acting as a demand-side platform, deliver an advertisement to a viewer of video content on behalf of an advertiser client, we may share information related to that transaction with our advertiser client. Any personal information we provide to the advertiser client will also be subject to the advertiser client’s privacy policy. We are not responsible for the advertiser client’s processing of personal information.

Service Providers. We may share any personal information we collect about you with our third-party service providers that help us provide the Advertising Services.

Affiliates. We may share personal information with Wurl’s affiliated entities.

Disclosures to Protect Us or Others.We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.

Disclosure in the Event of Merger, Sale, or Other Asset Transfer. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

6. INTERNATIONAL DATA TRANSFERS

All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States and other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

7. YOUR CHOICES

You may be able to limit the collection and/or use of your personal information by Wurl and other demand-side platforms involved in the Advertising Services by adjusting your preferences as your device or application permits or by contacting us as set forth in “Contact Us” below. For more details about how to manage your preferences on some Internet connected TVs, read the instructions found here. In addition, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOSand others. For the most effective and up-to-date limit ad tracking methods, you should consult instructions provided by your device manufacturer or application/browser provider.

The online advertising industry also provides websites from which you may opt out of receiving targeted ads from organizations that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.

Please note you must separately opt out on each device and in each browser.

8. YOUR PRIVACY RIGHTS

Your Privacy Rights. In accordance with applicable law, you may have the right to:

Access Personal Informationabout you, including: (i) confirming whether we are processing your personal information; (ii) obtaining access to or a copy of your personal information; and (iii) receiving an electronic copy of personal information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);

Request Correction of your personal information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your personal information;

Request Deletion of your personal information;

Request Restriction of or Object to ourprocessing of your personal information; and

Withdraw your Consentto our processing of your personal information.

If you would like to exercise any of these rights, please contact us as set forth in “Contact Us” below. We will process such requests in accordance with applicable laws.

Please note that we are unable to authenticate any individuals whose device level data we receive from publishers of online video content and/or other supply-side partners. As a result, we may not be able to fulfill data subject requests that we receive.

9. RETENTION OF PERSONAL INFORMATION

We store the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, provide our Advertising Services, resolve disputes, establish legal defenses, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

10. SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

This Supplemental California Privacy Notice only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA provides California residents with the right to know what categories of personal information Wurl, in its capacity as a business, has collected about them and whether Wurl disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding 12 months. California residents can find this information below:

Category of Personal Information Collected by Wurl	Categories of Third Parties Personal Information is Disclosed to for a Business Purpose
Identifiers	· Demand-side platforms · Advertiser clients · Service providers
Commercial information	· Demand-side platforms · Advertiser clients · Service providers
Internet or other electronic network activity	· Demand-side platforms · Advertiser clients · Service providers
Inferences drawn from other personal information to create a profile about a consumer	· Demand-side platforms · Advertiser clients · Service providers

The categories of sources from which we collect personal information and our business and commercial purposes for using personal information are set forth above.

Additional Privacy Rights for California Residents

“Sales” of Personal Information under the CCPA.For purposes of the CCPA, Wurl does not “sell” personal information, nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.

Non-Discrimination.California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

Authorized Agent.Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To designate an authorized agent, please contact us as set forth below.

Verification. When you make a request, we are required to ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.

Please note that we are unable to authenticate any individuals whose device level data we receive from publishers of online video content and/or other supply-side partners.

11. SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal information to third parties who intend to license or sell that personal information. Please note that we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth below.

12. CHILDREN’S INFORMATION

The Advertising Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.

13. OTHER PROVISIONS

Third-Party Services. The Advertising Services may contain links to, be compatible, or receive personal information from third-party websites, applications, devices, or services (each a “Third-Party Service”) and other Third-Party Services may reference, link to, or interface with our Advertising Services. These Third-Party Services are not controlled by us. We encourage our users to read the privacy policies of each Third-Party Service with which they interact. We do not endorse, screen or approve, and are not responsible for, the practices or content of such other Third-Party Services. Interacting with Third-Party Services is at your own risk.

Supervisory Authority.If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law.

14. CHANGES TO OUR PRIVACY NOTICE

We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you by posting an updating notice online.

15. CONTACT US

If you have any questions about our privacy practices or this Privacy Notice, please contact us at:

Wurl, Inc.

101 University Ave, Suite 300

Palo Alto, CA 94301

United States of America

info@wurl.com

Exhibit A – Supplemental Terms for the Standard Contractual Clauses

If you are a Wurl customer that has entered into a commercial agreement with Wurl (“Agreement”), and the Agreement incorporates by reference Module One’s obligations set forth in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council(“Standard Contractual Clauses”), this Exhibit A forms part of the Agreement and supplements the Standard Contractual Clauses.

Wurl and the applicable Wurl customer agree that the following terms will supplement the Standard Contractual Clauses:

1. Supplemental Terms.The parties agree that the following terms shall supplement the Standard Contractual Clauses: (i) a new Clause 1(e) is added the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the applicable data protection laws of Switzerland and/or the United Kingdom. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss and/or United Kingdom law as it relates to transfers of personal data that are subject to such laws.”; (ii) the optional text in Clause 7 and Clause 11 is deleted; and (iii) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
2. Annex I. Annex I shall read as follows:
  - A. List of Parties
    - Data Exporter:
    - Name: The applicable Wurl customer.
    - Address: As set forth in the Notices section of the Agreement.
    - Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
    - Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.
    - Role: Controller.
    - Data Importer:
    - Name: Wurl.
    - Address: As set forth in the Notices section of the Agreement.
    - Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
    - Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.
    - Role: Controller.
  - B. Description of the Transfer

Categories of data subjects whose personal data is transferred

As set forth in Wurl’s Advertising Services Privacy Notice.

Categories of personal data transferred

As set forth in Wurl’s Advertising Services Privacy Notice.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

To Wurl’s knowledge, no sensitive data is transferred.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Personal data is transferred on a continuous basis by virtue of the Wurl customer’s use of the Services.

Nature of the processing

As set forth in the Agreement and Wurl’s Advertising Services Privacy Notice.

Purpose(s) of the data transfer and further processing

As set forth in the Agreement and Wurl’s Advertising Services Privacy Notice.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Personal data will be retained in accordance with Wurl’s Advertising Services Privacy Notice.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Those subprocessors contemplated by Wurl’s Advertising Services Privacy Notice.

1. - C. Competent Supervisory Authority:

The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

2. Annex II. Annex II shall read as follows:

Data importer will use commercially reasonable efforts to implement and maintain reasonable administrative, technical, and physical safeguards designed to protect personal data.

Signature Each party’s signature to the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.