Wurl Advertising Services Privacy Notice

Effective Date: July 1, 2023

SCOPE
ABOUT WURL’S ADVERTISING SERVICES
PERSONAL INFORMATION WE COLLECT
HOW WE USE PERSONAL INFORMATION
HOW WE DISCLOSE PERSONAL INFORMATION
INTERNATIONAL DATA TRANSFERS
YOUR CHOICES
YOUR PRIVACY RIGHTS
RETENTION OF PERSONAL INFORMATION
SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS
SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS
CHILDREN’S INFORMATION
OTHER PROVISIONS
CHANGES TO OUR PRIVACY NOTICE
CONTACT US

EXHIBIT A – SUPPLEMENTAL TERMS FOR THE STANDARD CONTRACTUAL CLAUSES

Notice at Collection. At or before the time of collection, California residents may have a right to receive notice of our practices, including the categories of personal information to be collected, the purposes for which such information is collected or used, whether such information is sold or shared and how to opt-out of such uses, and how long such information is retained. You can find those details by clicking on the above links.

1. SCOPE

This Privacy Notice applies to personal information processed by Wurl, Inc. and WURL NETWORK UK, LTD (“Wurl,” “we,” “us,” and “our”) through our performance marketing services or supply-side platform (SSP) services (our “Advertising Services”).

2. ABOUT WURL’S ADVERTISING SERVICES

Overview: Wurl provides a supply-side platform to publishers of online video content (i.e., Internet delivered video content) and a demand-side platform to buyers of digital advertising inventory displayed on online video content (i.e., advertisements/commercials displayed during the viewing of Internet delivered video content). Wurl’s Advertising Services help its publisher and advertiser clients achieve their monetization and advertising goals.

How it works:When a publisher that offers online video content wants to provide video advertisements to viewers of its content, it can work with supply-side platforms (e.g., Wurl) to reach potential advertisers. To do this, the publisher of this video content (which could be a streaming app or a channel/content provider within a streaming app) will share certain device level data about the device with the supply-side platforms when someone is viewing the publisher’s video content. The supply-side platforms then make this device level data available to demand-side platforms (e.g., Wurl and other demand-side platforms) in the form of “bid requests” (i.e., a request to bid on displaying an advertisement to the viewer of online video content).

Once a demand-side platform receives a bid request, it will help its advertiser clients decide how much to bid on displaying an advertisement based on a variety of factors.

When an advertiser has the highest bid to display an advertisement, it will win the bid request and video content viewer will see the advertiser’s advertisement displayed on the device.

3. PERSONAL INFORMATION WE COLLECT

A Quick Note: Before we describe the types of information collected by the Advertising Services, it is important to understand that all information processed by the Advertising Services is solely at the device level and cannot, by itself, be used to identify a natural person in the real world. However, certain privacy and data protection laws still consider this device level data to be “personal information” which is why we use this terminology in our Privacy Notice.

Below are the types of information which may be collected by the Advertising Services:

Bid Request Data. When Wurl receives a bid-request from one of its publisher clients or another supply-side platform, we collect device level data contained in the bid-request which may include:

An advertising ID or similar device ID about the device that is consuming online video content;
Details about the video content being viewed;
Details about the device such as the TV make and model;
Details about the application on the device through which the video content is being viewed;
Details about the user supplied permissions associated with the bid request (e.g., user opt out or consent preferences);
Country, time zone, and locale settings (country and preferred language);
City- and/or country-level geolocation data; and
IP address.

Data Collected by Wurl’s Advertiser Clients. Wurl’s advertiser clients may provide us with device level data that they have collected about users of their services. This information provides insight into interests of our advertiser client’s users. Wurl uses this information to create models that help the advertiser client determine what sort of users it should target with advertisements and how much it should spend on advertisements. Wurl is a “processor” or “third-party” of event data and may only use this data in accordance with our advertiser client’s written instructions.

Impression Data. When an advertiser client wins a bid and has its advertisement displayed on the device to the viewer of video content, Wurl may collect information in connection with delivering the ad including ad viewing and usage data through the use of beacons or pixels.

4. HOW WE USE PERSONAL INFORMATION

We use personal information for a variety of business purposes, including: (i) to perform and provide the Advertising Services, (ii) for Wurl’s product development, implementation, and improvement purposes, and (iii) for pursuing legitimate interests, such as marketing, fraud prevention, quality control, and security.

5. HOW WE DISCLOSE PERSONAL INFORMATION

We may share personal information with the following categories of third parties:

Supply-Side Platforms and Demand-Side Platforms. Where we act as a supply-side platform on behalf of our publisher clients, we may share bid request data and data about impressions served with other supply-side platforms and demand-side platforms so that they, or parties they work with, can bid on and deliver advertisements.

Any personal information we provide to the supply-side platform and/or the demand-side platform will also be subject to such party’s privacy policy (and potentially the privacy policy of other third-party recipients that they disclose personal information to). Supply-side platforms, demand-side platforms, and any third parties they work with are not our service providers or subprocessors. We are not responsible for the processing of personal information by supply-side platforms, demand-side platforms, and/or any third parties they work with.

Advertiser Clients. If we, acting as a demand-side platform, deliver an advertisement to a viewer of video content on behalf of an advertiser client, we may share information related to that transaction with our advertiser client. Any personal information we provide to the advertiser client will also be subject to the advertiser client’s privacy policy. We are not responsible for the advertiser client’s processing of personal information.

Service Providers. We may share any personal information we collect about you with our third-party service providers that help us provide the Advertising Services.

Affiliates. We may share personal information with Wurl’s affiliated entities.

Disclosures to Protect Us or Others.We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.

Disclosure in the Event of Merger, Sale, or Other Asset Transfer. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

6. INTERNATIONAL DATA TRANSFERS

All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States and other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

If we transfer personal information which originates in the European Economic Area, Switzerland, and/or the United Kingdom to a country that has not been found to provide an adequate level of protection under applicable data protection laws, one of the safeguards we may use to support such transfer is the EU Standard Contractual Clauses.

For more information about the safeguards we use for international transfers of your personal information, please contact us as set forth below.

7. YOUR CHOICES

You may be able to limit the collection and/or use of your personal information by Wurl and other supply-side and demand-side platforms involved in the Advertising Services by adjusting your preferences as your device or application permits or by contacting us as set forth in “Contact Us” below. For more details about how to manage your preferences on some Internet connected TVs, read the instructions found here. In addition, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. For the most effective and up-to-date limit ad tracking methods, you should consult instructions provided by your device manufacturer or application/browser provider.

The online advertising industry also provides websites from which you may opt out of receiving targeted ads from organizations that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada.

Please note you must separately opt out on each device and in each browser.

8. YOUR PRIVACY RIGHTS

Your Privacy Rights. In accordance with applicable law, you may have the right to:

Confirm Whether We Are Processing Your Personal Information (the right to know);
Request Access to and Portability of Your Personal Information, including: (i) obtaining access to or a copy of your personal information; and (ii) receiving an electronic copy of personal information that you have provided to us, or asking us to send that information to another company in a structured, commonly used, and machine readable format (also known as the “right of data portability”);

Request Correction of your personal information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your personal information;

Request Deletion of your personal information;

Request to Opt-Out of Certain Processing Activities including, as applicable, if we process your personal information for “targeted advertising” (as “targeted advertising” is defined by applicable privacy laws), if we “sell” your personal information (as “sell” is defined by applicable privacy laws), or if we engage in “profiling” in furtherance of certain “decisions that produce legal or similarly significant effects” concerning you (as such terms are defined by applicable
privacy laws);
Request Restriction of or Object to ourprocessing of your personal information; and

Withdraw your Consentto our processing of your personal information.

If you would like to exercise any of these rights, please contact us as set forth in “Contact Us” below. We will process such requests in accordance with applicable laws.

To protect your privacy, we will take steps to reasonably verify your identity before fulfilling requests submitted under applicable privacy laws. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.

Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your personal information. If your personal information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent using the information found in “Contact Us” below and ask us for additional instructions.

Please note that we are unable to authenticate any individuals whose device level data we receive from publishers of online video content and/or other supply-side partners. As a result, we may not be able to fulfill data subject requests that we receive.

Some laws may allow you to appeal our decision if we decline to process your request. If applicable laws grant you an appeal right and you would like to appeal our decision with respect to your request, you may do so by informing us of this and providing us with information supporting your appeal.

If your personal information is subject to the applicable data protection laws of the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority if you believe our processing of your personal information violates applicable law.

EEA Data Protection Authorities (DPAs)
Swiss Federal Data Protection and Information Commissioner (FDPIC)
UK Information Commissioner’s Office (ICO)

9. RETENTION OF PERSONAL INFORMATION

We store the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, provide our Advertising Services, resolve disputes, establish legal defenses, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

To determine the appropriate retention period for personal information, we may consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, certain risk factors, the purposes for which we process your personal information, and whether we can achieve those purposes through other means.

10. SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

This Supplemental Notice for California Residents supplements our Privacy Notice and only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (as amended from time to time) (“CCPA”).

The CCPA provides California residents with the right to know what categories of personal information Wurl has collected about them whether Wurl disclosed that personal information for a business purpose (e.g., to a service provider), whether Wurl “sold” that personal information, and whether Wurl “shared” that personal information for “cross-context behavioral advertising” in the preceding twelve months. California residents can find this information below:

Category of Personal Information Collected by Wurl	Categories of Third Parties Personal Information is Disclosed to for a Business Purpose
Identifiers	· Demand-side platforms · Advertiser clients · Service providers
Commercial information	· Demand-side platforms · Advertiser clients · Service providers
Internet or other electronic network activity	· Demand-side platforms · Advertiser clients · Service providers
Inferences drawn from other personal information to create a profile about a consumer	· Demand-side platforms · Advertiser clients · Service providers

The categories of sources from which we collect personal information and our business and commercial purposes for using above.and disclosing personal information are set forth in “Personal Information We Collect”, “How We Use Personal Information”, and “How We Disclose Personal Information” above, respectively. We will retain personal information in accordance with the time periods set forth in “Retention of Personal Information.”

Under the CCPA, there is uncertainty regarding what may be (1) a “sale” of personal information and/or (2) “sharing” personal information for “cross-context behavioral advertising.” For example, it is unclear whether or not a Wurl’s disclosure of bid request data to supply-side and/or demand-side platforms is a “sale” of personal information. To the extent Wurl’s processing of personal information is considered “selling” or “sharing”, we “sell” and “share” your personal information to provide you with “cross-context behavioral advertising” about products and services that may be of interest you.

Additional Privacy Rights for California Residents

Opting Out of “Sales” of Personal Information and/or “Sharing” for Cross-Context Behavioral Advertising under the CCPA. California residents have the right to opt out of the “sale” of personal information and the “sharing” of personal information for “cross-context behavioral advertising.” To the extent Wurl’s processing of personal information is considered “selling” or “sharing”, California residents may exercise these rights by contacting us as set forth in “Contact Us” below.

For more details about how to manage your preferences on some Internet connected TVs, read the instructions found here. In addition, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others. For the most effective and up-to-date limit ad tracking methods, you should consult instructions provided by your device manufacturer or application/browser provider.

Disclosure Regarding Individuals Under the Age of 16. Wurl does not have actual knowledge of any “sale” of personal information of minors under 16 years of age. Wurl does not have actual knowledge of any “sharing” of personal information of minors under 16 years of age for “cross-context behavioral advertising.”

Disclosure Regarding Sensitive Personal Information. Wurl does not knowingly collect any sensitive
personal information via the Advertising Services.

Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

11. SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal information to third parties who intend to license or sell that personal information. Please note that we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth below.

12. CHILDREN’S INFORMATION

The Advertising Services are not directed to children under 16 (or other age as required by local law outside of the United States), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.

13. OTHER PROVISIONS

Third-Party Services. The Advertising Services may contain links to, be compatible, or receive personal information from third-party websites, applications, devices, or services (each a “Third-Party Service”) and other Third-Party Services may reference, link to, or interface with our Advertising Services. These Third-Party Services are not controlled by us. We encourage our users to read the privacy policies of each Third-Party Service with which they interact. We do not endorse, screen or approve, and are not responsible for, the practices or content of such other Third-Party Services. Interacting with Third-Party Services is at your own risk.

14. CHANGES TO OUR PRIVACY NOTICE

We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you by posting an updating notice online.

15. CONTACT US

Wurl is the controller of the personal information we process under this Privacy Notice.

If you have any questions about our privacy practices or this Privacy Notice, please contact us at:

WURL, LLC
101 University Ave, Suite 300
Palo Alto, CA 94301
United States of America

info@wurl.com

EU and UK Privacy Representatives

We have appointed Prighter Group as our privacy representatives in the EU and UK. You can contact us through our privacy representatives at the following addresses:

For residents of the EU:
PrighterGDPR-Rep by Maetzler Rechtsanwalts GmbH & Co KG
c/o Wurl, LLC
Schellinggasse 3/10
1010 Vienna
Austria

For residents of the UK:
PrighterUK-Rep by Prighter Ltd.
c/o Wurl, LLC
20 Mortlake Mortlake High Street
London, SW14 8JN
United Kingdom

Additional information regarding our privacy representatives can be found at the following links:

https://prighter.com/q/18612339371
https://prighter.com/q/17903445896

Exhibit A – Supplemental Terms for the Standard Contractual Clauses

If you are a Wurl customer that has entered into a commercial agreement with Wurl (“Agreement”), and the Agreement incorporates by reference Module One’s obligations set forth in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council(“Standard Contractual Clauses”), this Exhibit A forms part of the Agreement and supplements the Standard Contractual Clauses.

Wurl and the applicable Wurl customer agree that the following terms will supplement the Standard Contractual Clauses:

1. Supplemental Terms.The parties agree that the following terms shall supplement the Standard Contractual Clauses: (i) a new Clause 1(e) is added the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 and Clause 11 is deleted; and (iv) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
2. Annex I. Annex I shall read as follows:

A. List of Parties

Data Exporter:

Name: The applicable Wurl customer.

Address: As set forth in the Notices section of the Agreement.

Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.

Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.

Role: Controller.

Data Importer:

Name: Wurl.

Address: As set forth in the Notices section of the Agreement.

Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.

Activities relevant to the data transferred under these Clauses: As set forth in the Agreement and/or Annex I, Section B of the Standard Contractual Clauses.

Role: Controller.

B. Description of the Transfer

Categories of data subjects whose personal data is transferred

As set forth in Wurl’s Advertising Services Privacy Notice.

Categories of personal data transferred

As set forth in Wurl’s Advertising Services Privacy Notice.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

To Wurl’s knowledge, no sensitive data is transferred.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Personal data is transferred on a continuous basis by virtue of the Wurl customer’s use of the Services.

Nature of the processing

As set forth in the Agreement and Wurl’s Advertising Services Privacy Notice.

Purpose(s) of the data transfer and further processing

As set forth in the Agreement and Wurl’s Advertising Services Privacy Notice.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Personal data will be retained in accordance with Wurl’s Advertising Services Privacy Notice.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Those subprocessors contemplated by Wurl’s Advertising Services Privacy Notice.

C. Competent Supervisory Authority:

The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

D. Additional Data Transfer Impact Assessment Questions:

Will data importer process any personal data under the Clauses about a non-United States person that is “foreign intelligence information” as defined by 50 U.S.C. § 1801(e) ?

Not to data importer’s knowledge.

Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Clauses? For example, FISA Section 702. If yes, please list these laws:

As of the effective date of the Clauses, no court has found data importer to be eligible to receive
process issued under the laws contemplated by this question, including FISA Section 702, and no
such court action is pending.

Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain:

No.

Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain:

No.

E. Data Transfer Impact Assessment Outcome:

Taking into account the information and obligations set forth in the Agreement and, as may be the case for a party, such party’s independent research, to the parties’ knowledge, the personal data originating in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the Clauses to a country that has not been found to provide an adequate level of protection under applicable data protection laws is afforded a level of protection that is essentially equivalent to that guaranteed by applicable data protection laws.

Annex II. Annex II shall read as follows:

Data importer will use commercially reasonable efforts to implement and maintain reasonable administrative, technical, and physical safeguards designed to protect personal data.

Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as
follows:

The UK Information Commissioner’s Office International Data Transfer Addendum to the EU
Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.

Table 1: The start date in Table 1 is the effective date of the Addendum. All other information
required by Table 1 is set forth in Annex I, Section A of the Clauses.

Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK
Addendum is appended to including the Appendix Information, effective as of the effective date of
the Addendum.

Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.

Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.

Signature Each party’s signature to the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.