Data processing addendum

1. Definitions

For purposes of this DPA:

• "Agreement" means the Terms of Service or other written agreement governing Customer's use of the Services.
• "Customer Personal Data" means personal data processed by AdMesh on behalf of Customer under the Agreement.
• "Data Protection Laws" means applicable laws and regulations governing the processing of personal data, including the GDPR, UK GDPR, and applicable U.S. state privacy laws where relevant.
• "GDPR" means Regulation (EU) 2016/679.
• "UK GDPR" means the GDPR as incorporated into United Kingdom law, as amended.
• "Personal data," "processing," "controller," and "processor" have the meanings given under applicable Data Protection Laws.
• "Services" means the AdMesh platform, APIs, SDKs, and related services provided under the Agreement.
• "Subprocessor" means a third party engaged by AdMesh to process Customer Personal Data on Customer's behalf.

2. Scope and Roles of the Parties

In respect of Customer Personal Data, Customer acts as a controller, business, or processor, as applicable under Data Protection Laws. AdMesh processes Customer Personal Data on Customer's behalf as a processor or subprocessor and, where applicable, as a service provider, in accordance with this DPA and Customer's documented instructions.

Where Customer acts as a processor for another controller, Customer represents and warrants that it is authorized to engage AdMesh as a subprocessor and to issue the instructions contemplated by the Agreement and this DPA on that controller's behalf.

AdMesh acts as an independent controller only to the extent it determines the purposes and means of processing personal data for account administration, billing, management of business relationships, security, fraud prevention, or legal compliance. Such processing is subject to Data Protection Laws, the Agreement, and AdMesh's Privacy Policy. This provision does not authorize AdMesh to use Customer Personal Data for unrelated purposes or limit its obligations under this DPA for processing carried out on Customer's behalf. Each party's role is determined by the relevant processing activity and applicable law.

3. Subject Matter and Duration

The subject matter of the processing is AdMesh's processing of Customer Personal Data on Customer's behalf in connection with the provision of the Services under the Agreement.

Processing shall continue for the duration of the Agreement and until Customer Personal Data is returned or deleted in accordance with Section 14. Any continued retention must comply with Data Protection Laws and Section 14. The protections and obligations of this DPA shall remain applicable for as long as AdMesh retains Customer Personal Data on Customer's behalf.

The nature of the processing includes receipt, recording, organization, storage, analysis, redaction, transmission, and deletion of Customer Personal Data, to the extent necessary to provide, secure, and support the Services. Processing purposes include recommendations and auctions, attribution and measurement, and authorized integrations, in accordance with Customer's documented instructions, the Agreement, this DPA, and Data Protection Laws.

4. Categories of Data and Data Subjects

Depending on the Services used and Customer's documented instructions, Customer Personal Data may comprise the following categories, to the extent processed by AdMesh on Customer's behalf:

• account and business contact information;
• query text, conversation context, and other user-provided content submitted through authorized integrations;
• account, platform, session, request, and event identifiers, timestamps, and related API and integration metadata;
• device, browser, IP address, usage, and technical log information;
• personal data contained in brand-agent, real-time offer, auction, recommendation, exposure, click, conversion, and attribution records;
• transaction and billing-related information processed on Customer's behalf; and
• additional categories expressly agreed in writing by the parties for the provision of the Services, subject to Data Protection Laws.

Data subjects may include Customer's personnel and authorized users; individuals who interact with Customer's platforms, properties, applications, or integrations; individual publishers and advertisers and personnel or representatives of publishers, advertisers, agencies, and partners; and other individuals whose personal data is lawfully submitted within the scope of the Services.

Customer shall ensure that personal data submitted for processing is adequate, relevant, and limited to what is necessary for the requested Services and that its collection and submission comply with Data Protection Laws, the Agreement, and this DPA. The categories described in this section do not authorize submission of information prohibited or restricted under the Agreement or Section 6 of this DPA.

5. Customer Instructions

AdMesh shall process Customer Personal Data only in accordance with Customer's documented instructions, including with respect to international transfers, unless required otherwise by applicable law. The Agreement, this DPA, and requests and settings submitted by Customer or its authorized users through supported Service interfaces constitute documented instructions to the extent consistent with the Agreement and this DPA.

Customer instructs AdMesh to carry out the processing described in Section 3, including processing reasonably necessary to maintain the security and reliability of the Services, troubleshoot issues, and prevent fraud and abuse on Customer's behalf. These instructions do not authorize processing for unrelated purposes. Additional instructions shall be provided in writing and comply with Data Protection Laws, the Agreement, and this DPA.

If applicable law requires processing beyond Customer's instructions, AdMesh shall inform Customer of that requirement before processing, unless the law prohibits such notice.

AdMesh shall immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws and may suspend the affected processing while the parties work to resolve the issue. AdMesh is not required to carry out unlawful instructions.

6. Customer Obligations

• Customer shall assess whether the Services are appropriate for its intended processing activities and shall comply with Data Protection Laws in its collection, submission, and use of Customer Personal Data and in its instructions to AdMesh.
• Customer represents and warrants that it has obtained and will maintain the rights, authority, and lawful basis necessary to submit Customer Personal Data and authorize the processing described in the Agreement and this DPA. Customer shall provide all legally required notices and obtain and maintain consent where required before submitting the relevant data.
• Customer shall implement applicable consent, withdrawal, and opt-out controls, communicate relevant user-choice signals through supported interfaces, and ensure that submissions and instructions respect those choices where required by law.
• Customer shall limit submissions to personal data necessary for the requested Services, remove unnecessary personal or confidential information, and take reasonable steps to maintain the accuracy and quality of the data it submits.
• Customer shall not submit or instruct AdMesh to process special-category personal data or other highly sensitive information unless AdMesh has expressly agreed in writing and all applicable legal requirements are satisfied. Query text and contextual content must not contain passwords, API keys, authentication tokens, or other credentials. Customer shall comply with the Agreement's restrictions concerning children's information and properties directed to children.
• Customer shall maintain appropriate security and access controls for its accounts, properties, and integrations and comply with applicable AdMesh integration documentation. Optional sanitization tools and automated redaction supplement these controls and do not discharge Customer's obligations under the Agreement, this DPA, or Data Protection Laws.
• Upon becoming aware of prohibited or unlawfully submitted data or unlawful instructions, Customer shall notify AdMesh without undue delay, cease the affected submissions or instructions, and reasonably cooperate in investigation and remediation.

Nothing in this section limits AdMesh's obligations under this DPA or Data Protection Laws.

7. Confidentiality and Personnel

AdMesh shall ensure that all persons it authorizes to process Customer Personal Data, including employees, contractors, and temporary personnel, are bound by contractual confidentiality obligations or an appropriate statutory duty of confidentiality covering that data.

Access to Customer Personal Data shall be limited to authorized persons who require it to perform their duties in connection with the Services. AdMesh shall require those persons to process the data only in accordance with Customer's documented instructions and this DPA, unless otherwise required by applicable law, and to comply with applicable security and confidentiality requirements.

8. Security Measures

AdMesh shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Such measures shall provide a level of security appropriate to the nature of the data and the risks associated with its processing, in accordance with Data Protection Laws.

9. Subprocessors

Customer grants AdMesh general written authorization to engage Subprocessors to process Customer Personal Data as necessary to provide the Services, subject to this DPA and Data Protection Laws. AdMesh shall maintain a current list of Subprocessors, including their processing functions and locations, and make it available to Customer upon request.

AdMesh shall provide reasonable advance written notice of any intended addition or replacement of a Subprocessor through the Services or another appropriate written channel, giving Customer a reasonable opportunity to object before the proposed Subprocessor processes Customer Personal Data.

Customer may object in writing on reasonable data-protection grounds, identifying the basis for its objection. The parties shall work in good faith to resolve the objection before the proposed Subprocessor processes the affected data. If no reasonable resolution is available, either party may terminate only the affected Services by written notice, subject to the Agreement and Data Protection Laws.

Before permitting a Subprocessor to process Customer Personal Data, AdMesh shall enter into a binding written agreement imposing data-protection obligations no less protective than those in this DPA, as applicable to the processing performed, including confidentiality, security, and any required international transfer safeguards.

AdMesh shall remain responsible to Customer for the performance of its Subprocessors' data-protection obligations under this DPA, in accordance with Data Protection Laws.

10. Assistance with Data Subject Requests

Taking into account the nature of the processing, AdMesh shall assist Customer through appropriate technical and organizational measures, insofar as possible, in fulfilling obligations to respond to requests concerning Customer Personal Data under Data Protection Laws. This assistance shall include, as applicable, requests for access, correction, deletion, portability, restriction of processing, and objections to processing, and shall be provided in time to enable compliance with applicable legal deadlines.

If AdMesh receives a request directly relating to Customer Personal Data processed on Customer's behalf, AdMesh shall notify Customer without undue delay, unless prohibited by law. AdMesh may acknowledge receipt or direct the individual to Customer, but shall not otherwise respond substantively except on Customer's documented instructions or as required by law.

Customer remains responsible for assessing and responding to requests, or coordinating with the relevant controller where Customer acts as a processor, including any required identity verification and determination of applicable rights and exemptions. Customer shall provide timely instructions and only the information reasonably necessary for AdMesh to locate the relevant data and provide assistance. Nothing in this section limits either party's obligations under Data Protection Laws.

11. Assistance with Compliance

Taking into account the nature of the processing and the information available to AdMesh, AdMesh shall provide assistance required under Data Protection Laws in relation to Customer Personal Data, including assistance with:

• assessing and maintaining security appropriate to the risks associated with the processing;
• evaluating personal data breaches and preparing required notifications to supervisory authorities and affected individuals;
• conducting data protection impact assessments where required; and
• undertaking required prior consultations with supervisory authorities.

AdMesh shall provide relevant information available to it and reasonably cooperate with Customer in a timely manner to support compliance with applicable legal deadlines. Customer shall identify the assistance requested, provide reasonably necessary information, and communicate relevant deadlines. Customer remains responsible, as applicable to its role, for its assessments, compliance decisions, and required notifications or consultations, including coordination with the relevant controller where Customer acts as a processor. This assistance does not limit AdMesh's own obligations under this DPA or Data Protection Laws, including Sections 8 and 12.

12. Security Incidents

AdMesh shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data processed by AdMesh or its Subprocessors. For this purpose, a personal data breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

To the extent known at the time of notification, AdMesh shall provide:

• a description of the nature of the breach, including the categories and approximate numbers of affected individuals and personal data records, where available;
• the likely consequences of the breach;
• measures taken or proposed to address the breach and mitigate its adverse effects; and
• a contact point for further information and coordination.

AdMesh shall not delay the initial notice pending completion of its investigation or availability of all relevant information. Additional information may be provided in stages without undue further delay as it becomes available. Customer shall maintain current contact details for receipt of such notices.

AdMesh shall take reasonable steps to investigate, contain, and remediate the breach and mitigate its effects, and shall reasonably cooperate with Customer in fulfilling applicable breach-response and notification obligations. Customer remains responsible, as applicable to its role, for assessing and making required notifications to supervisory authorities and affected individuals, including coordination with the relevant controller where Customer acts as a processor. Nothing in this section limits AdMesh's own obligations under Data Protection Laws.

13. Audits and Information

AdMesh shall make available to Customer the information necessary to demonstrate compliance with this DPA and applicable processor obligations under Data Protection Laws. Where available, relevant documentation, audit reports, and certifications may be used to support Customer's review without unnecessary duplication.

AdMesh shall allow for and contribute to audits, including inspections, conducted by Customer or a qualified independent auditor appointed by Customer in accordance with Data Protection Laws. Review of existing documentation shall not replace or restrict an audit or inspection required by applicable law.

The parties shall reasonably coordinate the scope, timing, frequency, and duration of an audit to limit unnecessary disruption. Audits shall ordinarily take place during normal business hours on reasonable advance written notice, with appropriate confidentiality and security safeguards. Shorter notice or additional audits shall be accommodated where required by law, a competent authority, or reasonably necessary to investigate a personal data breach or suspected material noncompliance. Safeguards shall protect other customers' information and unrelated confidential information while enabling verification of relevant compliance obligations.

Customer shall bear the costs of its appointed auditor. Any reimbursement of AdMesh's reasonable, documented audit-support costs must be agreed in advance and permitted by Data Protection Laws. Cost arrangements and audit procedures shall not prevent or unreasonably delay the exercise of legally required audit rights. Nothing in this section restricts the powers of a competent supervisory authority.

14. Return and Deletion of Data

Upon termination or expiry of the Services involving Customer Personal Data, AdMesh shall, at Customer's choice, return or delete that data and delete existing copies without undue delay, unless applicable law requires its storage. Customer shall communicate its choice through timely written instructions, including instructions from the relevant controller where Customer acts as a processor. In the absence of instructions requesting return, AdMesh shall delete the data in accordance with this section.

Where retention is required by law, AdMesh shall retain only the data required for the applicable period, restrict processing to that legal requirement and protection of the retained data, and continue to apply this DPA's safeguards. AdMesh shall inform Customer of such retention unless prohibited by law and delete the data when the requirement ends.

Where immediate deletion from backup copies is not technically practicable, AdMesh shall put the affected data beyond ordinary use, maintain appropriate safeguards, and securely delete it as soon as reasonably practicable through the applicable backup deletion cycle. Backup retention shall not authorize continued use of the data for other purposes.

AdMesh shall require its Subprocessors to comply with applicable return and deletion obligations. Upon Customer's written request, AdMesh shall confirm completion and identify any remaining data retained under this section and the basis for its continued retention.

15. International Transfers

Customer authorizes processing of Customer Personal Data in the United States and other countries where AdMesh or its authorized Subprocessors operate, subject to Customer's documented instructions, Section 9, and Data Protection Laws. This authorization does not by itself establish a lawful mechanism for an international transfer.

Before a transfer subject to restrictions under Data Protection Laws takes place, the parties shall ensure, in accordance with their respective roles, that an applicable lawful transfer mechanism is in place. This may include a relevant adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum to those clauses, or another mechanism permitted by applicable law, subject to its requirements.

Where contractual transfer safeguards are required, the relevant parties shall execute or validly incorporate the applicable clauses and complete the required transfer details and annexes before relying on them. The parties shall cooperate in carrying out required transfer assessments, and AdMesh shall provide relevant information reasonably available to it and implement supplementary safeguards where required by Data Protection Laws.

AdMesh shall ensure that transfers it makes or arranges, including onward transfers to Subprocessors, comply with the applicable transfer mechanism. If that mechanism ceases to be valid or its requirements cannot be met, AdMesh shall suspend the affected transfers unless and until a lawful alternative is in place. Any mandatory transfer clauses shall prevail over conflicting provisions of this DPA or the Agreement to the extent of that conflict.

16. CCPA and Similar U.S. Laws

This section applies to Customer Personal Data processed on Customer's behalf that is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations ("CCPA"), or other applicable U.S. state privacy laws. AdMesh shall act as a service provider or contractor under the CCPA, or as a processor under other applicable laws, according to the relevant processing activity. Terms specific to those laws have their statutory meanings.

Customer discloses such personal information for the limited purposes of analyzing submitted intent and context, evaluating brand-agent offers, conducting auctions, delivering sponsored recommendations, providing attribution and reporting, supporting authorized integrations, and securing and troubleshooting those Services on Customer's behalf. In processing that information, AdMesh shall:

• not sell or share it, as those terms are defined by the CCPA, or use it for cross-context behavioral advertising;
• limit its retention, use, and disclosure to the specified service purposes or uses expressly permitted by applicable law;
• not retain, use, or disclose it outside the direct business relationship with Customer, except as expressly permitted by applicable law; and
• not combine it with personal information received from other customers or sources, or collected through AdMesh's own interactions with individuals, except as expressly permitted by applicable law.

AdMesh shall comply with applicable obligations under those laws, afford the level of privacy protection they require, and assist Customer with applicable consumer requests in accordance with Section 10. AdMesh certifies that it understands and shall comply with the restrictions in this section and shall notify Customer without undue delay if it determines that it can no longer meet its applicable obligations.

Customer may take reasonable and appropriate steps to verify that AdMesh's processing complies with Customer's applicable obligations, including through Section 13, and, upon notice, to stop and remediate unauthorized use. AdMesh shall cooperate with those steps and impose the applicable statutory requirements on Subprocessors through written agreements in accordance with Section 9. Nothing in the Agreement authorizes processing prohibited by this section or applicable law.

17. Order of Precedence

In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict solely in relation to the processing of Customer Personal Data.

Where transfer safeguards are validly incorporated or entered into pursuant to Section 15, their mandatory hierarchy and precedence provisions shall apply. Neither this DPA nor the Agreement shall override those provisions or reduce protections required by Data Protection Laws.

Except as expressly amended by this DPA, the Agreement remains in full force and effect. Nothing in this DPA excludes or limits obligations or individual rights that cannot lawfully be excluded or limited.

18. Contact

For questions concerning this DPA or requests for assistance under it relating to Customer Personal Data, contact AdMesh at legal@useadmesh.com.