Publisher Services Agreement

This Publisher Services Agreement (the "Agreement") is between Yolla Media, LLC, a Delaware limited liability company with its principal office at 750 Lexington Avenue, 8th Floor, New York, NY 10022 ("Yolla", "we", "us"), and the person or entity that accepts it (the "Publisher", "you"). You accept this Agreement by clicking to accept it when you enroll in the Services, by signing an order or insertion form that references it, or by placing the Yolla Codes on a Site. If you accept on behalf of a company, you confirm that you are authorized to bind it.

1. Definitions

1.1 "Ads" means advertising of any format — including display, native, rich media, and pre-roll, mid-roll and outstream video — served on a Site through the Services.

1.2 "Ad Partners" means the third parties through which Yolla sells or serves Ads, including Google Ad Manager, supply-side platforms, ad exchanges, header-bidding and identity partners, and advertisers and their agencies.

1.3 "Advertising Privacy Statement" means Yolla's statement for visitors to publisher sites, currently at https://yollamedia.com/advertising-privacy, as updated from time to time.

1.4 "Data Protection Addendum" or "DPA" means the addendum attached as Exhibit A.

1.5 "Gross Revenue" means the amounts Yolla actually receives from Ad Partners for Ads served on a Site through the Services. Amounts an Ad Partner reports as earned but has not paid to Yolla are not Gross Revenue until Yolla receives them.

1.6 "Invalid Traffic" or "IVT" means any impression, click, view, conversion or other event that is not the result of genuine human interest, including traffic that is general or sophisticated invalid traffic under the Media Rating Council's Invalid Traffic Detection and Filtration Guidelines, traffic generated by bots, crawlers, scripts, click farms, incentives, deceptive placements, auto-refresh not permitted by Ad Partner policies, ad stacking, pixel stuffing, or domain spoofing, and any traffic an Ad Partner classifies as invalid.

1.7 "Net Revenue" has the meaning in Section 7.2.

1.8 "Portal" means the Yolla publisher portal at portal.yollamedia.com or any successor site.

1.9 "Program Policies" means Yolla's content, implementation and technical requirements for Sites, as published in the Portal and updated under Section 17.

1.10 "Services" means the ad sales, ad placement, ad-revenue optimization, consent-management and reporting services Yolla provides under this Agreement.

1.11 "Site" means each website, domain, subdomain or other property you designate in the Portal or in an order form and Yolla accepts.

1.12 "Yolla Codes" means the scripts, tags, libraries, SDKs and configuration Yolla provides for placing Ads and delivering the Services, including any consent-management platform Yolla provides.

2. Appointment and exclusivity

2.1 Appointment. You appoint Yolla, during the Term, as the exclusive worldwide provider of programmatic and other ad sales, ad management and ad-revenue optimization services for each Site, on every device and platform on which the Site is available.

2.2 No other providers. During the Term you will not, for any Site, (a) appoint or allow any other ad network, ad-management provider, header-bidding wrapper, monetization partner or reseller to sell or serve advertising, or (b) sell or serve advertising yourself through programmatic channels, in each case unless Yolla agrees in writing.

2.3 Direct-sold campaigns. You may run campaigns you sell directly to an advertiser, provided they are served through Yolla's ad-server set-up and do not use any other programmatic channel. Revenue from those campaigns is not Gross Revenue.

3. The Services

3.1 What Yolla provides. Yolla will: (a) sell Ads on the Sites through Ad Partners it selects; (b) recommend Ad layouts, placements, sizes and formats; (c) provide and host the Yolla Codes; (d) optimize the yield of Ad inventory, including through pricing floors and bidder selection; (e) provide a consent-management platform for use on the Sites as described in the DPA; and (f) make earnings and performance reports available in the Portal.

3.2 Changes to the Services. Yolla may change, add or remove features, Ad Partners or formats at any time. Yolla will give you at least 30 days' notice by email of any change that materially reduces the Services, except where an Ad Partner, platform or law requires a faster change.

3.3 Ad Partners. Yolla chooses its Ad Partners and may add or remove them. Yolla's principal Ad Partners are listed in the Advertising Privacy Statement. Yolla does not guarantee any level of fill, CPM or revenue.

4. Implementation and your responsibilities

4.1 Yolla Codes. You will place the Yolla Codes on each Site as instructed and will not modify, block, delay, wrap or reverse-engineer them, or add third-party code that interferes with them.

4.2 Program Policies and Ad Partner terms. You will comply with the Program Policies and with the policies of Ad Partners that apply to your Sites, including the Google Publisher Policies and Google Ad Manager program policies. Yolla will make those policies available or link to them in the Portal.

4.3 Site content. Each Site must not: (a) contain content that is illegal, sexually explicit, hateful, violent, or that infringes intellectual property or other rights; (b) distribute malware or unwanted software; (c) encourage anyone to click or view Ads, or place Ads in a way that is misleading or likely to cause accidental clicks; or (d) be directed to children under 13, or to children under 16 in the EEA, UK or Switzerland, unless you have told Yolla in writing and Yolla has agreed to treat that Site as child-directed.

4.4 Access. You will give Yolla the access to your Sites, analytics and ad-server settings that Yolla reasonably needs to provide the Services. You are responsible for keeping your Portal credentials secure and for all activity under your account.

5. ads.txt, sellers.json and supply-chain transparency

5.1 ads.txt. Within five (5) business days of Yolla's request, you will publish on each Site's root domain the ads.txt (and, for apps, app-ads.txt) entries Yolla provides, and keep them published and current throughout the Term. You will not list sellers for a Site's inventory that Yolla has not authorized, and you will not remove or alter Yolla's entries except at Yolla's request or after termination.

5.2 sellers.json. Yolla will list you in its sellers.json file as the publisher of the Sites' inventory, with your legal name and business domain, in line with the IAB Tech Lab sellers.json specification. You may ask Yolla to mark your entry confidential where the specification and Ad Partner requirements allow it.

5.3 SupplyChain object. Yolla will pass a complete SupplyChain object (schain) in bid requests for the Sites' inventory where Ad Partners support it.

5.4 Managerdomain. Yolla may ask you to include a MANAGERDOMAIN line naming Yolla in your ads.txt files.

5.5 After termination. Within ten (10) business days after termination you will remove Yolla's ads.txt entries, and Yolla will remove your sellers.json entry.

6. Invalid Traffic and fraud

6.1 Prohibitions. You will not, and will not allow anyone to, generate or attempt to generate Invalid Traffic, including by buying traffic that you know or should reasonably suspect contains Invalid Traffic.

6.2 Monitoring. Yolla and its Ad Partners may monitor the Sites' traffic for Invalid Traffic using their own and third-party tools. You will cooperate with any reasonable investigation, including by disclosing your traffic-acquisition sources on request.

6.3 No payment for IVT. Yolla is not required to pay you for any revenue that is attributable to Invalid Traffic, or that an Ad Partner withholds, reverses, refunds, charges back or does not pay because of Invalid Traffic, a policy violation, or a dispute with an advertiser (together, "Clawbacks"). Yolla may deduct Clawbacks from Gross Revenue, withhold them from any payment, or offset them against later payments, including Clawbacks an Ad Partner makes after Yolla has paid you. If no later payment is due, you will repay Clawbacks within thirty (30) days of Yolla's invoice.

6.4 Evidence. Yolla will give you reasonable information about any Clawback, including the Ad Partner's notice where Yolla is permitted to share it.

6.5 Suspension. If Yolla reasonably suspects Invalid Traffic or a policy violation on a Site, it may pause Ads on that Site, or withhold payment for the affected period, while it investigates.

7. Revenue share and payment

7.1 Revenue share. Unless you and Yolla agree otherwise in writing, Yolla will pay you at least seventy-five percent (75%) of Net Revenue for each calendar month of the Term.

7.2 Net Revenue. "Net Revenue" for a calendar month means the Gross Revenue Yolla receives in that month, less: (a) Clawbacks; (b) fees charged by third parties for ad serving, data, identity, brand-safety, IVT-detection, video hosting and similar technology used to deliver the Services, to the extent attributable to the Sites; and (c) any sales, use, value-added or similar taxes on Gross Revenue (but not taxes on Yolla's income). Yolla is not liable to pay you any amount an Ad Partner fails to pay Yolla.

7.3 Timing. Yolla will pay the amount due for each calendar month within thirty (30) days after the end of that month.

7.4 Method, currency and threshold. Yolla pays in US dollars by the method you select in the Portal. If the amount due for a month is less than US$50, Yolla carries it forward and adds it to the next month's payment until the total due reaches US$50; any balance is paid in full after termination under Section 12.4. You bear your bank's and payment provider's receiving fees.

7.5 Tax. You will give Yolla a valid IRS Form W-9 or W-8 (or equivalent) before any payment. Yolla may withhold any taxes it is required by law to withhold. Each party is responsible for its own income taxes.

7.6 Payment details. You are responsible for keeping your payment details accurate. Yolla is not responsible for a payment sent to the details in your account.

8. Reporting and statements

8.1 Reports. Yolla will make daily estimated earnings and performance reports available in the Portal. Daily figures are estimates and may change as Ad Partners finalize their data and apply Clawbacks. Payments are based on Net Revenue under Section 7.2, which reflects revenue Yolla actually receives and may differ from, or arrive later than, reported earnings.

8.2 Monthly statement. Yolla will make a monthly statement of Gross Revenue, deductions and Net Revenue available in the Portal before paying you for that month.

8.3 Disputes. If you dispute a monthly statement, you must tell Yolla in writing, with reasonable detail, within sixty (60) days after the statement is available. Yolla will review the dispute in good faith and give you supporting information it is permitted to share. Statements not disputed in time are final and binding, absent manifest error.

8.4 Records. Yolla will keep records supporting its statements for at least two (2) years.

9. Privacy and data protection

9.1 Data Protection Addendum. The DPA (Exhibit A) governs how the parties handle personal data in connection with the Services. If this Agreement and the DPA conflict on a data-protection matter, the DPA controls.

9.2 Your privacy notice. Each Site must have a privacy policy that complies with applicable law, discloses that third parties (including Yolla and its Ad Partners) collect information through cookies and similar technologies for advertising, and links to Yolla's Advertising Privacy Statement.

9.3 Consent and opt-out tools. You will deploy, and not disable or alter, the consent-management and opt-out tools Yolla provides or approves, as described in the DPA, including a consent tool registered with the IAB Europe Transparency & Consent Framework (TCF) for visitors in the EEA, UK and Switzerland and a "Do Not Sell or Share My Personal Information" (or "Your Privacy Choices") link for visitors in the United States.

9.4 No personal information to Yolla. You will not pass to Yolla, through the Yolla Codes, URLs or otherwise, any names, email addresses (hashed or unhashed), phone numbers or other directly identifying information, or any sensitive personal information, unless Yolla agrees in writing.

10. Confidentiality

10.1 Confidential Information. "Confidential Information" means non-public information one party discloses to the other that is marked confidential or that a reasonable person would understand to be confidential, including the Yolla Codes, Yolla's pricing, Ad Partner and yield data, performance statistics, and any custom commercial terms. It does not include information that is or becomes public through no fault of the receiving party, that the receiving party already had or independently develops, or that it lawfully receives from a third party without a duty of confidentiality.

10.2 Obligations. The receiving party will use Confidential Information only to perform or receive the Services, protect it with at least reasonable care, and disclose it only to its employees, contractors and advisers who need it and are bound by similar duties. A party may disclose Confidential Information if required by law, after giving the other party prompt notice where lawful.

10.3 Duration. These obligations continue for three (3) years after termination, and for trade secrets for as long as they remain trade secrets.

10.4 Competitors. During the Term, you will not share Yolla's reports, yield data or configuration with any provider of services similar to the Services.

11. Intellectual property and data

11.1 Yolla's rights. Yolla and its licensors own the Services, the Yolla Codes, the Portal and all related technology. Yolla grants you a limited, non-exclusive, non-transferable, revocable license during the Term to use the Yolla Codes and Portal solely to receive the Services on the Sites.

11.2 Your rights. You own your Sites and their content. You grant Yolla and its Ad Partners a non-exclusive license during the Term to access, crawl, cache and display the Sites and their content as needed to provide the Services, including brand-safety and contextual classification.

11.3 Service data. Yolla may collect, use and retain data generated through the Services (such as auction, performance and traffic data) to provide, secure and improve the Services, subject to the DPA and applicable law. Yolla may create and use aggregated or de-identified data that does not identify you or any individual, including to benchmark and improve the Services, during and after the Term.

11.4 Publicity. Neither party will use the other's name or logo in marketing without consent, except that Yolla may list you in its sellers.json file and describe you as a Yolla publisher in confidential communications with Ad Partners.

12. Term and termination

12.1 Term. This Agreement starts when you accept it and continues until terminated (the "Term").

12.2 Termination for convenience. Either party may terminate this Agreement, or remove any Site from it, on thirty (30) days' written notice. You give notice to legal@yollamedia.com; Yolla gives notice to your account email.

12.3 Termination for cause. Yolla may suspend the Services or terminate this Agreement, in whole or for any Site, immediately on notice if: (a) a Site generates or Yolla reasonably suspects Invalid Traffic; (b) you breach Sections 2, 4, 5, 6 or 9 or the Program Policies; (c) an Ad Partner requires Yolla to stop serving a Site; or (d) continuing would expose Yolla to legal or regulatory liability. Either party may terminate immediately if the other materially breaches this Agreement and does not cure the breach within fifteen (15) days of notice, or becomes insolvent.

12.4 Effect of termination. On termination: (a) you will remove the Yolla Codes from the Sites and comply with Section 5.5; (b) Yolla will pay Net Revenue for Ads served before termination, including the final two months, within thirty (30) days after Yolla receives the corresponding Gross Revenue from Ad Partners, less Clawbacks; and (c) each party will return or destroy the other's Confidential Information on request.

12.5 Survival. Sections 5.5, 6.3, 7 (for amounts accrued), 8.3, 9, 10, 11.3, 12.4, 12.5, 13 to 16 and 18, and the DPA to the extent it applies to retained data, survive termination.

13. Representations and warranties

13.1 Mutual. Each party represents that it has the authority to enter into and perform this Agreement.

13.2 Yours. You represent and warrant that: (a) if you are an individual, you are at least 18; (b) you own or control each Site and have all rights, licenses and consents needed for Yolla to provide the Services on it; (c) the information you give Yolla is accurate and you will keep it current; (d) you and each Site comply with applicable law, including privacy, consumer-protection and advertising law; and (e) neither you nor your owners are the subject of sanctions administered by the US Treasury Department's Office of Foreign Assets Control, the EU or the UK, or located in a comprehensively sanctioned country.

13.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE". YOLLA DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. YOLLA DOES NOT WARRANT ANY LEVEL OF REVENUE, FILL, CPM OR UPTIME, OR THAT THE SERVICES WILL BE ERROR-FREE.

14. Indemnification

You will defend, indemnify and hold harmless Yolla, its affiliates and their officers, directors, employees and agents from and against all third-party claims, and related losses, damages, fines, costs and expenses (including reasonable legal fees), arising out of or relating to: (a) any Site or its content; (b) your breach of this Agreement, including the DPA; (c) your violation of applicable law, including privacy law; (d) Invalid Traffic from a Site; or (e) your use of the Services other than as permitted. Yolla will give you prompt notice of the claim, reasonable cooperation at your expense, and control of the defense, except that you may not settle any claim that imposes an obligation on Yolla without its consent.

15. Limitation of liability

15.1 Excluded damages. EXCEPT FOR THE EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE OR DATA, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

15.2 Yolla's cap. YOLLA'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE NET REVENUE SHARE ACTUALLY PAID TO YOU UNDER THIS AGREEMENT IN THE SIX (6) MONTHS IMMEDIATELY BEFORE THE DATE OF THE CLAIM.

15.3 Excluded Claims. "Excluded Claims" means your obligations under Section 14, your liability for Invalid Traffic and Clawbacks under Section 6, and either party's breach of Section 10.

15.4 Application. These limits apply to the fullest extent permitted by law and do not limit liability that cannot be limited by law, or either party's liability to data subjects under the EU SCCs and UK Addendum.

16. Governing law and disputes

16.1 Governing law. This Agreement is governed by the laws of the State of New York, without regard to its conflict-of-laws rules. The EU SCCs and UK Addendum in the DPA are governed by the law stated in them.

16.2 Venue. The state and federal courts located in the Borough of Manhattan, New York, have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each party consents to their jurisdiction.

16.3 Individual claims only. EACH PARTY BRINGS CLAIMS ONLY IN ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, CONSOLIDATED OR REPRESENTATIVE PROCEEDING.

16.4 Jury waiver. EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.

17. Changes to this Agreement

17.1 Notice of changes. Yolla may update this Agreement, the DPA or the Program Policies. For any material change, Yolla will email you at your account email at least thirty (30) days before it takes effect. Non-material changes take effect when posted in the Portal.

17.2 Your options. If you do not agree to a material change, you may terminate this Agreement by notice before the change takes effect, and the prior version will apply until termination. If you continue to use the Services after the effective date, you accept the change.

17.3 Legal and Ad Partner changes. Changes required by law, by a regulator or by an Ad Partner may take effect sooner, on the shortest notice that is practical.

18. General

18.1 Notices. Notices to Yolla go to legal@yollamedia.com, with a copy by mail to Yolla Media, LLC, Attn: Legal, 750 Lexington Avenue, 8th Floor, New York, NY 10022 for notices of breach or termination. Notices to you go to your account email. Email notices are effective when sent, unless the sender receives a delivery failure.

18.2 Assignment. You may not assign this Agreement without Yolla's written consent, except to a successor to all or substantially all of your business or the relevant Site, on notice to Yolla. Yolla may assign this Agreement to an affiliate or to a successor in a merger, acquisition or sale of its business.

18.3 Relationship. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship.

18.4 Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control, other than payment obligations.

18.5 Entire agreement. This Agreement, the DPA, the Program Policies and any signed order form are the entire agreement between the parties about the Services, and supersede any earlier version, including the Yolla Media Services Agreement previously published at yollamedia.com/index.php/terms/. A signed order form's commercial terms control over this Agreement for the Sites it covers.

18.6 Severability and waiver. If any provision is unenforceable, it will be modified to the minimum extent needed and the rest remains in effect. A waiver is effective only in writing and does not waive any other breach.

18.7 Language. This Agreement is written in English. Any translation is for convenience only, and the English version controls.

18.8 Electronic acceptance. Acceptance by click, electronic signature or counterparts is binding.

Exhibit A — Data Protection Addendum

This Data Protection Addendum ("DPA") forms part of the Publisher Services Agreement between Yolla and the Publisher (the "Agreement"). Capitalized terms not defined here have the meanings in the Agreement.

A1. Definitions

A1.1 "Applicable Data Protection Law" means all laws that apply to the processing of Personal Data under the Agreement, including: the EU General Data Protection Regulation 2016/679 ("GDPR"); Directive 2002/58/EC and its national implementations; the GDPR as incorporated into UK law ("UK GDPR"), the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003; the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"); the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations ("CCPA"); and the comprehensive consumer privacy laws of other US states (together with the CCPA, "US State Privacy Laws").

A1.2 "Personal Data", "controller", "processor", "processing", "data subject" and "supervisory authority" have the meanings given in the GDPR. "Personal Data" includes "personal information" under US State Privacy Laws.

A1.3 "Ad Data" means Personal Data about visitors to the Sites that Yolla or its Ad Partners collect through the Yolla Codes, as described in Annex I.

A1.4 "EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, as amended.

A1.5 "TCF" means the IAB Europe Transparency & Consent Framework, as updated from time to time, and its Policies.

A2. Roles

A2.1 Independent controllers. For Ad Data subject to the GDPR, UK GDPR or FADP, the Publisher and Yolla each act as an independent controller, except as set out in Section A2.2. Each is responsible for its own compliance, including its own notices, legal bases and responses to data subjects.

A2.2 Collection and transmission. To the extent the Publisher and Yolla are joint controllers for the collection of Ad Data on a Site through the Yolla Codes and its transmission to Yolla, and for no later processing, this Section is their arrangement under Article 26 of the GDPR and the UK GDPR: (a) the Publisher is responsible for giving visitors the information required by Articles 13 and 14 at the point of collection and for obtaining any consent Applicable Data Protection Law requires, using the tools described in Section A3; (b) Yolla is responsible for providing Yolla Codes and a consent-management platform that respect the choices captured, and for the information in its Advertising Privacy Statement; (c) data subjects may exercise their rights against either party, and each party will forward requests that concern the other under Section A4.4; and (d) the Publisher will make the essence of this arrangement available to visitors, including by linking to the Advertising Privacy Statement in its privacy policy.

A2.3 Allocation. Because the Publisher operates the Sites, the Publisher is responsible for presenting the notices and obtaining the consents Applicable Data Protection Law requires before Ad Data is collected on a Site, using the tools described in Section A3. Yolla is responsible for its own processing of Ad Data once received, as described in its Advertising Privacy Statement.

A2.4 US State Privacy Laws. For purposes of US State Privacy Laws, the Publisher makes Ad Data available to Yolla, and Yolla makes it available to Ad Partners, for cross-context behavioral or targeted advertising. The parties acknowledge this may be a "sale" or "sharing" of personal information, or processing for "targeted advertising". Yolla will: (a) process Ad Data only for the limited and specified purposes in Annex I; (b) comply with US State Privacy Laws and provide the level of privacy protection they require; (c) honor opt-out requests and opt-out preference signals (including Global Privacy Control) communicated through the Yolla Codes or forwarded by the Publisher; (d) notify the Publisher if it determines it can no longer meet its obligations under US State Privacy Laws; and (e) permit the Publisher, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Ad Data.

A3. Publisher obligations

A3.1 Consent in the EEA, UK and Switzerland. For visitors in the EEA, UK and Switzerland, the Publisher will use the consent-management platform (CMP) included in the Yolla Codes, or another CMP that Yolla approves in writing and that is registered with IAB Europe under the TCF. The Publisher will: (a) not modify the CMP's configuration, vendor list, purposes or user interface except through Yolla; (b) ensure no Ad Data is collected or passed to Yolla or Ad Partners before the CMP has captured the visitor's choices where consent is required; and (c) not override, fabricate or alter TCF consent strings.

A3.2 US opt-outs. For visitors in the United States, the Publisher will display, in the footer of each page of each Site, the "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link that Yolla provides, and will not interfere with the Yolla Codes' handling of opt-out requests and Global Privacy Control signals.

A3.3 Notice. The Publisher's privacy policy will meet Section 9.2 of the Agreement and, where required, describe the sale or sharing of personal information for advertising and how to opt out.

A3.4 Children. The Publisher will tell Yolla in writing if any Site or section of a Site is directed to children, or if the Publisher has actual knowledge that a visitor is a child under 13 (or under 16 where US State Privacy Laws, the GDPR or the UK GDPR set a higher age), so that Yolla can serve only non-personalized Ads there.

A3.5 No directly identifying data. The Publisher will comply with Section 9.4 of the Agreement.

A4. Yolla obligations

A4.1 Processing. Yolla will process Ad Data in accordance with Applicable Data Protection Law, the TCF signals it receives, and its Advertising Privacy Statement.

A4.2 Security. Yolla will implement and maintain the technical and organizational measures in Annex II.

A4.3 Personal data breaches. Yolla will notify the Publisher without undue delay after becoming aware of a personal data breach affecting Ad Data that relates to a Site, and will provide information the Publisher reasonably needs to meet its own obligations. Each party is responsible for its own notifications to supervisory authorities and data subjects.

A4.4 Data subject requests. Each party will handle requests addressed to it. If a party receives a request that concerns the other party's processing, it will forward it without undue delay. Yolla will delete Ad Data it holds that relates to a verified deletion request within thirty (30) days.

A4.5 Onward disclosure. Yolla discloses Ad Data only to Ad Partners bound by terms that require them to process it in accordance with Applicable Data Protection Law and the TCF signals they receive.

A4.6 Retention. Yolla keeps Ad Data it holds for no longer than thirteen (13) months after collection, after which it deletes or aggregates it.

A4.7 Assurance. On written request no more than once a year, Yolla will provide a written summary of its security measures or complete a reasonable security questionnaire. Any further audit the Publisher is entitled to under Applicable Data Protection Law will be conducted by an independent auditor reasonably acceptable to Yolla, at the Publisher's expense, on thirty (30) days' notice, during business hours and subject to confidentiality, no more than once a year.

A5. International transfers

A5.1 EEA. To the extent the Publisher transfers Ad Data subject to the GDPR to Yolla in the United States, the parties enter into Module One (controller to controller) of the EU SCCs, which are incorporated by reference, with the Publisher as data exporter and Yolla as data importer, and: (a) Clause 7 (docking clause) applies; (b) in Clause 11, the optional language does not apply; (c) in Clause 13, the competent supervisory authority is the one determined under Clause 13(a) and Annex I.C; (d) in Clause 17, the EU SCCs are governed by the law of Ireland; and (e) in Clause 18(b), disputes are resolved by the courts of Ireland. Annexes I and II of this DPA complete the Annexes to the EU SCCs.

A5.2 UK. To the extent the transfer is subject to the UK GDPR, the EU SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in Section A5.1 and Annexes I and II, and for Table 4 either party may end the UK Addendum as set out in its Section 19.

A5.3 Switzerland. To the extent the transfer is subject to the FADP, the EU SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and references to "Member State" include Switzerland, so that data subjects in Switzerland may sue in their place of habitual residence.

A5.4 Precedence. If the EU SCCs or UK Addendum conflict with this DPA or the Agreement, the EU SCCs or UK Addendum prevail.

A6. Liability

Each party's liability under this DPA is subject to Section 15 of the Agreement, except that nothing limits a party's liability to data subjects under the EU SCCs or UK Addendum.

A7. Term

This DPA applies for as long as either party processes Ad Data collected under the Agreement.

Annex I — Description of processing and transfer

A. Parties

B. Description

C. Competent supervisory authority

The supervisory authority determined under Clause 13(a) of the EU SCCs. Where the Publisher is not established in the EU and has appointed an Article 27 representative, it is the authority of the Member State where that representative is established.

Annex II — Technical and organizational measures

1. Encryption: Personal Data is encrypted in transit using TLS and encrypted at rest by Yolla's hosting providers.
2. Access control: access to production systems is limited to staff who need it, with multi-factor authentication where the provider supports it.
3. Minimization and retention: only the data needed for the purposes in Annex I is collected; records are deleted or aggregated after 13 months.