INVIDI AB
Ad-Tech Services Privacy Policy
Effective Date: February 13, 2020
This Ad-Tech Services Privacy Policy (this "Policy") describes how INVIDI TECHNOLOGIES AB ("INVIDI
AB, " "we, " "our, " or "us") collects, uses and otherwise processes information in connection with the INVIDI
Pulse platform ("INVIDI Pulse") and related ad serving technology, tools and services provided by INVIDIAB (collectively, the "Ad-Tech Services").
INVIDI AB is a registered Global Vendor with the IAB Europe's Transparency and Consent Framework. For
more information, please visit iabeurope.eu.
INVID AB is a proud member of the IAB Sweden.
Contact Information
Name:

INVIDI TECHNOLOGIES AB

Address:

46C Sankt Eriksgatan, 112 34 Stockholm, Sweden

Email Contact for Company
and for the Office of the Data
Protection Officer (DPO):

privacyoffice@invidi.com

1. Introduction.
The purpose of this Policy is to provide customers that purchase and use the Ad-Tech Services, including
third-party video network operators (our "Customers"), third parties who purchase ad inventory through the
Ad-Tech Services, such as advertisers and ad agencies (our "Ad-Tech Partner(s)"), and viewers or end
users of our Customers' products, services, platforms, or other properties ("End User(s)"), the informationneeded to assess the processing of Information through the Ad-Tech Services, as well as to outline how
INVIDI AB has established measures to maintain compliance with Applicable Law, including whereapplicable, the GDPR.
This Policy applies to information INVIDI AB collects and otherwise processes from Customers ("Customer
Information"), Ad-Tech Partners ("Ad-Tech Partner Information"), and End Users ("End User Information")in connection with the Ad-Tech Services, to the extent that any of the foregoing consist of Personal Data.
INVIDI AB is not responsible for Information processed by third parties or through third-party services. This
Policy does not apply to the processing of Personal Data outside of the Ad-Tech Services, including through
INVIDI AB's website. For more information about how we process Information on our website, please visit
our online Privacy Policy.
Please note that this Policy offers a general overview of the processing activities and data protection
measures associated with the Ad-Tech Services. If you are a Customer or Ad-Tech Partner, please referto the relevant Data Processing Addendum for further information about the processing involved in the useof the Ad-Tech Services referenced in this Policy.
This Policy is current as of the Effective Date above; however, we may change or update the Policy fromtime to time. If we make any material changes to how we process Personal Data, we will endeavor toprovide you with notice in advance of such change by providing written notice or by posting an updated
version on INVIDI AB's website or through the Ad-Tech Services. We will seek consent to any materialchanges if and where required by Data Protection Laws.
2. Definitions. As used in this Policy, the following terms shall have the following meanings:

"Affiliates" means companies controlling, controlled by, or under common control with INVIDI AB;"Applicable Law(s)" means (i) Data Protection Laws with respect to Personal Data in respect of which
INVIDI AB or the relevant Customer or Ad-Tech Partner is subject to; and (ii) any other applicable law withrespect to any Personal Data in respect of which INVIDI AB or a relevant Customer or Ad-Tech Partner issubject to;"Data Protection Law(s)" means any law, rule, regulation, decree, statute, or other enactment applicableto the processing of Personal Data received by INVIDI AB pursuant to or in connection with the Ad-Tech
Services including, to the extent applicable, EU Data Protection Laws;"Data Subject Request" has the meaning set forth in Section 6.e below;"EEA" means the European Economic Area;"EU Data Protection Law(s)" means any and all data protection or data privacy laws, rules, regulations,decrees, statutes, or other enactments of the EEA and its Member States that are applicable to theprocessing of Personal Data by the Ad-Tech Services, including as applicable, the GDPR and laws andregulations implementing or supplementing the GDPR;"GDPR" means EU General Data Protection Regulation 2016/679;"Information" means, collectively, Customer Information, Ad-Tech Partner Information, and End User
Information.
"Personal Data" means, to the extent processed by INVIDI AB in connection with the Ad-Tech Services,
any Customer Information, Ad-Tech Partner Information, or End User Information that relates to an
identified or identifiable natural person;"Restricted Transfer" means a transfer of Personal Data to or from INVIDI AB or a Subprocessor, or
between two establishments of INVIDI AB or a Subprocessor; in each case, where such transfer would beprohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address thedata transfer restrictions of Data Protection Laws) in the absence of Standard Contractual Clauses or otherlawful data transfer mechanisms that are recognized under Data Protection Laws as providing an adequatelevel of protection for such transfers;"Standard Contractual Clauses" means the standard data protection clauses for the transfer of Personal
Data to processors established in third countries approved by the European Commission, the approved
version of which is set out in the European Commission's Decision 2010/87/EU of 5 February 2010;"Subprocessor" means any processor engaged by INVIDI AB, including subcontractors, appointed byor on behalf of INVIDI AB to process Personal Data on behalf of a Customer or Ad-Tech Partner inconnection with the Ad-Tech Services; andThe terms, "European Commission", "controller", "data subject", "Member State", "personal data
breach", "processor", "processing" and "Supervisory Authority" shall have the same meaning as in the
GDPR, and their cognate terms shall be construed accordingly.
3. Ad-Tech Services description.
The Ad-Tech Services consist of various ad serving tools that allow Customers to manage ad inventory andserve addressable advertisements to End Users across media types and devices. When an End User
accesses or uses a Customer's product, service, platform, or other applicable property, information about
the End User is sent from the End User's device to the Ad-Tech Services, and then matched withparameters provided in advance by Ad-Tech Partners so that such Ad-Tech Partners can place orders andserve addressable advertisements to such End Users.

4. Customers and Ad-Tech Partners.
This Section 4 sets forth information with respect to INVIDI AB's processing of Customer Information and
Ad-Tech Partner Information. For more information about our data protection practices with respect to suchinformation, please also see Section 7 below. For information about how we process End User Information,please see Section 6 below.
a. Respective roles.
With respect to any Customer Information or Ad-Tech Partner Information processed by INVIDI AB throughor in connection with the Ad-Tech Services, INVIDI AB is the controller and employees, agents orcontractors of a Customer or an Ad-Tech Partner act as data subjects, as those terms are defined in the
GDPR. The specific details of each Customer or Ad-Tech Partner's Personal Data that will be processedby INVIDI AB, including the duration, purpose and categories of such Personal Data, and the rights andobligations of the parties, will be defined in the applicable Data Processing Addendum with such Customer
or Ad-Tech Partner.
b. Information we collect.
We collect Customer Information and Ad-Tech Partner Information directly from, respectively, ourCustomers and Ad-Tech Partners. For example, we will collect a Customer or Ad-Tech Partners' employee,
agent or contractors' contact information when they enter into a contractual relationship with INVIDI AB or
if and when they inquire about the Ad-Tech Services. We may also collect other Personal Data that
Customers or Ad-Tech Partners choose to provide through the Ad-Tech Services, such as the contents ofmessages that a Customer or Ad-Tech Partner submits through the Ad-Tech Services. We may also collect
Personal Data from prospective Customers or Ad-Tech Partners through publicly available sources.
When a Customer or Ad-Tech Partner registers to use the Ad-Tech Services, we collect Personal Data,
including the Customer or Ad-Tech Partner's employee, contractor or agent's name, email address,
telephone number, payment card information, billing information, and/or any other Personal Data the
Customer or Ad-Tech Partner employee, agent or contractor may choose to provide through the Ad-Tech
Services. We may also work with third-party service providers to process payments to or from ourCustomers and/or Ad-Tech Partners on our behalf. A list of these vendors are set forth in the applicable
Data Processing Addendum between INVIDI AB and the relevant Customer or Ad-Tech Partner. INVIDI
AB will not have access to the Personal Data a Customer or Ad-Tech Partner provides to these third parties,
but we encourage our Customers and Ad-Tech Partners to visit their privacy policies to understand theirdata practices.
c.

How we use Customer Information and Ad-Tech Partner Information.

We use Customer Information and Ad-Tech Partner Information for the following purposes:•

Providing the Ad-Tech Services. To provide the Ad-Tech Services and for other customer
service purposes and to otherwise manage Customer and Ad-Tech Partner accounts.

•

Communicating with Customers, Ad-Tech Partners, or others. To communicate, via email orotherwise, with Customers or Ad-Tech Partners about their relevant accounts; to respond to
Customer or Ad-Tech Partner inquiries, requests, or complaints; and to provide Customers and AdTech Partners with news, best practices, or other helpful or interesting information, in accordancewith their communications preferences.

•

Marketing and advertising. To provide Customers or Ad-Tech Partners with newsletters, special
offers, and promotions, including via email, and for other marketing, advertising, promotional
purposes, and general updates about INVIDI AB or our Affiliates. These communications will besent in accordance with the communications preferences of our Customers or Ad-Tech Partners.

d. How we disclose Customer Information and Ad-Tech Partner Information.

We may disclose Customer Information and Ad-Tech Partner Information as follows:•

INVIDI AB Affiliates. We may disclose Customer Information or Ad-Tech Partner Information to
any of INVIDI AB's Affiliates, parent companies, or subsidiaries to process for the purposes
described in this Policy.

•

INVIDI AB service providers. We may disclose Customer Information or Ad-Tech Partner
Information to vendors, service providers, agents, contractors, or others who perform functions,such as maintenance, data analysis, customer relationship management, email marketing,surveys, payment card processing, data hosting, and fraud detection, on our behalf.

•

Other Customers or Ad-Tech Partners. We may disclose Customer Information or Ad-TechPartner Information to other Customers or Ad-Tech Partners where relevant to the Ad-Tech
Services we provide. For example, we may provide Ad-Tech Partners with information about
which Customers' products, services, platforms or properties their ads have appeared on.

5. Customer and Ad-Tech Partner rights.
Customers and Ad-Tech Partners may access, correct, or update the Personal Data they have provided
to INVIDI AB by updating such information in their account, emailing their INVIDI AB account manager, orby emailing us at privacyoffice@invidi.com.
We may send periodic promotional or informational emails to Customers or Ad-Tech Partners inaccordance with their communications preferences. At any time, Customers and Ad-Tech Partners may
opt out of such communications by following the opt-out instructions contained in the email. Please notethat if a Customer or Ad-Tech Partner opts out of receiving emails about recommendations or otherinformation we think may be of interest, we may still send emails to such Customer or Ad-Tech Partner
about their account or any Ad-Tech Services they have requested or received from us.
6. End Users.
This Section 6 sets forth information with respect to INVIDI AB's processing of End User Information. For
more information about our data protection practices with respect to such End User Information, pleasealso see Section 7 below. For information about how we process Customer Information and/or Ad-TechPartner Information, please see Section 4 above.
a.

Respective roles.

With respect to End User Information processed by INVIDI AB through the Ad-Tech Services, the Customer
is the controller, and End User is a data subject, and INVIDI AB acts as a processor, as those terms aredefined in the GDPR. The specific details of End User Information that will be processed by INVIDI AB on
behalf of a Customer, including the duration, purpose and categories of any Personal Data, and the rights
and obligations of the parties, will be defined in the applicable Data Processing Addendum with such
Customer.
b. Information we collect.
INVIDI AB automatically collects End User Information when End Users interact with the Ad-Tech
Services that appear on Customers' products, services, platforms, or other properties. We collect thisEnd User Information through cookies and other technologies.

Customers are solely responsible for selecting the types of End User Information processed through or inconnection with the Ad-Tech Services. Notwithstanding the forgoing, INVIDI AB generally collects, uses
and otherwise processes the following End User Information on behalf of Customers in their use of the AdTech Services: (i) persistent identifiers, (ii) IP addresses, and (iii) geolocation.

The Ad-Tech Services may also process other data elements, which may consist of Special Categories of
Personal Data, if and to the extent a Customer has opted in to the processing of such information. Our
Customers are solely responsible for obtaining consent on our behalf, where required by Applicable Law,for us to process this End User Information.
c.

How we use End User Information.

INVIDI AB does not process End Users' Personal Data other than on a Customer's documented
instructions, as set forth in an applicable Data Processing Addendum with such Customer, and as
reasonably necessary to provide the Customer with the Ad-Tech Services, unless processing is requiredby Applicable Law to which INVIDI AB is subject. Notwithstanding the foregoing, in general, we process
End User Information for the following purposes:•

Provide the Ad-Tech Services. To provide the Ad-Tech Services to our Customers, Ad-TechPartners, and End Users.

•

Serve addressable advertisements to End Users on behalf of Customers. To serve
addressable ads to End Users on behalf of and as directed by our Customers; to assist Customers
with ad inventory management; to identify unique End Users across multiple devices to serve
addressable advertisements; to analyze the effectiveness of advertising campaigns; to provide
aggregated information about End User interests; and to create data segments and groups.

INVIDI AB does not knowingly create segments or groups based upon Special Categories of Personal Data;
however, the Ad-Tech Services may process Special Categories of Personal Data if and to the extent a
Customer has opted in to the processing of such information. Our Customers are solely responsible forobtaining such End Users' explicit consent, where required by Applicable Law, for us to process this End
User Information.
d. How we disclose End User Information.
INVIDI AB does not disclose End Users' Personal Data other than on a Customer's documented
instructions, as set forth in an applicable Data Processing Addendum with such Customer, and as
reasonably necessary to provide the Customer with the Ad-Tech Services, unless disclosure is required by
Applicable Law to which INVIDI AB is subject. Notwithstanding the forgoing, in addition to sharing certain
End User Information as directed by Customers, INVIDI AB may disclose End User Information as follows:•

INVIDI AB Affiliates. INVIDI AB may disclose End User Information to any INVIDI AB Affiliates,
parent companies, or subsidiaries to process such End User Information for the purposes
described in this Policy.

•

INVIDI AB service providers. INVIDI AB may disclose End User Information to vendors, service
providers, agents, contractors, or others who perform functions, such as maintenance, data
analysis, customer relationship management, email marketing, surveys, payment card processing,data hosting, or fraud detection, on our behalf. Notwithstanding the foregoing, to the extent such
End User Information consists of any Personal Data, INVIDI AB only shares such Personal Datawith service providers who will utilize the information to provide their services to INVIDI AB.

•

Customers and Ad-Tech Partners. INVIDI AB may disclose End User Information to Customers
or Ad-Tech Partners where relevant to the Ad-Tech Services we provide to such Customers and/or
Ad-Tech Partners.

e. End User rights.
INVIDI AB, to the extent legally permitted, will promptly notify the relevant Customer if and when INVIDI AB
receives a request from an End User to exercise such End User's right of access, right to rectification,
restriction of processing, erasure, data portability, object to the processing, or its right not to be subject toan automated individual decision making (each such request, a "Data Subject Request"). Taking into

account the nature of the processing, INVIDI AB will assist the Customer by appropriate technical andorganizational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to a
Data Subject Request under Data Protection Law. In addition, to the extent a Customer, in its use of the
Ad-Tech Services, does not have the ability to address a Data Subject Request, INVIDI AB will, upon the
Customer's written request, provide commercially reasonable efforts to assist the Customer in responding
to such Data Subject Request, to the extent INVIDI AB is legally permitted to do so and the response tosuch Data Subject Request is required under Data Protection Law.
f.

Children.

INVIDI AB does not knowingly collect any End User Information or target any advertisements on
Customer products, services, platforms, or properties directed to children under the age of thirteen.
7. General provisions applicable to Customers, Ad-Tech Partners and End Users.
a. How we use Information.
We use Information for the purposes respectively set forth in Sections 4, 5, and 6 above, as well as for thefollowing purposes:•

Analyze the use of the Ad-Tech Services. To the extent aggregated or de-identified Information
is no longer considered Personal Data, for any purpose, including analysis, internal operations, andto improve the quality of the Ad-Tech Services.

•

Legal compliance. To comply with obligations under Applicable Laws, including requests fromlaw enforcement or other governmental entities.

•

Protecting rights and interests. To protect our rights and interests and the rights and interestsof our Customers, Ad-Tech Partners, End Users, and the general public, as well as to enforce thisPolicy and other INVIDI AB policies.

b. How we disclose Information.
When we share Information with third parties as specified above, we require such recipients to agree to
only use such Information in accordance with this Policy and our contractual specifications. In addition to
the disclosures detailed above, we may also disclose Information for the following purposes:•

Business transfers. INVIDI AB reserves the right to disclose and/or transfer Information toanother entity if we are acquired by or merged with another company, if we sell or transfer abusiness unit or assets to another company, as part of a bankruptcy proceeding, or as part of any
other similar business transfer.

•

Legal compliance. To comply with obligations under Applicable Laws, including requests fromlaw enforcement or other governmental entities.

•

Protecting rights and interests. To investigate, prevent, or take action regarding illegal activities,
suspected fraud, situations involving potential threats to the safety of any person, violations of ourthis Policy and/or other INVIDI AB policies, or as evidence in litigation in which we are involved, tothe extent we believe disclosure of such Information is necessary.

•

Aggregate and de-identified Information. We may disclose aggregated or de-identified
Information to our Customers, Ad-Tech Partners, Affiliates or third parties without restriction, to theextent aggregated or de-identified Information is no longer considered Personal Data.

c.

Legal Basis.

INVIDI AB processes End User Information as a processor on behalf of our Customers. To the extent
Customers or Ad-Tech Partners need to collect, disclose or otherwise process, or allow INVIDI AB tofacilitate in the collection, disclosure or other processing of Personal Data in connection with the Ad-Tech
Services, it is the responsibility of such Customers or Ad-Tech Partners to determine the appropriate legal
basis for doing so, as well as providing the necessary privacy notices and obtaining any required consent(s).
Where required, INVIDI AB's legal basis for processing Personal Data will depend on the Personal Data
concerned and the specific context in which we collect it. However, in connection with the Ad-Tech
Services, we generally collect Personal Data only (i) where we have the appropriate consent to do so, (ii)where we need the Personal Data to perform a contract, (iii) where the processing is in our legitimate
interests and not overridden by data protection interests or fundamental rights and freedoms, or (iv) where
we need to comply with a legal obligation.
If INVIDI AB asks for Personal Data in reliance on our legitimate interests (or those of any third party), we
will identify such legitimate interests at the relevant time. In addition, if we ask for Personal Data in order
to comply with a legal requirement or to perform a contract, we will make this clear at the relevant time.
d. Third-party links.
The Ad-Tech Services may contain links to third-party products, services, platforms, websites, or otherproperties. Any access to and/or use of any of the forgoing are not governed by this Policy but instead by
the privacy policies of those third-parties. INVIDI AB is not responsible for the information security nor
privacy practices of such third-parties.
e. Retention.
INVIDI AB retains Information for the period of time defined by a Customer or Ad-Tech Partner, as
applicable, in the relevant Data Processing Addendum with such party. Notwithstanding the foregoing,
INVIDI AB retains Personal Data only for as long as reasonably necessary to fulfil the purposes we collected
it for, including to provide the Ad-Tech Services and/or for the purposes of satisfying any legal, regulatory,
tax, accounting or reporting requirements. We may retain Personal Data for a longer period in the event of
a complaint or if we reasonably believe there is a prospect of litigation. To determine the appropriate
retention period for Personal Data, INVIDI AB considers the amount, nature and sensitivity of the Personal
Data, the potential risk of harm from unauthorized use or disclosure of Personal Data, the purposes forwhich we process Personal Data and whether we can achieve those purposes through other means, andthe applicable legal, regulatory, tax, accounting or other requirements.
f.

Security.

Taking into account the state of the art, the costs of implementation and the nature, scope, context andpurposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms ofnatural persons, INVIDI AB, in relation to Personal Data, implements appropriate technical andorganizational measures that are designed to ensure a level of security appropriate to such risk, including,as appropriate, the measures referred to in Article 32(1) of the GDPR. In assessing the appropriate levelof security, INVIDI AB takes account of the risks that are presented by processing, in particular from apersonal data breach.
INVIDI AB has implemented information security policies that set forth technical, administrative, andphysical safeguards for the protection of Personal Data. INVIDI AB regularly reviews such policies andimproves them where necessary.
g. INVIDI AB personnel.
INVIDI AB has appointed an Office of the DPO in order to inform and advise INVIDI AB and its staff on its
data protection obligations, and for monitoring compliance with those obligations and with INVIDI AB's dataprotection policies. The Office of the DPO can be reached at privacyoffice@invidi.com with any dataprocessing or data protection inquiries.

INVIDI AB takes reasonable steps to ensure the reliability of any employee, agent or contractor of INVIDIAB who may have access to Personal Data and implements access controls to limit access to Personal
Data. All INVIDI AB personnel who have access to Personal Data are educated and regularly trained on
INVIDI AB's data protection policies and the treatment of Personal Data, including the obligation ofconfidentiality with respect to such data.
h. Third-Party Subprocessors.
Customers can exercise their rights with respect to Subprocessor changes according to the provisions of
the applicable Data Processing Addendum. Notwithstanding the forgoing, with respect to each
Subprocessor: (i) before a Subprocessor first processes Personal Data, INVIDI AB carries out adequate
due diligence to ensure that the Subprocessor is capable of providing the appropriate level of protection forsuch Information; (ii) INVIDI AB ensures that the arrangement between INVIDI AB and Subprocessor isgoverned by a written contract including terms which offer at least the same level of protection for Personal
Data as those set out in the applicable Data Processing Addendum and meet the requirements of Article
28(3) of the GDPR; and (iii) where the arrangement involves a Restricted Transfer, INVIDI AB ensures thata valid legal mechanism is adopted, including, for example, incorporation of the Standard Contractual
Clauses into the agreement between INVIDI AB and Subprocessor.
i.

Restricted Transfers.

INVIDI AB transfers Personal Data outside the EEA and, where available, we rely on adequacy
determinations to do so. However, as part of our global operations, we may transfer Information to a
country that may not offer the same level of protection for Personal Data as the country in which it wascollected. To ensure that Personal Data is adequately protected when transferred outside the EEA,INVIDI AB's Data Processing Addendum includes Standard Contractual Clauses to permit the transfer of
Personal Data from the EEA to, for example, the United States.
8. Contact Us.
If you have questions about how INVIDI AB processes Personal Data, please contact the Office of the DPO
at privacyoffice@invidi.com.