EX-10.2





 Exhibit 10.2 

MANAGEMENT AGREEMENT 

This MANAGEMENT AGREEMENT (this “Agreement”) is made as of July 19, 2018, by and among Vista Equity Partners Management,
LLC, a Delaware limited liability company (“VEP”), Kavacha Topco, LLC, a Delaware limited liability company (“Topco”), Kavacha Intermediate, LLC, a Delaware limited liability company
(“Intermediate”), Kavacha Holdings, Inc., a Delaware corporation (“Parent”), and Integral Ad Science, Inc., a Delaware corporation (“IAS”, and together with Topco, Intermediate and Parent, as any
such company’s name or corporate form may change from time to time and such company’s successors and assigns, the “Company”). 

WHEREAS, Parent, Kavacha Merger Sub, Inc., a Delaware corporation, IAS and Shareholder Representative Services LLC, a Colorado limited
liability company, solely in its capacity as the Equityholders’ Representative are parties to that certain Agreement and Plan of Merger, dated as of June 1, 2018 (the “Merger Agreement”), as amended from time to time,
pursuant to which IAS became an indirect subsidiary of Topco. 
 WHEREAS, the Company from time to time desires to retain and avail itself
of VEP, and VEP desires to perform for the Company and its affiliates certain services; and 
 WHEREAS, VEP, by and through its officers,
employees, agents and affiliates, have developed, in connection with the conduct of their businesses and affairs, expertise in the fields of management, finance and strategic planning. 

NOW, THEREFORE, in consideration of the promises and the mutual covenants contained herein, the parties do hereby agree as follows: 

1. Term. This Agreement shall remain in effect unless the Company and VEP terminate this Agreement by mutual written
agreement (the “Term”). 
 2. Appointment. The Company hereby retains VEP to render management and
consulting services to the Company (or to such subsidiaries of the Company as the Company may request) during the term as herein contemplated. 

3. Services. VEP, by and through its officers, employees, agents and affiliates, as VEP, in its sole discretion, shall
designate from time to time, agrees to perform or cause to be performed such management and consulting services (including, but not limited to management, finance, marketing, operational and strategic planning, relationship access, corporate
development and analysis of potential mergers and acquisitions) for the Company and its affiliates as mutually agreed upon by and between VEP and the Companies’ respective boards of directors (or equivalent governing body). In addition, VEP
intends to provide certain services and assistance to the Company, and to provide the Company with certain resources available to VEP in order to enhance the equity value of the Company; provided, that the provision of such resources do not
compromise VEP or impair its ability to conduct its business, as determined in VEP’s sole discretion. The Company agrees to hire VEP as its financial adviser in connection with any future (a) material debt or equity financing of the
Company or its subsidiaries (including any sale of capital stock of the Company or its subsidiaries), (b) merger or sale of any material portion of the Company’s consolidated assets, and (c) acquisition of assets of another entity outside
the ordinary course of business or of any capital stock of another entity. 












 4. Expenses. 

(a) The Company shall reimburse VEP for all reasonable
out-of-pocket costs and expenses incurred in connection with services rendered hereunder. Such costs and expenses shall be reimbursed promptly by the Company upon
submission of customary expense reports. 
 (b) In the event, and during any period, that any loan or credit agreements to which the Company
is a party prohibits the payment of all or any portion of VEP’s out-of-pocket costs and expenses required to be reimbursed pursuant to clause (a) above, then
such out-of-pocket cost or expense, or portion thereof, that is not permitted to be paid shall accrue and be paid at the earliest date that the payment thereof is no
longer prohibited. 
 (c) In no event shall the lenders party to any loan or credit agreement to which the Company is a party have any
liability to VEP as a result of any prohibition in such loan or credit agreement with respect to the payment of all or any portion of the out-of-pocket costs and
expenses payable by the Company to VEP pursuant to this Section 4. 
 (d) Each obligation hereunder of the entities
comprising the Company shall be a joint and several obligation of each of them. 
 5. Independent Contractor. VEP and
the Company agree that VEP shall perform its services hereunder as an independent contractor, retaining control over and responsibility for its own operations and employees. 

6. Liability. Neither of VEP nor any of its affiliates, partners, employees or agents shall be liable to the Company or
its subsidiaries or affiliates for any loss, liability, damage or expense arising out of or in connection with the performance of services contemplated by this Agreement. 

7. Indemnity. 

(a) The Company and its affiliates shall defend, indemnify and hold harmless VEP, its affiliates, partners, employees, agents, directors,
managers, officers and controlling persons (collectively, the “Indemnified Parties”) from and against any and all loss, liability, damage, expense, or obligations of any kind or nature (whether accrued or fixed, absolute or
contingent), joint or several, arising from any claim (a “Claim”) by any person or entity with respect to, or in any way related to, the services (including, without limitation, the engagement of VEP pursuant to this Agreement and
the performance by VEP of services pursuant to this Agreement) contemplated by this Agreement (including attorneys’ fees) resulting from any act or omission by the Indemnified Parties. The Company and its affiliates shall defend at their own
cost and expense any and all suits or actions (just or unjust) which may be brought against the Company and/or its affiliates and the Indemnified Parties. The Company and its affiliates shall defend at their own cost and expense any and all suits or
actions (just or unjust) which may be brought in which the Indemnified Parties may be impleaded with others upon any Claim upon any matter, directly or indirectly, related to or arising out of this Agreement or the performance


  
 2 













 
hereof by the Indemnified Parties, except that if such damage shall be proven to be the direct result of gross negligence, bad faith or willful misconduct by any of the Indemnified Parties, then
such Indemnified Party shall reimburse the Company and its affiliates for the costs of defense and other costs incurred by the Company and its affiliates in proportion to such Indemnified Party’s culpability as proven. In the event of the
assertion against any Indemnified Party of any Claim or the commencement of any action or proceeding, the Company shall be entitled to participate in such action or proceeding and in the investigation of such Claim and, after written notice from the
Company to such Indemnified Party, to assume the investigation or defense of such Claim, action or proceeding with counsel of the Company’s choice at the Company’s expense; provided, however, that such counsel shall be
reasonably satisfactory to the Indemnified Party. Notwithstanding anything to the contrary contained herein, the Company may retain one firm of counsel to represent all Indemnified Parties in such claim, action or proceeding; provided,
however, that the Indemnified Party shall have the right to employ a single firm of separate counsel (and any necessary local counsel) and to participate in the defense or investigation of such claim, action or proceeding, and the Company
shall bear the expense of such separate counsel (and local counsel, if applicable), if (x) in the opinion of counsel to the Indemnified Party use of counsel of the Company’s choice could reasonably be expected to give rise to a conflict of
interest, (y) the Company shall not have employed counsel satisfactory to the Indemnified Party to represent the Indemnified Party within a reasonable time after notice of the assertion of any such claim or institution of any such action or
proceeding or (z) the Company shall authorize the Indemnified Party to employ separate counsel at the Company’s expense. The Company further agrees that with respect to any Indemnified Party who is employed, retained or otherwise
associated with, or appointed or nominated by, the VEP Parties or any of its affiliates and who acts or serves as a director, officer, manager, fiduciary, employee, consultant, advisor or agent of, for or to the Company or any of its subsidiaries,
that the Company or such subsidiaries, as applicable, shall be primarily liable for all indemnification, reimbursements, advancements or similar payments (the “Indemnity Obligations”) afforded to such Indemnified Party acting in
such capacity or capacities on behalf or at the request of the Company, whether the Indemnity Obligations are created by law, organizational or constituent documents, contract (including this Agreement) or otherwise. Notwithstanding the fact that
VEP and/or any of its respective affiliates, other than the Company (such persons or entities, together with its and their respective heirs, successors and assigns, the “VEP Parties”), may have concurrent liability to an Indemnified
Party with respect to the Indemnity Obligations, the Company hereby agrees that in no event shall the Company or any of its subsidiaries have any right or claim against any of the VEP Parties for contribution or have rights of subrogation against
any VEP Parties through an Indemnified Party for any payment made by the Company or any of its subsidiaries with respect to any Indemnity Obligation. In addition, the Company hereby agrees that in the event that any VEP Parties pay or advance an
Indemnified Party any expenses with respect to an Indemnity Obligation, the Company will, or will cause its subsidiaries to, as applicable, promptly reimburse any such VEP Parties for such payment or advance upon request; subject to the receipt by
the Company of a written undertaking executed by the Indemnified Party and the VEP Party that makes such payment or advance to repay any such amounts if it shall ultimately be determined by a court of competent jurisdiction that such Indemnified
Party was not entitled to be indemnified by the Company. The foregoing right to indemnity shall be in addition to any rights that any Indemnified Party may have at common law or otherwise and shall remain in full force and effect following the
completion or any 

  
 3 













 
termination of the engagement. If for any reason the foregoing indemnification is unavailable to any Indemnified Party or insufficient to hold it harmless as and to the extent contemplated by
this Section 7, then the Company shall contribute to the amount paid or payable by the Indemnified Party as a result of such Claim in such proportion as is appropriate to reflect the relative benefits received by the
Company and its affiliates, on the one hand, and the Indemnified Party, as the case may be, on the other hand, as well as any other relevant equitable considerations. 

(b) The Company hereby acknowledges that the Indemnified Parties have certain rights to indemnification, advancement of expenses and/or
insurance provided by investment funds managed by VEP and certain of its affiliates (collectively, the “Fund Indemnitors”). The Company hereby agrees with respect to any indemnification, hold harmless obligation, expense advancement
or reimbursement provision or any other similar obligation whether pursuant to or with respect to this Agreement, the organizational documents of the Company or any of its subsidiaries or any other agreement, as applicable, (i) that the Company
and its subsidiaries are the indemnitor of first resort (i.e., their obligations to the Indemnified Parties are primary and any obligation of the Fund Indemnitors to advance expenses or to provide indemnification for claims, expenses or obligations
arising out of the same or similar facts and circumstances suffered by any Indemnified Party are secondary), (ii) that the Company shall be required to advance the full amount of expenses incurred by any Indemnified Party and shall be liable for the
full amount of all expenses, liabilities, obligations, judgments, penalties, fines, and amounts paid in settlement to the extent legally permitted and as required by the terms of this Agreement, the organizational documents of the Company or any of
its subsidiaries or any other agreement, as applicable, without regard to any rights any Indemnified Party may have against the Fund Indemnitors, and (iii) that the Company, on behalf of itself and each of its subsidiaries, irrevocably waives,
relinquishes and releases the Fund Indemnitors from any and all claims against the Fund Indemnitors for contribution, subrogation or any other recovery of any kind in respect thereof. The Company further agrees that no advancement or payment by the
Fund Indemnitors on behalf of any Indemnified Party with respect to any claim for which any Indemnified Party has sought indemnification from the Company shall affect the foregoing and the Fund Indemnitors shall have a right of contribution and/or
be subrogated to the extent of such advancement or payment to all of the rights of recovery of any Indemnified Party against the Company. The Company agrees that the Fund Indemnitors are express third-party beneficiaries of the terms of this
Section 7(b). 
 8. Representations and Warranties. The Company represents and warrants to VEP
that: (a) the Company has taken all action necessary to permit it to execute and deliver this Agreement and the other documents and instruments to be executed by it pursuant hereto and to carry out the terms hereof and thereof; (b) this
Agreement and each such other document and instrument, when duly executed and delivered by the Company, will constitute a valid and binding obligation of the Company, enforceable against the Company in accordance with its terms; and (c) the
Company is not required to obtain any order, consent, approval or authorization of, or to make any declaration or filing with, any third party or governmental authority in connection with the execution and delivery of this Agreement and the other
documents and instruments to be executed by it pursuant hereto or the consummation of the transactions contemplated hereby and thereby, except for such order, consent, approval, authorization, declaration or filing as which has been or will be
obtained or made. 

  
 4 













 9. Notices. All notices, requests, consents and other communications
provided for herein shall be in writing and shall be (a) delivered in person, (b) transmitted by telecopy or electronic mail, (c) sent by first-class, registered or certified mail, postage prepaid, or (d) sent by reputable
overnight courier service, fees prepaid, to the recipient at the address, telecopy number, or electronic mail address set forth below, or such other address, telecopy number or electronic mail address as may hereafter be designated in writing by
such recipient. Notices shall be deemed given upon personal delivery, seven days following deposit in the mail as set forth above, upon acknowledgment by the receiving telecopier or by the recipient of the electronic mail or one day following
deposit with an overnight courier service. 
 If to Topco, Intermediate, Parent or IAS: 

c/o Vista Equity Partners Management, LLC 

Four Embarcadero Center, 20th Floor 

San Francisco, CA 94111 

Attention:         David A. Breach, Michael Fosnaugh and Rod Aliabadi 

E-mail:             *********** 

                       
 *********** 

                       
 *********** 
 with a copy (which shall not constitute notice to Topco, Intermediate, Parent, or IAS) to: 

Kirkland & Ellis LLP 

555 California Street 
 Suite
2900 
 San Francisco, CA 94104 

Attention: Stuart E. Casillas, P.C. 

Facsimile No.: *********** 
 E-mail: *********** 
 If to VEP: 

Vista Equity Partners Management, LLC 

Four Embarcadero Center, 20th Floor 

San Francisco, CA 94111 

Attention:         David A. Breach, Michael Fosnaugh and Rod Aliabadi 

E-mail:             *********** 

                       
 *********** 

                       
 *********** 
 with a copy (which shall not constitute notice to VEP) to: 

Kirkland & Ellis LLP 

555 California Street 
 Suite
2900 

  
 5 













 
San Francisco, CA 94104 
 Attention: Stuart E. Casillas, P.C. 

Facsimile No.: *********** 
 E-mail: *********** 
 10. Miscellaneous. 

(a) Amendment and Waiver. The provisions of this Agreement may be amended and/or waived only with the prior written consent of each of
VEP and the Company. 
 (b) Survival of Representations and Warranties. All representations and warranties contained herein or made in
writing by any party in connection herewith shall survive the execution and delivery of this Agreement and the consummation of the transactions contemplated hereby. 

(c) Successors and Assigns. Except as otherwise expressly provided herein, all covenants and agreements contained in this Agreement by
or on behalf of any of the parties hereto shall bind and inure to the benefit of the respective successors and assigns of the parties hereto whether so expressed or not. 

(d) Severability. Whenever possible, each provision of this Agreement shall be interpreted in such manner as to be effective and valid
under applicable law, but if any provision of this Agreement is held to be prohibited by or invalid under applicable law, such provision shall be ineffective only to the extent of such prohibition or invalidity, without invalidating the remainder of
this Agreement. 
 (e) Counterparts. This Agreement may be executed simultaneously in two or more counterparts, any one of which need
not contain the signatures of more than one party, but all such counterparts taken together shall constitute one and the same agreement. 

(f) Descriptive Headings; Interpretation. The descriptive headings of this Agreement are inserted for convenience only and do not
constitute a substantive part of this Agreement. The use of the word “including” in this Agreement shall be by way of example rather than by limitation. 

(g) Governing Law. ALL QUESTIONS CONCERNING THE CONSTRUCTION, VALIDITY AND INTERPRETATION OF THIS AGREEMENT SHALL BE GOVERNED
BY AND CONSTRUED IN ACCORDANCE WITH THE DOMESTIC LAWS OF THE STATE OF NEW YORK, WITHOUT GIVING EFFECT TO ANY CHOICE OF LAW OR CONFLICT OF LAW PROVISION OR RULE (WHETHER OF THE STATE OF NEW YORK OR ANY OTHER JURISDICTION) THAT WOULD CAUSE THE
APPLICATION OF THE LAWS OF ANY JURISDICTION OTHER THAN THE STATE OF NEW YORK. 

  
 6 













 (h) Arbitration. 

(i) Resolution of Disputes. If a Dispute arises between the parties, the parties agree to use the following procedures
in good faith to resolve such Dispute promptly and non-judicially. For purposes of this Agreement, “Dispute” shall mean any alleged material breach of any representation, warranty or
obligation herein, or a disagreement regarding the interpretation, performance or nonperformance of any provision thereof, or the validity, scope and enforceability of these dispute resolution procedures, or any dispute regarding any damages arising
from the termination of this Agreement. Any party may give written notice to any other party of the existence of a Dispute (a “Dispute Notice”). 

(ii) Negotiation. Within ten days after delivery of any Dispute Notice the parties involved in the Dispute shall meet at
a mutually agreeable time and place and thereafter as often as they deem reasonably necessary to exchange relevant information and attempt in good faith to negotiate a resolution of the Dispute. If the Dispute has not been resolved within ten days
after the first meeting of the parties, or, if the party receiving the Dispute Notice will not meet within ten days after receipt of the Dispute Notice, then either party may, by delivering notice to the other party, commence arbitration
proceedings. 
 (iii) General Dispute Resolution Provisions. 

(A) All deadlines specified in this Section 10(h) may be extended by mutual agreement. The
procedures specified in this Section 10(h) are an essential provision of this Agreement and are legally binding on the parties. These procedures shall be the sole and exclusive procedures for the resolution of any Dispute
between the parties arising out of or relating to this Agreement. Any and all actions to enforce the obligations under this Section 10(h) shall be brought in any court of competent jurisdiction in courts located in San
Francisco, California. 
 (B) The parties acknowledge that the provisions of this Section 10(h)
are intended to provide a private resolution of Disputes between them. Accordingly, all documents, records, and other information relating to the Dispute shall at all times be maintained in the strictest confidence and not disclosed to any third
party, other than the arbitrators, except where specifically allowed hereunder. All proceedings, communications and negotiations pursuant to this Section 10(h) are confidential. In the event of any judicial challenge to, or
enforcement of, any order or award hereunder, any party may designate such portions of the record of such proceedings, communications, and negotiations as such party deems appropriate to be filed under seal. All proceedings, communications and
negotiations pursuant to this Section 10(h) shall be treated as compromise negotiations for all purposes, including for purposes of the US Federal Rules of Evidence and state rules of evidence. None of the statements,
disclosures, offers, or communications (or other assertions made in any proceeding or negotiation) made pursuant to this Section 10(h) shall be deemed admissions, nor shall any of said statements, disclosures, offers,
communications or assertions be admissible for any purpose other than the enforcement of the terms of this Section 10(h). 

The parties agree to act in good faith to comply with all of their respective obligations under this Agreement as much as
possible as if there were no Dispute during any pending mediation or arbitration hereunder. 

  
 7 













 The parties agree that the terms of this
Section 10(h) shall survive the termination or expiration of this Agreement. 
 (iv) WAIVER OF
JURY TRIAL. The parties agree to have any Dispute decided by neutral arbitration as provided in this Section 10(h) and the parties are giving up any rights they might possess to have the Dispute litigated in a court or
by a jury trial. The parties are giving up their judicial rights to discovery and appeal, unless such rights are specifically included in this Section 10(h). The parties acknowledge and agree that their agreement to this
arbitration provision is voluntary. FOR THE AVOIDANCE OF DOUBT AND IN FURTHERANCE OF THE FOREGOING, EACH PARTY HERETO HEREBY WAIVES AND COVENANTS THAT IT WILL NOT ASSERT (WHETHER AS PLAINTIFF, DEFENDANT OR OTHERWISE) ANY RIGHT TO TRIAL BY JURY IN
ANY FORUM IN RESPECT OF ANY ISSUE OR ACTION, CLAIM, CAUSE OF ACTION OR SUIT (IN CONTRACT, TORT OR OTHERWISE), INQUIRY, PROCEEDING OR INVESTIGATION ARISING OUT OF OR BASED UPON THIS AGREEMENT OR THE SUBJECT MATTER HEREOF OR IN ANY WAY CONNECTED WITH
OR RELATED OR INCIDENTAL TO THE TRANSACTIONS CONTEMPLATED HEREBY, IN EACH CASE WHETHER NOW EXISTING OR HEREAFTER ARISING. 
 (i) Other
Activities. To the fullest extent permitted by law: (i) any Covered Person (as defined below) shall have the right to, and shall have no duty (contractual or otherwise) not to, directly or indirectly: (A) engage or otherwise
participate in any manner whatsoever in the same, similar or competing business activities or lines of business as the Company or its subsidiaries, (B) do business with any client or customer of the Company or its subsidiaries, or (C) make
investments in competing businesses of the Company or its subsidiaries, and such acts shall not be deemed wrongful or improper; (ii) no Covered Person shall be liable to the Company or its subsidiaries, for breach of any duty (contractual or
otherwise), including without limitation fiduciary duties, by reason of any such activities or of such person’s participation therein; and (iii) in the event any Covered Person acquires knowledge of a potential transaction or matter that
may be a corporate opportunity for the Company or its subsidiaries, on the one hand, and a Covered Person, on the other hand, or any other person, no Covered Person shall have any duty (contractual or otherwise), including without limitation
fiduciary duties, to communicate, present or offer such corporate opportunity to the Company or its subsidiaries and shall not be liable to the Company or its subsidiaries for breach of any duty (contractual or otherwise), including without
limitation fiduciary duties, by reason of the fact that the Covered Person directly or indirectly pursues or acquires such opportunity for itself, directs such opportunity to another person, or does not present or communicate such opportunity to the
Company or its subsidiaries, even though such corporate opportunity may be of a character that, if presented to the Company or its subsidiaries, could be taken by the Company or its subsidiaries. The Company renounces any interest or expectancy of
the Company in, or in being offered an opportunity to participate in, any such opportunity. “Covered Persons” include Vista Equity Partners Fund VI, L.P., Vista Equity Partners Fund VI-A,
L.P., and VEPF VI FAF, L.P., Vista Equity Partners Management, LLC and their respective affiliates and any of their respective managed investment funds and portfolio companies (excluding the Company and its subsidiaries) and their respective
partners, members, directors, managers, employees, stockholders, agents, any successor by operation of law (including by merger) of any such 

  
 8 













 
person, and any entity that acquires all or substantially all of the assets of any such person in a single transaction or series of related transactions. Notwithstanding anything in this
Section 10(i) to the contrary, for so long as VEP and its affiliates hold at least 50.1% of the outstanding membership interests of Topco, to the extent of any conflict between this Section 10(i) and the Amended and Restated Limited
Liability Company Agreement of Topco (the “Topco LLC Agreement”), the Topco LLC Agreement shall control. 
 (j) Complete
Agreement. This Agreement, together with the Data Protection Addendum, embodies the complete agreement and understanding among the parties hereto with respect to the subject matter hereof, and supersedes and preempts any prior understandings,
agreements or representations by or among such parties, written or oral, which may have related to the subject matter hereof in any way. 
 *
* * * 

  
 9 













 IN WITNESS WHEREOF, the parties hereto have executed this Management Agreement on the date
first written above. 
  

			
	VISTA EQUITY PARTNERS MANAGEMENT, LLC
		
	By:	 	VEP Group, LLC
	Its:	 	Senior Managing Member
		
	By:	 	 /s/ Robert F. Smith

	Name:	 	Robert F. Smith
	Title:	 	Managing Member
	
	KAVACHA TOPCO, LLC
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President


  

			
	KAVACHA INTERMEDIATE, LLC
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President
	
	KAVACHA HOLDINGS, INC.
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President


  

			
	INTEGRAL AD SCIENCE, INC.
		
	By:	 	 /s/ Don Epperson

	Name:	 	Don Epperson
	Title:	 	Chief Executive Officer


 {Management Agreement} 












 DATA PROTECTION ADDENDUM 

This Data Protection Addendum (“DPA”), which forms part of the Management Agreement (“Agreement”) among: (i) Vista
Equity Partners Management, LLC (“VEP”); (ii) Kavacha Topco, LLC, a Delaware limited liability company (“Topco”); Kavacha Intermediate, LLC, a Delaware limited liability company
(“Intermediate”); Kavacha Holdings, Inc., a Delaware corporation (“Parent”); and Integral Ad Science, Inc., a Delaware corporation (“IAS”, and together with Topco, Intermediate and Parent, as any
such company’s name or corporate form may change from time to time and such company’s successors and assigns, the “Company”), to which it is attached, reflects the Parties’ agreement with regards to the processing of
EU Personal Data. Each of VEP and Company may be referred to herein as a “Party” or the “Parties”. 
 The DPA applies to
VEP’s processing of Personal Data provided by the Company or/and its affiliates to VEP. Except as expressly stated otherwise, in the event of any conflict between the terms of this DPA, including any policies or appendices referenced herein,
and the Agreement, the terms of this DPA shall take precedence. 
  

	1.	 Definitions 


  

	1.1	 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly: 


  

	 	1.1.1	 “Company” is as defined above; 



 

	 	1.1.2	 “Data Protection Legislation” means all applicable legislation relating to the protection and
processing of Personal Data in any relevant jurisdiction, including (without limitation): the Data Protection Directive (95/46/EC), the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Data Protection (Processing of
Sensitive Personal Data) Order 2000, or any other legislation which implements any other current or future legal act of the European Union concerning the protection and processing of personal data (including Regulation (EU) 2016/679 (the General
Data Protection Regulation) and any national implementing or successor legislation), and including any amendment or re-enactment of the foregoing; 



 

	 	1.1.3	 “Personal Data” has the meaning given to it in the Data Protection Legislation and relates
only to personal data, or any part of such personal data, of which VEP is a controller in connection with the performance of its obligations under this DPA and the Agreement; 



 

	 	1.1.4	 “Standard Contractual Clauses” means the standard contractual clauses for the transfer
of Personal Data from the EU to controllers established in third countries (controller to controller transfers), as set out in the Annex to Commission Decision 2004/915/EC and attached at Schedule 1 hereto; and 



 

	 	1.1.5	 “VEP” means Vista Equity Partners Management, LLC. 















	 	1.2	 The terms, “Data Subject”, “processing and process”, “supervisory authority”,
and “controller”, “processor” and “appropriate technical and organisational measures” shall have the meanings given to them in the Data Protection Legislation. 



 

	 	1.3	 The word “include” shall be construed to mean include without limitation, and cognate terms
shall be construed accordingly. 


  

	 	2.	 Data Protection 



 

	 	2.1	 The Parties acknowledge and agree that, for the purposes of the Data Protection Legislation, VEP is a
controller of the Personal Data. VEP shall comply, and take all reasonable steps to cause its employees, agents and subcontractors to comply, with its obligations under applicable Data Protection Legislation. 



 

	 	2.2	 VEP shall: (i) only process the Personal Data to the extent necessary to exercise its rights, and perform
its obligations, under the Agreement and this DPA; and (ii) shall not do or omit to do anything that would cause the Company (or its affiliates) to breach its obligations under Data Protection Legislation. 



 

	 	2.3	 VEP shall implement appropriate technical and organisational measures to ensure a level of security of the
Personal Data appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of processing. 



 

	 	2.4	 In the event of a notice, dispute or claim brought by a data subject, supervisory authority, or other third
party concerning the processing of the Personal Data against either or both Parties, the Parties will inform each other about any such notices, disputes or claims, and will cooperate with each other to resolve the matter with the relevant data
subject, supervisory authority or other third party. The Parties agree to provide reasonable assistance to each other to enable each Party to comply with any data subject requests in respect of the Personal Data that are received by either Party
under Data Protection Legislation and to respond to any other queries or complaints from data subjects. 


  

	 	2.5	 VEP shall only transfer the Personal Data to, or process the Personal Data in, any country outside the European
Economic Area in accordance with Data Protection Legislation (which may include VEP entering into the Standard Contractual Clauses). 














 IN WITNESS WHEREOF, this DPA is entered into and becomes a binding part of the Agreement with effect from
the date first set out above. 
  

			
	KAVACHA TOPCO, LLC
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President

  

			
	KAVACHA INTERMEDIATE, LLC
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President
	
	KAVACHA HOLDINGS, INC.
		
	By:	 	 /s/ Michael Fosnaugh

	Name:	 	Michael Fosnaugh
	Title:	 	Vice President

  

			
	INTEGRAL AD SCIENCE, INC.
		
	By:	 	 /s/ Don Epperson

	Name:	 	Don Epperson
	 Title:
  

Dated:
	 	 Chief Executive Officer
  

July 19, 2018















			
	VISTA EQUITY PARTNERS MANAGEMENT, LLC
		
	By:	 	/s/ Robert F. Smith
	Name: Robert F. Smith
	Title: Managing Member

 Dated: July 19, 2018 












 Schedule 1 
  

					
	



	 	  EUROPEAN COMMISSION

 DIRECTORATE-GENERAL JUSTICE
  

 Directorate C: Fundamental rights and Union citizenship

 Unit C.3: Data protection


  
  

Commission Decision C(2004)5721 

SET II 
 Standard
contractual clauses for the transfer of personal data from the Community to third countries (controller to 
 controller transfers)

 Data transfer agreement 

between 
 KAVACHA TOPCO, LLC; KAVACHA
INTERMEDIATE, LLC; KAVACHA HOLDINGS, INC.; and INTEGRAL AD SCIENCE,
INC.                                        
                                         
                            (name) 

c/o Vista Equity Partners Management, LLC, 4 Embarcadero Center, 20th Floor, San
Francisco, CA 94111 (address and country of establishment) 
 hereinafter “data exporter” 

and 
 VISTA EQUITY PARTNERS MANAGEMENT,
LLC                                        
 (name) 
 4 Embarcadero Center, 20th Floor, San Francisco, CA 94111
                               (address and country of establishment) 

hereinafter “data importer” 

each a “party”; together “the parties”. 

Definitions 
 For the purposes of the clauses: 

 

	 	a)	 “personal data”, “special categories of data/sensitive data”,
“process/processing”, “controller”, “processor”, “data subject” and “supervisory authority/authority” shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the
authority” shall mean the competent data protection authority in the territory in which the data exporter is established); 


  

	 	b)	 “the data exporter” shall mean the controller who transfers the personal data; 



 

	 	c)	 “the data importer” shall mean the controller who agrees to receive from the data exporter personal
data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection; 



 

	 	d)	 “clauses” shall mean these contractual clauses, which are a free-standing document that does not
incorporate commercial business terms established by the parties under separate commercial arrangements. 


 The details of the transfer
(as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses. 













	I.	 Obligations of the data exporter 



The data exporter warrants and undertakes that: 
  

	 	a)	 The personal data have been collected, processed and transferred in accordance with the laws applicable to the
data exporter. 


  

	 	b)	 It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations
under these clauses. 


  

	 	c)	 It will provide the data importer, when so requested, with copies of relevant data protection laws or
references to them (where relevant, and not including legal advice) of the country in which the data exporter is established. 


  

	 	d)	 It will respond to enquiries from data subjects and the authority concerning processing of the personal data by
the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer
is unwilling or unable to respond. Responses will be made within a reasonable time. 


  

	 	e)	 It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries
under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right
to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the
confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required. 


  

	II.	 Obligations of the data importer 



The data importer warrants and undertakes that: 
  

	 	a)	 It will have in place appropriate technical and organisational measures to protect the personal data against
accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.



  

	 	b)	 It will have in place procedures so that any third party it authorises to have access to the personal data,
including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on
instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data. 



 

	 	c)	 It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws
that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.



  

	 	d)	 It will process the personal data for purposes described in Annex B, and has the legal authority to give the
warranties and fulfil the undertakings set out in these clauses. 


  

	 	e)	 It will identify to the data exporter a contact point within its organisation authorised to respond to
enquiries concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data
exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause I(e). 


  

	 	f)	 At the request of the data exporter, it will provide the data exporter with evidence of financial resources
sufficient to fulfil its responsibilities under clause III (which may include insurance coverage). 


  

	 	g)	 Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and
documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to
ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within
the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion. 















	 	h)	 It will process the personal data, at its option, in accordance with: 



 

	 	i.	 the data protection laws of the country in which the data exporter is established, or 



 

	 	ii.	 the relevant provisions1 of any Commission decision
pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by
such authorisation or decision for the purposes of the transfer(s) of the personal data2, or 


  

	 	iii.	 the data processing principles set forth in Annex A. 



Data importer to indicate which option it
selects:                                       
                                         
                         

Initials of data importer:
                                         
                                         
                                         
                   ; 
  

	 	i)	 It will not disclose or transfer the personal data to a third party data controller located outside the
European Economic Area (EEA) unless it notifies the data exporter about the transfer and 


  

	 	i.	 the third party data controller processes the personal data in accordance with a Commission decision finding
that a third country provides adequate protection, or 


  

	 	ii.	 the third party data controller becomes a signatory to these clauses or another data transfer agreement
approved by a competent authority in the EU, or 


  

	 	iii.	 data subjects have been given the opportunity to object, after having been informed of the purposes of the
transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or 


  

	 	iv.	 with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the
onward transfer 


  

	III.	 Liability and third party rights 



 

	 	a)	 Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability
as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any
breach of third party rights under these clauses. This does not affect the liability of the data exporter under its data protection law. 


  

	 	b)	 The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause
and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and
accept jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his
rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A
data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden
to prove that it took reasonable efforts). 


  
  


	1 	 “Relevant provisions” means those provisions of any authorisation or decision except for the
enforcement provisions of any authorisation or decision (which shall be governed by these clauses). 



	2 	 However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must be
applied when this option is chosen and take precedence over any comparable provisions of the Commission Decision selected. 















	IV.	 Law applicable to the clauses 



These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to
processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause. 
  

	V.	 Resolution of disputes with data subjects or the authority 



 

	 	a)	 In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the
personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion. 



 

	 	b)	 The parties agree to respond to any generally available non-binding
mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider
participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes. 


  

	 	c)	 Each party shall abide by a decision of a competent court of the data exporter’s country of establishment
or of the authority which is final and against which no further appeal is possible. 


  

	VI.	 Termination 


  

	 	a)	 In the event that the data importer is in breach of its obligations under these clauses, then the data exporter
may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated. 


  

	 	b)	 In the event that: 


  

	 	i.	 the transfer of personal data to the data importer has been temporarily suspended by the data exporter for
longer than one month pursuant to paragraph (a); 


  

	 	ii.	 compliance by the data importer with these clauses would put it in breach of its legal or regulatory
obligations in the country of import; 


  

	 	iii.	 the data importer is in substantial or persistent breach of any warranties or undertakings given by it under
these clauses; 


  

	 	iv.	 a final decision against which no further appeal is possible of a competent court of the data exporter’s
country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or 


  

	 	v.	 a petition is presented for the administration or winding up of the data importer, whether in its personal or
business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data
importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs 



then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these
clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses. 
  

	 	c)	 Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article
25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes
directly applicable in such country. 


  

	 	d)	 The parties agree that the termination of these clauses at any time, in any circumstances and for whatever
reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred. 















	VII.	 Variation of these clauses 



The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where
required. This does not preclude the parties from adding additional commercial clauses where required. 
  

	VIII.	 Description of the Transfer 



The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business
information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional
transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers. 













			
	Dated:
	
	FOR DATA IMPORTER
	VISTA EQUITY PARTNERS MANAGEMENT, LLC

  

			
		
	By:	 	 /s/ Robert F. Smith

	Name:	 	Robert F. Smith
	Title:	 	Managing Member

 Dated: July 19, 2018 
 FOR DATA
EXPORTER 
 COMPANY 
  

			
	KAVACHA TOPCO, LLC
		
	By:	 	 /s/ Michael Fosnaugh



			
	Name:	 	Michael Fosnaugh
	Title:	 	Vice President

  

			
	KAVACHA INTERMEDIATE, LLC
		
	By:	 	 /s/ Michael Fosnaugh



			
	Name:	 	Michael Fosnaugh
	Title:	 	Vice President
	
	KAVACHA HOLDINGS, INC.
		
	By:	 	 /s/ Michael Fosnaugh



			
	Name:	 	Michael Fosnaugh
	Title:	 	Vice President

  

			
	INTEGRAL AD SCIENCE, INC.
		
	By:	 	 /s/ Don Epperson

	Name:	 	Don Epperson
	Title:	 	Chief Executive Officer

 Dated: July 19, 2018 












 ANNEX A 

DATA PROCESSING PRINCIPLES 
  

	1.	 Purpose limitation: Personal data may be processed and subsequently used or further communicated only for
purposes described in Annex B or subsequently authorised by the data subject. 


  

	2.	 Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The
personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed. 


  

	3.	 Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as
information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter. 


  

	4.	 Security and confidentiality: Technical and organisational security measures must be taken by the data
controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data
controller, including a processor, must not process the data except on instructions from the data controller. 


  

	5.	 Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data
subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or
systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm
the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be
identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is
inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of
any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating
to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority. 



 

	6.	 Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are
necessary to protect such sensitive data in accordance with its obligations under clause II. 


  

	7.	 Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective
procedures should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes. 



 

	8.	 Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data
exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to
him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when: 



a) i. such decisions are made by the data importer in entering into or performing a contract with the data subject, and 

ii. the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties
making such decision or otherwise to make representations to that parties. 
 or 

b) where otherwise provided by the law of the data exporter. 












 ANNEX B 

DESCRIPTION OF THE TRANSFER 

(To be completed by the parties) 
 Data
subjects 
 The personal data transferred concern the following categories of data subjects: 

Employees of the Company or affiliated entities, executives, directors, employee candidates, vendors, other business relationships. 

Purposes of the transfer(s) 
 The transfer is made for the
following purposes: 
 We process personal information to enable us to perform the management and consulting services provided under the Agreement
(including, but not limited to management, finance, marketing, operational and strategic planning, relationship access, corporate development and analysis of potential mergers and acquisitions). We process Company candidates’ data for
administration, research, database development and business operation purposes. We also process personal information in order to maintain our own accounts and records, promote our services and to support and manage our employees and partners.

 Categories of data 
 The personal data
transferred concern the following categories of data: 
  

	 	•	 	 personal details (e.g., name, title, email, address, taxpayer ID number, passport number, driver licence number
etc.) 


  

	 	•	 	 financial details (e.g. compensation including bonus amounts and account information to facilitate payment)



  

	 	•	 	 business of the person whose personal information we are processing (e.g., job title) 



 

	 	•	 	 education and employment details 



 

	 	•	 	 family details 


  

	 	•	 	 lifestyle and social circumstances 



 

	 	•	 	 photographs 



Recipients 
 The personal data transferred may be
disclosed only to the following recipients or categories of recipients: 
  

	 	•	 	 Vista Consulting Group, LLC 



 

	 	•	 	 Other affiliates, including affiliated investment funds and the limited partners thereof 



 

	 	•	 	 suppliers and service providers (e.g. data hosting providers, auditors and third parties undertaking KYC reviews
and background checks, amongst others) 


  

	 	•	 	 business associates 


  

	 	•	 	 financial organisations 



 

	 	•	 	 ombudsman, regulatory and governmental authorities 



 

	 	•	 	 employment and recruitment agencies 



 

	 	•	 	 current, past or prospective employers 



 

	 	•	 	 healthcare professionals, social and welfare organisations (e.g., for
HR-related benefits and pensions providers) 


  

	 	•	 	 educators and examining bodies 



 

	 	•	 	 trade associations and professional bodies 



 

	 	•	 	 debt collection and tracing agencies 



 

	 	•	 	 credit reference agencies 



 

	 	•	 	 complainants, enquirers 



 

	 	•	 	 courts and tribunals 


  

	 	•	 	 family, associates or representatives of the person whose personal data we are processing 



Sensitive data (if appropriate) 
 The personal data
transferred concern the following categories of sensitive data:  
  

	 	•	 	 physical or mental health details 



 

	 	•	 	 trade union membership 



 

	 	•	 	 offences and alleged offences 



 

	 	•	 	 criminal proceedings, outcomes and sentences 



Data will be stored for no longer than is necessary for the purpose. 












 Contact points for data protection enquiries 

Data importer 
 Vista Equity Partners Management, LLC 

4 Embarcadero Center, 20th Floor 

San Francisco, CA 94111 
 Data exporter 

Kavacha Topco, LLC 
 Kavacha Intermediate, LLC 

Kavacha Holdings, Inc. 
 Integral Ad Science, Inc. 

c/o Vista Equity Partners Management, LLC 
 4 Embarcadero
Center, 20th Floor 
 San Francisco, CA 94111