Annex 1 to Restricted Transfer Addendum: Description of the Processing

Part 1. List of Parties

Data exporter(s)

When acting as Data Exporter, the relevant Party's details and its data protection officer and/or representative in the European Union/United Kingdom shall be as identified in the Order Form or as follows: For Publisher, as identified in the Order Form; For Adagio: Marieke Schuit, DPO, legal@adagio.io, or such other DPO as Adagio may designate from time to time upon notice to Publisher.

Data importer(s)

When acting as Data Importer, the relevant Party's details and its data protection officer and/or representative in the European Union/United Kingdom shall be as identified in the Order Form or as follows: For Publisher, as identified in the Order Form; For Adagio: OnFocus, a SAS incorporated in France (RCS n° 820244770), dba Adagio, with its data protection officer being Marieke Schuit, DPO, legal@adagio.io, or such other DPO as Adagio may designate from time to time upon notice to Publisher.

Part 2. Description of Transfer

• Categories of data subjects whose personal data is transferred: data subjects utilizing the Media owned, operated, or contractually controlled by Publisher.
• Categories of personal data transferred: Device ID and Unique ID (either generated by Adagio or by a Bidder), non-precise geolocation information derived from IP addresses, IP addresses, cookie identifiers, advertising identifiers, browser type and version, operating system information, and other technical information reasonably necessary for the delivery of advertising.
• Sensitive Personal Data transferred (if applicable): N/A
• Frequency of the transfer: On a continuous basis.
• Nature of the processing: Collection, recording, organization, structuring, alteration, retrieval, consultation, disclosure by transmission, erasure or destruction, as reasonably necessary to provide the Services
• Purpose(s) of the data transfer and further processing: See the GDPR General Terms for the Processing Purposes and the applicable Order Form.
• Period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The data will be retained as required for the Processing Purposes set forth in the GDPR General Terms and will be deleted within the time frames set forth in Adagio’s then-current publicly posted privacy policy on its corporate website and no later than 13 months after collection, unless a longer retention period is specifically required by applicable law or reasonably necessary for Adagio's legitimate business purposes in compliance with applicable data protection laws. Any extension of the retention period for legitimate business purposes shall be documented and justified in accordance with Article 5(1)(e) of the GDPR.

Part 3.  Competent Supervisory Authority/ies.

Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of GDPR in accordance with its Art 3 (2) and has appointed a representative pursuant to Art. 27 (1) GDPR: The supervisory authority of the Member State in which the representative within the meaning of Art. 27 (1) GDPR is established shall act as a competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of GDPR in accordance with its Art. 3 (2) without however having to appoint a representative pursuant to Art. 27 (2) GDPR: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behavior is monitored shall act as competent supervisory authority.