Effective Date: September 25, 2023
This International Data Privacy Addendum (“Addendum”) is incorporated into the services agreement(s) (all such agreements, the “Agreement”) between Quantcast International Limited on behalf of itself and any other Quantcast entity identified in the Agreement (“Quantcast”) and the counterparty(ies) identified in the Agreement (“Company”).
This Addendum applies to the extent that International Privacy Laws apply, as described below. This Addendum replaces any terms previously applicable to the processing of Personal Data to which International Privacy Laws apply.
Capitalized terms not defined in this Addendum are as defined in the Agreement. In the event of any inconsistency between the terms of the Agreement and this Addendum, the terms of this Addendum shall prevail.
Quantcast reserves the right to modify this Addendum. Quantcast will notify Company by making the revised version available on this page, and an updated revision date will indicate that changes have been made. If Company does not accept the changes, Company must stop using the Quantcast services and products that are subject to this Addendum. Company’s continued use of the Quantcast services and products after Quantcast publishes changes means that Company agrees to the updates.
1. Definitions.
“Authorized Purposes” means all purposes for which the Agreement requires or permits Quantcast to use Company Information and Personal Data in the Agreement, including as applicable, personalized advertising and audience measurement.
“Canadian Privacy Laws” means the Personal Information Protection and Electronic Documents Act, SC 2000 c 5; the Personal Information Protection Act, SA 2003, c P-6.5; the Personal Information Protection Act, SBC 2003, c 63; and the Act respecting the protection of personal information in the private sector, CQLR c P-39.1, as amended by Law 25.
“Company Information” means any Personal Data that is provided to Quantcast by or on behalf of Company or onboarded to Company’s account with Quantcast, whether directly or via a third party (e.g., an onboarding service provider), including data collected via a Tag.
“European Privacy Laws” means the EU General Data Protection Regulation (Regulation (EU) 2016/679) and any EU Member State laws implementing the GDPR, and the UK GDPR and the UK Data Protection Act 2018, the e-Privacy Directive (Directive 2002/58/EC) and the UK Privacy and Electronic Communications Regulations 2003, and the Swiss Act on Federal Data Protection.
“International Privacy Laws” means the Canadian Privacy Laws, European Privacy Laws and any other non-US privacy laws referenced in this Addendum.
“Online Properties” means Company Media or Client Data (if defined in the Agreement) or other webpages, advertisements and other digital properties on which the Tag is implemented.
“Personal Data” means any information relating to an individual that is subject to protection under the International Privacy Laws and includes information that is referred to as “personal information” and similar terms as may be defined in the International Privacy Laws.
“Tags” means Quantcast-provided cookies, tags, pixels or other tracking technologies, including campaign tags, ad serving tags and measurement tags (including Campaign Tags, if defined in the Agreement).“Transparency Framework” means any applicable transparency and consent framework, including the IAB Europe Transparency and Consent Framework and the IAB Transparency and Consent Framework Canada (TCF Canada), or other technical standard agreed to by the parties.
2. Lawful Collection and Processing.
To the extent that International Privacy Laws apply, including where Online Properties are accessed by individuals in any country or region subject to International Privacy Laws and where Company Information that includes Personal Data subject to International Privacy Laws is provided, Company agrees to:
2.1. Provide users with information about (i) Quantcast’s use of Company Information (where applicable) and Quantcast’s use of Tags and/or other storing and/or accessing of information stored on users’ devices, including means of activating such functions where required by International Privacy Laws (e.g., under Quebec law); and (ii) Quantcast’s processing of users’ Personal Data for the Authorized Purposes, including by posting a link to Quantcast’s Products and Services Privacy Policy (www.quantcast.com/privacy).
2.2. Obtain any required consents for (i) Quantcast’s use of Company Information and of Tags and/or other storing and/or accessing of information stored on users’ devices and (ii) Quantcast’s collection, use, disclosure or other processing of users’ Personal Data for the Authorized Purposes.
2.3. As to Tags, inform Quantcast in accordance with the Transparency Framework that the conditions of 2.1 and 2.2 are met, or prevent Tags from executing unless the conditions of 2.1 and 2.2 are met. To the extent that Company has implemented a consent management platform configured to provide transparency about and obtain consent for Quantcast in accordance with the Transparency Framework, the conditions of 2.1, 2.2 and 2.3 shall be deemed to be met.
3. European Privacy Laws.
This section applies to the extent that European Privacy Laws apply, including where Online Properties are accessed by individuals in the European Economic Area, Switzerland, or the United Kingdom and where Company Information that includes Personal Data subject to European Privacy Laws is provided (whether provided directly by Company or via third parties on Company’s behalf).
3.1. As to all Quantcast services for marketers (such as Quantcast Advertise and managed campaign services) and as to Quantcast’s provision of audience measurement services to Company, Company and Quantcast acknowledge joint determination of the means and purposes of processing of Personal Data. Such joint controllership covers the collection of Personal Data through the Tags and any other transmission of such Personal Data to Quantcast in connection with the foregoing services.
3.2. As to Agreements in which the Authorized Purposes includes Quantcast’s use of Company Information beyond the services provided directly to Company (i.e., Quantcast Measure), Company and Quantcast acknowledge that as to such uses, there is no joint determination of the purposes and means, and Quantcast and Company are separate and independent controllers.
3.3. The parties’ respective responsibilities for compliance with the obligations under European Privacy Laws in connection with the processing of Personal Data of users in the European Economic Area, Switzerland, or the United Kingdom that is collected by Quantcast from Online Properties on which Company places Tags is as follows:
3.3.1. Without prejudice to any obligations set forth in Agreement, Quantcast will ensure that it has a legal basis for the collection and processing of Personal Data. Quantcast will make available information about its data processing, as well as a means for users to exercise their data subject rights and other information required by European Privacy Laws, in its Products and Services Privacy Policy at www.quantcast.com/privacy. Quantcast will implement appropriate technical and organizational measures to enhance the security of its processing of Personal Data.
3.3.2. In addition to any obligations set forth in Agreement, Company will ensure that it has a legal basis for the collection and processing of Personal Data. Company will make available information about its data processing and other information required by European Privacy Laws in its privacy policy.
3.3.3. If any user exercises its rights under European Privacy Laws with respect to the parties’ processing of Personal Data collected by Quantcast from Online Properties on which Company placed Tags, or if Company is contacted by a supervisory authority with regard to such processing, Company will, promptly and no later than seven (7) days following receipt of the request, forward all relevant information regarding such requests to Quantcast at privacy.qil@quantcast.com. Quantcast agrees to respond to such requests as required by European Privacy Laws. For the avoidance of doubt, Company is not authorized to answer on Quantcast’s behalf.
4. Canadian Privacy Laws.
This section applies to the extent that Canadian Privacy Laws apply, including where Online Properties are accessed by individuals in Canada and where Company Information that includes Personal Data subject to Canadian Privacy Laws is provided (whether provided directly by Company or via third parties on Company’s behalf).
4.1. Quantcast agrees that any Company Information received from the Company or exposed to it in connection with the Agreement in Canada is done so solely for the Authorized Purposes, and Quantcast acquires no right or interest in or to the Company Information except as set out in the Agreement.
4.2. Quantcast will not use any Company Information provided or disclosed by the Company for any purpose other than that for which it was provided or disclosed to it, and as authorized in the Agreement. Except to the extent that the Authorized Purposes include Quantcast’s use of Company Information beyond the services provided directly to Company (i.e., Quantcast Measure), as necessary to fulfill its obligations under the Agreement, or as required by law, Quantcast shall not disclose any Company Information to any third party except Quantcast’s third party service providers who process the Company Information solely on Quantcast’s behalf.
4.3. Quantcast will implement safeguards to protect against the loss, disclosure, alteration or misuse of Company Information that is in its care or custody, and will protect Company Information with the same degree of care and diligence that Quantcast uses to protect and safeguard its own like information, but not less than the degree of care that would be exercised by a reasonable person given the sensitivity of such Company Information.
4.4. Quantcast will cooperate as may be necessary to assist in any access or other individual requests, questions, complaints, audits and any investigations related to Company Information. In the event that Quantcast is contacted by any individual whose Personal Data is the subject of the Agreement or this Addendum, or by any person (including a regulator) respecting the Agreement, Quantcast will refer them to the Company and will promptly give the Company’s Privacy Officer notice of such contact. Quantcast will not communicate with any individual whose Personal Data is subject to this Addendum unless authorized to do so by the Company, except (a) as needed to acknowledge the request and direct the individual to Quantcast’s opt out functionality, and (b) as required by applicable law, including Canadian Privacy Laws.
4.5. Quantcast will only retain Company Information for as long as is reasonably necessary for the Authorized Purposes.
4.6. In the event that Quantcast becomes legally required to disclose any Company Information, Quantcast shall provide Company with prompt notice (unless Quantcast is prohibited from doing so) in order for Company to seek a protective order or other appropriate remedy and/or waive compliance with the provisions of this Addendum. In the event that such protective order or other remedy is not obtained, Quantcast shall furnish only that portion of the Company Information which is legally required to be furnished in the opinion of Quantcast’s counsel.
4.7. In addition to the requirements in Section 2 above, Company will provide users with information about transfers of Company Information outside of Canada and/or Quebec.
5. Application. For the avoidance of doubt, this Addendum applies to all Quantcast-branded services used by Company, such as Quantcast ad serving and audience measurement.