US Data Privacy Addendum

Effective Date: May 16, 2023

This US Data Privacy Addendum (this “Addendum”) entered into by Customer and Quantcast (each, a “Party” and collectively, the “Parties”), governs the Processing of Personal Information that Customer transmits or otherwise makes available to Quantcast in connection with the delivery of Quantcast’s services (“Services”). 

This Addendum is incorporated into the relevant Quantcast services agreement executed by the Parties (the “Agreement”). This Addendum reflects the Parties’ agreement with respect to the Processing of Personal Information pursuant to the Agreement and is applicable solely to the extent that the US State Privacy Laws apply. 

In the event of any inconsistency between the terms of the Agreement and this Addendum, the terms of this Addendum shall prevail. 

1. Definitions. Capitalized terms used in this Addendum that are not defined herein shall have the same meaning as set forth in the Agreement.

1.1. “Consumer” means a natural person to whom Personal Information relates.

1.2. “Consumer Rights Request” means a request made by a Consumer to exercise his or her rights under the US State Privacy Laws in relation to Personal Information.

1.3. “Controller” means the party that alone or jointly with others determines the purpose and means of the Processing of Personal Information. 

1.4. “Personal Information” means any information relating to a Consumer that is subject to protection under the US State Privacy Laws and includes information that is referred to as “personal data” and similar terms as may be defined in the US State Privacy Laws.  

1.5. “Processor” means the party that Processes Personal Information on behalf of the Controller. 

1.6. “Subprocessor” means a party engaged by Quantcast in the Processing of the Customer Personal Information on Customer’s behalf. 

1.7. “US State Privacy Laws” means privacy laws, regulations, or guidance applicable to the Processing of Personal Information in any relevant jurisdiction, including the California Consumer Privacy Act, as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”), the Colorado Privacy Act (“CPA”), the Connecticut Act Concerning Protection and Online Monitoring (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), and any other similar applicable laws that are in effect or come into effect during the term of the Agreement.  

1.8. The terms “Business,” “Process,” “Sale” (or “Sell”), “Service Provider,” “Share,” and “Third Party” have the meanings ascribed to them in the CCPA.

2. Quantcast as a Third Party

2.1. Role of Quantcast. The Parties acknowledge and agree that with regard to the Personal Information that Customer makes available to Quantcast through the Tag pursuant to the Agreement and any Personal Information included in the Customer Data (the “Disclosed Personal Information”), Quantcast is a Third Party. In its role as a Third Party, Quantcast shall comply with the obligations that apply to it under the US State Privacy Laws (including with respect to the Disclosed Personal Information) and provide the Disclosed Personal Information the level of privacy protection required by such laws. In the event that Quantcast determines that it can no longer meet its obligations under the US State Privacy Laws with respect to the Disclosed Personal Information, it shall take commercially reasonable steps to notify Customer.

2.2. Processing of the Disclosed Personal Information. Customer makes the Disclosed Personal Information available to Quantcast for the limited and specified purpose of providing Customer with access to Quantcast’s platform and the Services and as otherwise described in the Agreement. Quantcast shall not Process the Disclosed Personal Information for any other purpose unless such Processing is explicitly permitted or required by the US State Privacy Laws or other applicable law. 

2.3. Data Security. Quantcast shall maintain technical and organizational measures designed to protect the Disclosed Personal Information against any breach of security leading to the accidental or unlawful destruction, use, loss, alteration, unauthorized disclosure of, or access to the Disclosed Personal Information. 

2.4. Consumer Rights Requests. In accordance with the US State Privacy Laws, Customer shall notify Quantcast in writing or through other methods agreed upon by the Parties of all Consumer Rights Requests it receives relating to the Disclosed Personal Information with which Quantcast must comply (including deletion and opt-out requests). 

2.5. Compliance Verification. At reasonable intervals during the term of the Agreement not to exceed more than once in a given twelve (12) month period, Quantcast shall, upon written request, make available to Customer information or documentation necessary to demonstrate its compliance with its obligations under this Addendum with respect to the Disclosed Personal Information. In the event that the information or documentation provided by Quantcast reveals any unauthorized use of the Disclosed Personal Information, Customer and Quantcast shall promptly work together in good faith to agree upon reasonable and appropriate steps to stop and remediate the unauthorized use. 

3. Modifications. The Parties agree to cooperate in good faith to amend the terms of this Addendum and/or enter into additional terms as necessary to address modifications, amendments, or updates to the US State Privacy Laws.