EDAA Trust Seal

Platform & Data Services

DATA PROCESSING ADDENDUM

This Platform & Data Services Data Processing Addendum (DPA) applies to the Processing of Personal Data under any agreement that incorporates this DPA (the Agreement) by and between the Affiliate of Publicis Groupe Holdings B.V. (Publicis) and the other party to the Agreement (Client).

All references to Publicis shall be deemed references to a Publicis Affiliate that is a party to the Agreement or fulfills orders under the Agreement. All references to Client shall be deemed references to a Client Affiliate that is a party to the Agreement or places orders under the Agreement. Publicis and Client may be referred to herein each as a party or collectively as the parties.

Notwithstanding anything to the contrary in the Agreement, this DPA applies solely to: (a) the provision of digital advertising services by Publicis through its proprietary technology and (b) data services in which Publicis makes available Personal Data that it Processes as a Disclosing Controller, each as specifically described in the applicable Description of Processing available at https://legal.epsilon.com/us/description-of-processing (collectively, the “Platform & Data Services”).

This DPA governs the parties’ respective rights and obligations solely with respect to such Platform & Data Services. All other services provided by Publicis under the Agreement that involve the Processing of Personal Data by Publicis on behalf of Client as a Processor shall be governed exclusively by the data processing provisions contained in the Agreement and any processor-specific data processing addendum incorporated therein, and not by this DPA.

This DPA will form part of the Agreement, and any breach of this DPA will be a breach of the Agreement. In the event of any conflict or inconsistency between: (i) the Agreement; (ii) any processor-focused data processing provisions or addenda incorporated into the Agreement; and (iii) this DPA, this DPA shall prevail solely with respect to the Platform & Data Services, and the processor-focused data processing provisions shall prevail solely with respect to services for which Publicis acts as a Processor.

In consideration of the mutual promises contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

Definitions

All capitalized words used within this DPA are defined in the attached Schedule 1 Definitions.

Compliance with Applicable Data Protection Law

Each party understands and agrees that it will comply with its respective obligations under the Applicable Data Protection Law. For clarity, a party shall not be required to comply with the obligations of a data protection law unless such law applies to that party in accordance with the law’s territorial provisions. Unless expressly stated otherwise in a Description of Processing, each party acts as an independent Controller with respect to the Personal Data it Processes under the Agreement. Each party shall independently determine the purposes and means of its Processing and shall comply with its obligations under Applicable Data Protection Law.

Permitted Purposes

Recipient will Process the Personal Data made available by Disclosing Controller solely in accordance with the Permitted Purpose(s) identified within the specific description(s) of Processing as contemplated in the Agreement and/or as agreed by the parties from time to time for which email acknowledgment is sufficient. Each description of Processing shall identify the parties’ role (e.g., Controller, Third Party) with regards to the Personal Data Processed and shall form a part of this DPA. If the Agreement does not contain a description of Processing and the services include the serving of digital advertisements by Epsilon (a Publicis Groupe entity), the provision of clean room services by Epsilon, or the provision of services by Lotame or ReTargetly, the description of Processing for these Services can be found at https://legal.epsilon.com/us/description-of-processing.

Technical and Organizational Measures

Each party will implement and maintain technical and organizational measures appropriate to the nature of the Personal Data it Processes (including any Personal Data it may receive or access from the other party) in accordance with Applicable Data Protection Law. This includes measures that are designed to protect the Personal Data from unauthorized or illegal access, destruction, use, modification, or disclosure. Publicis has no obligation to protect Client Data that Client elects to transfer outside of Publicis’ systems.

Cooperation

Upon written request, the parties shall provide each other with such information as either party may reasonably require about the other party’s Processing of Personal Data under the Agreement, to the extent such party does not have access to the relevant information, so that the parties can:

    1. ensure that such information is presented to Data Subjects;
    2. complete statutorily required data protection assessments;
    3. respond to an inquiry from a Regulator related to a party’s performance under this DPA; and
    4. ensure the Recipient is Processing Personal Data made available by the Disclosing Controller consistent with the obligations under Applicable Data Protection Law.

Confidentiality

The parties will ensure that their personnel engaged in the Processing of Personal Data under the Agreement have received appropriate training regarding the access, use and treatment of Personal Data under Applicable Data Protection Laws and are subject to written confidentiality agreements governing the access, use and treatment of Personal Data.

Lawful Bases, Notice, Choice, and Consent

Each party shall identify and maintain a lawful basis for its Processing activities as required under the Applicable Data Protection Law. Disclosing Controller warrants that all Personal Data it makes available to Recipient under this Agreement has been collected, disclosed, and transferred in compliance with Applicable Data Protection Law. This includes: (a) providing Data Subjects with appropriate notices, at or before the time of collection; (b) obtaining all necessary and legally enforceable consents or establishing another lawful basis for Recipient’s Processing for the Permitted Purposes, including any required regulatory approvals; and (c) ensuring that no Personal Data is disclosed to Recipient relating to Data Subjects who have opted out, withdrawn consent, or otherwise exercised rights that prohibit such Processing (except where such requests are shared for suppression purposes). Disclosing Controller shall promptly notify Recipient of any Data Subject’s withdrawal of consent and provide documentation evidencing compliance with these obligations upon Recipient’s request. Where Publicis Tags are deployed on Client’s digital properties or Client makes available Client Data for Publicis digital advertising services, the terms in Schedule 2 shall apply.

Prohibited Data

Unless otherwise set out in the Agreement, Client shall ensure that no Personal Data that is afforded a higher level of protection under Applicable Data Protection Law is disclosed or made available to Publicis nor any Personal Data relating to a Data Subject under the age of 18 or any higher age that is considered a child under applicable laws.

International Transfers

    1. The parties may Process Personal Data throughout the world provided that any transfer of Personal Data outside the country of origin is subject to an appropriate data export mechanism where required by Applicable Data Protection Law. Upon request, and to the extent required by Applicable Data Protection Law, Publicis will provide Client with a list of countries to which Client Data is transferred.
    2. In the event the disclosure of Personal Data (including Client Data) by one party (the data exporter) to the other party (the data importer) under this DPA is considered a transfer of Personal Data outside the country of origin under Applicable Data Protection Law, and where required by such Applicable Data Protection Law, the transfer shall be subject to the following:
      1. The data importer agrees to comply with the same obligations the data exporter has under Applicable Data Protection Law in connection with the protection of Personal Data;
      2. The transfer shall be subject to the relevant Standard Contractual Clauses adopted under Applicable Data Protection Law or other lawful and valid transfer mechanisms. The Standard Contractual Clauses shall be completed with the data exporter being the Exporter, the data importer the Importer and with the information set out in this DPA and the Agreement, and shall be deemed signed by the parties when this DPA is signed; and
      3. Each party shall, upon the other party’s request, cooperate reasonably with the other in carrying out any assessment of such transfer that may be required under Applicable Data Protection Law.
    3. With respect to Personal Data (including Client Data) that is subject to Applicable Data Protection Law of the European Union (EU) and/or the United Kingdom (UK), such transfers shall be subject to the applicable Standard Contractual Clauses available here (as applicable):
      1. for Epsilon branded Services, here: https://legal.epsilon.com/eu/model-clauses
      2. for CJ branded Services, here: https://www.cj.com/legal/model-clauses
      3. for Lotame branded Services, here: https://www.lotame.com/wp-content/uploads/2024/12/2024.12_dpa-msa_GDPR-schedule_lotame.pdf
      4. for all other Services, here: https://sccsclients.publicisgroupe.com
    4. In the event that any provision of this DPA contradicts the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail, and any and all liability owed by Publicis or any of its Affiliates to Client under the Standard Contractual Clauses shall be limited to what is set out in the Agreement.

Inquiries

If either party receives correspondence, inquiries, complaints, investigations, or requests from a Regulator concerning Personal Data processed under this DPA that references the other party, it shall use commercially reasonable efforts to notify the other party within five (5) business days of receipt unless prohibited by law.

Additional Requirements under Applicable Data Protection Law

The parties will adhere to the following terms if required under Applicable Data Protection Law:

    1. Suspension of Processing. If the Recipient determines it can no longer meet its obligations under Applicable Data Protection Law, it shall promptly notify the Disclosing Controller. Upon such notice, or if the Disclosing Controller identifies unauthorized use or non-compliance, the Disclosing Controller may require the Recipient to immediately cease Processing the Personal Data made available by Disclosing Controller.
    2. Deidentified Data. To the extent Recipient receives deidentified data (as defined by Applicable Data Protection Law) from Disclosing Controller, Recipient will (i) take reasonable measures to ensure that such data cannot be associated with a Data Subject or household, (ii) maintain and use the information in deidentified form, and (iii) not attempt to reidentify such data.

Term and Survival

To the extent that Recipient continues to Process the Personal Data disclosed or made available by Disclosing Controller after the termination or expiration of the Agreement, the terms of this DPA survive such termination or expiration, and Recipient may continue to Process the Personal Data for the period identified in the description of Processing or Agreement, provided that such Processing complies with the requirements of this DPA and Applicable Data Protection Laws.

Entire Agreement

Except as expressly set forth herein, the terms of the Agreement remain unmodified and in full force and effect. The parties agree that this DPA shall replace any existing data processing agreement the parties may have previously entered into in connection with the Services, as such data processing agreement and terms relate to Personal Data within the scope of this DPA.

Contracts (Rights of Third Parties) Act 1999

Without prejudice to the rights of any Data Subject, a person who is not a party to this DPA has no rights under the Contracts (Rights of Third Parties) Act 1999 of the United Kingdom or any other applicable law concerning privity of contract to enforce any term of this DPA.

Choice of Law

This DPA and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law set out in the Agreement.

Jurisdiction

Each party irrevocably agrees that the courts set out in the Agreement shall have jurisdiction as set out in the Agreement to settle any dispute or claim arising out of or in connection with this DPA or its subject matter or formation (including non-contractual disputes or claims).

Schedule 1. Definitions

  1. Affiliate means any entity directly or indirectly Controlling, Controlled by, or under common Control with a party. Control means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of another entity (whether through the ownership of voting shares, by contract, or otherwise), the terms Controls and Controlled being construed accordingly.
  2. Applicable Data Protection Law means all laws or regulations relating to the protection of Personal Data Processed under the Agreement that are applicable to a party. For avoidance of doubt, such Applicable Data Protection Law shall only apply to a party that is subject to the territorial and/or other scope of such laws or regulations.
  3. Client Data means Personal Data Processed in connection with the Services that is: (a) made available or provided by Client (or a third party on Client’s behalf) to Publicis; or (b) collected by Publicis on Client’s behalf.
  4. Data Subject is a natural person or household that can be identified, directly or indirectly.
  5. Disclosing Controller means a party that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, and that discloses to or makes available (including digitally) Personal Data to a Recipient.
  6. Permitted Purpose(s) means the purpose(s) for which Recipient is authorized to Process the Personal Data disclosed or made available by the Disclosing Controller.
  7. Personal Data means any information relating to a Data Subject.
  8. Process(ing) means any operation or set of operations performed on Personal Data.
  9. Recipient means a party that receives Personal Data from a Disclosing Controller.
  10. Regulator means a regulator, law enforcement, or other government authority which from time-to-time monitors and/or enforces compliance with any Applicable Data Protection Law.
  11. “Services” means the services supplied by Publicis to Client under the Agreement.
  12. Standard Contractual Clauses means (i) where Applicable Data Protection Law of the European Union (EU) applies, the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, (ii) where Applicable Data Protection Law of the United Kingdom (UK) applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR, and (iii) standard contractual clauses (or similar measures as applicable) adopted by Regulators and/or under Applicable Data Protection Law to protect Personal Data when transferred outside the country of origin; each as amended from time to time.
  13. Tags mean any technology, tool, or code (including cookies, pixels, SDKs, APIs, local shared objects, and scripts) embedded within an advert, digital property(ies) or server(s) that enables access to or storage of information on a device.

Schedule 2. Tags and Digital Advertising by Publicis Affiliate (Epsilon/Lotame/ReTargetly)

  1. Without limiting each party’s obligation to comply with the Applicable Data Protection Law to which it is subject (in accordance with the DPA), the Parties agree that they shall each fulfil the specific data protection compliance responsibilities related to Personal Data of residents outside of the United States described below:
    1. Client shall integrate all its digital properties where Publicis Tags are deployed to collect Personal Data with a consent management platform verified by the Interactive Advertising Bureau’s Transparency and Consent Frame (TCF) and list (i) Epsilon and Epsilon d/b/a Lotame (as applicable to the Services) as a vendor and (ii) the Permitted Purposes.
    2. If Client does not use a TCF-verified consent management platform or if a TCF-verified consent management platform is not available in that market, Client must implement another mechanism to obtain visitor consent on digital properties where Publicis Tags are deployed. Such a mechanism must: (a) provide prominent notice to visitors of Publicis’ Tags for the Permitted Purposes; (b) provide visitors a link to Epsilon’s privacy notice; (c) display all necessary disclosures and obtain required consents before Tags are served; and (d) offer necessary opt-out mechanisms, all in accordance with Applicable Data Protection Law. Upon Publicis request, Client must provide records evidencing these disclosures and consents.
    3. For any Personal Data Client collects and provides to Publicis Affiliate (other than Data collected by the Publicis’ Tags), Client must: (a) collect the Personal Data fairly, lawfully, and in compliance with Applicable Data Protection Law; (b) provide Data Subjects with prominent notice at the point of collection that their Data will be processed by Publicis Affiliate, Epsilon, for Permitted Purposes, including a link to Epsilon’s privacy notice; (c) offer Data Subjects the ability to opt out of such Processing; and (d) not disclose to Publicis any Data of subjects who have opted out.
  2. Client must maintain a clear and conspicuous link on all relevant digital properties to its privacy notice, which must include a link to the respective country Digital Advertising Alliance’s opt-out page (e.g., Europe DAA, Canada DAA, US DAA).
  3. Upon request, Publicis will provide Client with information reasonably required about Publicis’ Processing of Client Data (including use of Tags) so Client can ensure information is provided to Data Subjects, as necessary.
  4. Publicis may provide Client with certain Personal Data regarding visitors to third party digital properties where adverts are served (“Metrics Data”). This includes device identifiers, cookie IDs, non-precise geolocation, date and time, browser/device information, and browsing behavior. Client will only Process Metrics Data to measure advertising performance.
  5. If Publicis, at Client’s request, places Client or a third party’s (each such third party as an Attribution Partner) tags in advertising served by Publicis Affiliate Epsilon, Client is solely responsible for the Attribution Partner. Client must ensure the Attribution Partner has the rights to Process any collected data (including Personal Data) for permitted uses: (a) attribution analysis, (b) click and impression tracking, (c) campaign measurement, (d) customization of creatives, or (e) another Publicis-approved purpose. Attribution Data cannot be used for retargeting or audience creation by Client, the Attribution Partner, or any other party. Client will indemnify and hold harmless Publicis and its Affiliates for any breach of these obligations by Client or the Attribution Partner.