PUBLISHER LINK AGREEMENT

THIS PUBLISHER LINK AGREEMENT (the Agreement) is made by and agreed to between you (Media Partner) and Conversant LLC, on behalf of itself and its Affiliates (Conversant), each a Party or together in any number referred to as Parties and is effective upon the date in which Media Partner accepts these terms (Effective Date). By using the Services set forth herein Media Partner agrees to terms in this Agreement. If Media Partner does not agree to the terms in the Agreement, do not use the Services.

NOW, THEREFORE, the Parties, for good and valuable mutual consideration, the receipt and sufficiency of which are hereby acknowledged, agree as follows:

1. Definitions. Unless otherwise defined herein, the following definitions shall apply to the terms of this Agreement:

Affiliate(s) means any corporation or entity which controls, is controlled by, or is under common control with a Party.

Confidential Information means all administrative, technical, financial, trade secret, or other private information, not generally available to the public, including any Conversant rates or pricing information, whether or not such Confidential Information carries a proprietary legend, is marked as confidential, or is transmitted verbally. Confidential Information does not include information, even if designated by a Party, which: (a) is or becomes generally available to the public without breach of this Agreement; (b) can be documented was in the possession of the Receiving Party (defined below) prior to its disclosure by the Disclosing Party (defined below); (c) becomes available from a third party not in breach of any obligations of confidentiality and without knowledge by the Receiving Party of any breach of a fiduciary duty or obligation owed to Disclosing Party (defined below); or (d) can be documented was independently developed by the Receiving Party.

Malicious Code means adware, spyware, P2P application, malware, spyware, viruses, worms, Trojan horses or other harmful computer code that interferes with or disrupts the integrity or performance of any Conversant service.

Conversant IP means the software or other computer and/or source code, and any deviations thereon, owned and/or provided by Conversant for use by Media Partner. For the avoidance of doubt, Conversant IP is Conversants Intellectual Property.

Intellectual Property or IP means trade names, logos, trademarks, service marks, trade dress, internet domain names, copyrights, patents, trade secrets, knowhow and proprietary technology, including, without limitation, those used by a Party or which may be developed and/or used by it in the future.

Laws means all applicable laws, including but not limited to federal, state and local laws and regulations.

Media Properties means any desktop websites, affiliate websites, mobile websites, and/or apps, owned by, aggregated by, or under the control of Media Partner, or on which Media Partner has a license to offer inventory.

PII means data linked, or intended to be linked, to an identified individual, including name, address, telephone number, email address, financial account number, and non-publicly available government-issued identifier.

Prohibited Data means (a) a government-issued identification number (e.g., Social Security Number, drivers license number, state identification number, or passport number); (b) a financial or customer account number, including financial institution or bank account number or a credit or debit card number; (c) information regarding an individuals sexual orientation, religion, or health or medical condition, including Protected Health Information, as defined in 45 CFR 160.103 or any sensitive personal data or special categories of personal data as defined by applicable data protection law; (d) unique biometric data or digital representation of biometric data; (e) an individuals full date of birth; (f) maiden name of the individual's mother; (g) individual's digitized or other electronic signature; (h) a user name, email address or other unique electronic identifier or routing code, which is sent in combination with a personal identification code, password, or security question and answer that would permit access to an online account, or (i) any data associated with an individuals status as a person under the age of thirteen

User means any actual person accessing the Media Properties.

2. Publisher Link.

2.1. Integration. Media Partner shall, via real-time API call, pass to Conversant, as applicable, hashed email addresses, phone numbers, Publisher Common ID, and/or Device IFA User Data. Conversant shall match the User Data, and/or data collected via Conversant IP, to its user profiles and return to Media Partner a corresponding pseudonymous and/or encrypted identifier (Conversant Data) to Media Partner. Media Partner shall, where applicable, provide such identifier to Conversant in bid requests associated with the User for which that identifier corresponds.

2.2. Licenses. Media Partner grants to conversant a non-exclusive irrevocable, fully-paid up, royalty-free right and license to use the User Data for (i) its performance pursuant to this Agreement; (ii) providing, managing, maintaining and enhancing its service; (iii) disclosing such information as may be required by law or legal process; and (iv) when such User Data is aggregated with similar information relating to other Conversant customers or users such that Media Partner or Users cannot be individually identified. Conversant hereby grants to Media Partner a limited, revocable, non-exclusive, non-assignable, non-sublicensable, non-transferable license to use the Conversant IP and Conversant Data solely for purposes of performing its obligations for the benefit of Conversant hereunder. Except for the limited licenses expressly granted in this Section, nothing in this Agreement shall be construed as either Party granting the other Party any right, title or interest in its intellectual property. Each Party shall own and shall retain all right, title and interest in its Intellectual Property.

3. Term and Termination. Either Party may terminate this Agreement immediately, in whole or in part, in its sole but reasonable discretion, with written notice, should the other Party: (i) materially breach an agreement with the other Party or its Affiliate and fails to cure such breach within thirty (30) days of its receipt of notice thereof; (ii) be a party to a lawsuit involving the other Party or its Affiliates; (iii) become insolvent; (iv) make an assignment for the benefit of creditors; (v) cease to do business as an ongoing concern; or (vi) file a petition or have a petition filed against it under any bankruptcy or insolvency laws. Upon termination of this Agreement, Media Partner agrees to immediately (y) remove from the Media Properties any and all Conversant IP and (z) securely delete all Conversant Data.

4. Representations and Warranties.

4.1. Mutual. Each Party represents and warrants that: (i) it has the full power and authority to enter into this Agreement; (ii) its execution of and performance under this Agreement does not and will not breach or cause a default under any other agreement, contract or joint venture agreement to which it is a party; (iii) its performance hereunder will fully comply with all applicable Laws, including but not limited to those relating to advertising, the internet, online privacy, unfair business practices, or otherwise; (iv) it will not engage in conduct as expressly prohibited in this Agreement; (v) its performance hereunder will not violate the rights of ant third party; and (vi) it will provide and maintain the resources, personnel and facilities suitable to perform its obligations under the Agreement.

4.2. By Media Partner. Media Partner represents, warrants, and covenants that it shall (i) not, or permit any third party to, provide to Conversant any Prohibited Data or Malicious Code and (ii) not, or permit any third party to, provide to Conversant any (a) PII or (b) User-information subject to opt-in consent if such consent has not been provided;

4.3. By Conversant. Conversant represents, warrants, and covenants that it shall (i) not, or permit any third party to, provide to Media Partner any Prohibited Data or Malicious Code and (ii) not, or permit any third party to, provide to Conversant any (a) PII or (b) User-information subject to opt-in consent if such consent has not been provided.

5. Confidentiality.

5.1. Confidential Information. A Party (the Receiving Party) may receive Confidential Information of the other Party (the Disclosing Party) and the Receiving Party shall keep such Confidential Information in confidence and protect such Confidential Information, including, but not limited to, by security measures at least as restrictive as those it takes to protect its own Confidential Information, but in no case less than reasonable security measures. Except as required by law or permitted by this Agreement, the Receiving Party shall not disclose Confidential Information to any third party (other than to its legal and financial advisors, agents, employees, and consultants on a need to know basis who are under obligations of confidentiality at least as restrictive as those in this Agreement), without the Disclosing Partys prior express written consent, and the Receiving Party shall not use any Confidential Information for any purpose other than in connection with the performance of its obligations and exercise of its rights under this Agreement. At the express written request of the Disclosing Party, the Receiving Party shall return or destroy any Confidential Information of the Disclosing Party to the extent possible and except as otherwise needed as evidence or as required to be provided by each Party in an aggregated form to governmental authority(ies). The Parties agree the Confidential Information of the Disclosing Party is and remains the property of the Disclosing Party. Disclosure or use of Confidential Information by the Receiving Party in violation of the provisions of this Section would cause irreparable injury to the Disclosing Party; therefore, in the event either Party breaches the provisions of this Section, the other Party, in addition to any other remedies it may have, is entitled to preliminary and permanent injunctive relief without having to post a bond.

5.2. Conditions of Disclosure. The Receiving Party may disclose Confidential Information pursuant to an order of a court of competent jurisdiction, by rule or regulation of an administrative agency to which the Receiving Party is subject, or subpoena, provided that, to the extent permitted by law and feasible, the Receiving Party provides prompt written notice of such court order, requirement, or subpoena to the Disclosing Party to enable the Disclosing Party to seek a protective order, confidential treatment, or to otherwise prevent or restrict such disclosure. The Receiving Party will reasonably cooperate, at the Disclosing Partys expense, to assist the Disclosing Party in seeking such protective order or from otherwise preventing or restricting such disclosure.

6. Privacy.

6.1. Definitions. In this Section 6, the following terms shall have the following meanings:

Controller, Processor, Data Subject, Personal Data, Processing (and Process) and Special Categories of Personal Data shall have the meanings given in EU/UK Data Protection Law;

Applicable Data Protection Law means all worldwide data protection and privacy laws, regulations and self-regulatory codes and/or principles applicable to the Personal Data in question, including, where applicable, EU Data Protection Law and also, where applicable, (i) all FTC Guidelines and any other applicable laws, rules and regulations with respect to online privacy; (ii) the Network Advertising Initiative Self-Regulatory Code of Conduct as amended from time to time; (iii) with the Digital Advertising Alliance (DAA) and European Digital Advertising Alliance (EDAA) Self-Regulatory Principles for Online Behavioral Advertising (collectively, the DAA Principles), as amended from time-to-time, which can be found at www.aboutads.info; and (v) EU/UK Data Protection Law.

EU/UK Data Protection Law means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); (iv) ) the UK Privacy and Electronic Communications (EC Directive) Regulations 2003; and (v) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii), (iii) or (iv); in each case as may be amended or superseded from time to time.

Standard Contractual Clauses means (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").

6.2. Purpose of Processing. Media Partner discloses or otherwise permits Conversant to collect, certain Personal Data about Users of Media Partners digital properties as described in the GPA (the Data). Conversant shall process the Data for the purposes described in the GPA (or as otherwise agreed in writing by the Parties) (the Permitted Purpose).

6.3. Relationship of the Parties. The Parties acknowledge that Media Partner is a Controller of the Data it discloses or otherwise permits Conversant to collect, and that Conversant will also process the Data as a Controller for the Permitted Purpose. Conversant may share the Data back with Media Partner for Media Partner to use solely for purposes compatible with the Permitted Purpose and always in accordance with Applicable Data Protection Law.

6.4. Compliance with Law. Each party undertakes that it will comply with Applicable Data Protection Law, including its responsibilities as Controller under EU/UK Data Protection Law, in respect of its Processing of the Data. Without limiting each Party's obligation to comply with the Applicable Data Protection Law to which it is subject, the Parties agree that they shall each fulfil the specific data protection compliance responsibilities described below:

6.4.1. Each Party shall: (i) maintain a prominent and publicly accessible privacy notice on their respective digital properties that satisfies the transparency and other requirements of Applicable Data Protection Law; (ii) ensure such privacy notice discloses the means by which a Data Subject can contact the Party in order to exercise its data protection rights under Applicable Data Protection Law; (iii) identify, and only Process the Data in a manner consistent with, one or more lawful bases under Applicable Data Protection Law; and (iv) include an appropriate choice mechanism, which the Parties shall honor and that is in compliance with the DAA Principles and all other Applicable Data Protection Laws.

6.4.2. With regards to Personal Data that subject to EU/UK Data Protection Law, Media Partner shall implement a mechanism to obtain User consent on any digital properties on which Media Partner will deploy Conversant Tags to collect Data. Such mechanism must: (a) provide prominent notice to Users that the digital property deploys Tags operated by Conversant for the Permitted Purposes; (b) provide Users a link to Conversant's privacy notice; (c) display to Users all necessary disclosures, and obtain all necessary consents, prior to service of the Tags to the User; and (d) offer all necessary opt-out mechanisms; in each case as is required to comply with Applicable Data Protection Law.

6.4.3. Media Partner shall ensure that, in respect of any Data that it collects and provides to Conversant (that is, other than Data collected by Conversant using Tags on Media Partner's digital properties): (a) it collects the Data fairly and lawfully and in compliance with Applicable Data Protection Law; (b) it provides prominent notice to Data Subjects, at the point of Data collection, that their Data shall be Processed by Conversant for the Permitted Purposes, (c) it offers Data Subjects the ability to opt-out of such Processing by Conversant; and (d) it will not disclose or make available to Conversant any Data relating to Data Subjects that have opted-out of Processing for the Permitted Purposes.

6.4.4. Upon request Conversant shall provide Media Partner with such information as Media Partner may reasonably require about Conversant's Processing of Data under this GPA (including the use of Tags) so that Media Partner can ensure that such information is presented to Data Subjects

6.5. Security. Each Party shall, taking into account the state of the art, the cost of implementation and the nature, scope, context and purpose of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures to protect the Data from and against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access.

6.7. Restricted Transfers. Neither Party shall engage in a Restricted Transfer in relation to Data unless it has taken such measures as are necessary to ensure the transfer is in compliance with Applicable Data Protection Law. To the extent that Media Partner's disclosure of Data to, or permitted collection of Data by, Conversant is a Restricted Transfer such Restricted Transfer shall be subject to the Data Transfer Addendum set out in Schedule 1.

6.8. Precise Location Information. To the extent applicable and required by Applicable Data Protection Law, and/or the DAA Principles, Media Partner shall (i) provide clear, meaningful, and prominent notice regarding the collection, transfer, and use of Precise Location Information; (ii) obtain opt-in consent from the User before providing Conversant with the Users Precise Location Information; and (iii) provide such Users with an easy-to-use tool to withdraw such Consent at any time. Precise Location Information means data that describes the precise geographic location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device, such as GPS-level latitude-longitude coordinates.

6.9. Industry Tools. Media Partner acknowledges that it may need to integrate its digital properties with certain industry tools or mechanisms that provide Data Subjects with notice and choice regarding the Processing of their Personal Data, including by way of example the Interactive Advertising Bureau's Transparency and Consent Framework, in order to receive certain Services or the full functionality of certain Services.

6.10. In the event that either Party receives any correspondence, inquiry or complaint from a Supervisory Authority ("Correspondence") directly related to the Data Processed under this GPA it shall promptly inform the other Party giving details of the same, and the Parties shall cooperate reasonably and in good faith in order to respond to the Correspondence in accordance with any requirements under Applicable Data Protection Law.

6.11. Data Subject Access Requests. Each Party shall be individually responsible for responding to lawful data protection requests that it receives from Data Subjects in respect of Data that it Processes. To the extent that either Party (the "Receiving Party") receives a request relating to Processing performed by the other Party (the "Other Party"), the Other Party shall provide such information and assistance as is reasonably necessary to the Receiving Party to enable the Receiving Party to respond to such request in accordance with Applicable Data Protection Law.

6.12. Legal requests. With regards to Personal Data that is subject to EU/UK Data Protection Law, if Conversant becomes aware that any government authority (including law enforcement) wishes to obtain access to or a copy of some or all of the Data, then Conversant will only make available the Data to the extent Conversant is legally required to do so. In no event shall Conversant disclose Data in a massive, disproportionate and indiscriminate manner that goes beyond what is necessary in a democratic society. Conversant shall have in place, maintain and comply with a policy governing Data requests from government authorities which at minimum prohibits: (1) massive, disproportionate or indiscriminate disclosure of Data; and (2) the disclosure of Data without a subpoena, warrant, writ, decree, summons or other legally binding order that compels disclosure of such.

9.13. Survival. This Section shall survive termination or expiry of the GPA. Upon termination or expiry of the GPA Conversant may continue to process the Data for the Permitted Purpose provided that such Processing complies with the requirements of this Section and Applicable Data Protection Law.

7. Indemnification. Each Party (the Indemnitor) shall defend, indemnify and hold the other Party, and that Partys parent and subsidiaries, and their respective employees, officers, directors, and Affiliates (the Indemnitee) harmless against all third party allegations, claims, actions, causes of action, lawsuits, damages, liabilities, obligations, costs and expenses, including, but not limited to, reasonable attorneys fees, court costs, and witness fees attributable to or related to the Indemnitor's breach of a duty, representation, warranty, obligation, or covenant this Agreement (Claim). Should any Claim give rise to a duty of indemnification under the provisions of this Agreement, then the Indemnitee shall promptly notify the Indemnitor in writing; provided that failure to give such prompt notice will not relieve the Indemnitor of its obligations under this section, except to the extent of losses that would have been avoided had such notice been given. The Indemnitee will fully cooperate with the Indemnitor to enable the Indemnitor to fulfill its obligations hereunder with respect to any Claim. The Indemnitee, at its own expense, may participate in the defense, provided that the Indemnitor shall control such defense and all negotiations relative to the settlement of any Claim. Participation in the defense shall not waive or reduce any obligations of the Indemnitor to indemnify or hold the Indemnitee harmless. The Indemnitor may enter into a settlement only if it: (i) involves only the payment of money damages by the Indemnitor; and (ii) includes a complete release of the Indemnitee. Any other settlement will be subject to written consent of the Indemnitee (consent not to be unreasonably withheld or delayed).

8. LIMITATION OF LIABILITY.

EXCEPT FOR EACH PARTYS INDEMNIFICATION, PRIVACY, AND CONFIDENTIALITY OBLIGATIONS HEREIN, IN NO EVENT SHALL EITHER PARTY HAVE ANY LIABILITY FOR ANY SPECIAL, INDIRECT, INCIDENTAL, OR PUNITIVE DAMAGES, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES ARISING IN ANY WAY OUT OF THIS AGREEMENT UNDER ANY CAUSE OF ACTION, WHETHER OR NOT THE OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING THE FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED REMEDY, AND REGARDLESS OF THE THEORY ON WHICH DAMAGES ARE SOUGHT, INCLUDING, WITHOUT LIMITATION, CONTRACT, STATUTE OR TORT. THEY SHALL NOT APPLY TO THE EXTENT THAT DAMAGES CANNOT BE LIMITED UNDER APPLICABLE MANDATORY LAW. EXCEPT FOR EACH PARTYS INDEMNIFICATION, PRIVACY, AND CONFIDENTIALITY OBLIGATIONS HEREIN, EACH PARTYS MAXIMUM AGGREGATE LIABILITY WILL NOT EXCEED TEN-THOUSAND DOLLARS ($10,000).

9. DISCLAIMER OF WARRANTIES.

EXCEPT AS EXPRESSLY WARRANTED HEREIN, CONVERSANTS PERFORMANCE OF ITS OBLIGATIONS HEREUNDER, THE CONVERSANT IP, AND/OR OTHER MATERIALS PROVIDED BY CONVERSANT, THEIR USE AND THE RESULTS THEREON, ARE PROVIDED ON AN AS IS, AS AVAILABLE BASIS. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, EACH PARTY SPECIFICALLY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND ANY WARRANTY REGARDING AN ECONOMIC OR OTHER BENEFIT THAT MIGHT BE GENERATED AS A RESULT OF THE TRANSACTIONS CONTEMPLATED HEREBY.

10. Force Majeure. Neither Party shall be liable by reason of any failure or delay in the performance of its obligations hereunder for any cause beyond the reasonable control of such Party, including, but not limited to, electrical outages, failure of Internet service providers, default due to Internet disruption, including, but not limited to, denial of service attacks, riots, insurrection, acts of terrorism, war, fires, floods, earthquakes, explosions, and other acts of nature, provided that such default or delay cannot be reasonably circumvented by the non-performing Party and that the non-performing Party uses reasonable efforts to resume performance as soon as practicable under the circumstances.

11. Notices. All notices relating to this Agreement must be sent (i) if to Conversant, via registered mail, return receipt requested or via an internationally recognized express mail carrier to: Epsilon Data Management, LLC, Legal Department/Urgent, 6021 Connection Drive, Irving, Texas, 75039 (effective upon actual receipt), with a concurrent copy to legalnotices@epsilon.com; and, (ii) if to Media Partner at the email or physical address listed on its account (effective upon sending as long as Conversant does not receive an error message regarding delivery of the email) or five (5) days after mailing, whichever occurs first.

12. Choice of Law and Attorneys Fees. The plaintiff to any litigated dispute arising out of or relating in any way to this Agreement shall have the option of selecting venue, and the other Party shall consent to such venue and exclusive jurisdiction, in any of the following States: New York, Texas, Delaware or Illinois. This Agreement shall be governed by the laws of the State selected for venue without respect to its choice of law rules. The prevailing Party of any litigated dispute arising out of or relating in any way to this Agreement shall receive its reasonable attorneys fees, together with its costs and expenses incurred resolving the dispute, as part of the judgment. The application of the United Nations Convention on the International Sale of Goods is expressly excluded.

13. Marketing. Any other use of either Partys name shall require that Partys prior written consent, which consent shall not be unreasonably withheld or delayed.

14. Independent Contractors. The relationship of the Parties shall be solely that of independent contractors, and nothing in this Agreement or in the business or dealings between the Parties shall be construed to make them joint venturers or partners with each other. Neither Party shall do anything to suggest to third parties that the relationship between the Parties is anything other than that of independent contractors.

15. Severability/Waiver. If any provision of this Agreement is held by any court of competent jurisdiction to be illegal, null or void, or against public policy, the remaining provisions shall remain in full force and effect. The Parties shall in good faith attempt to modify any invalidated provision to carry out the Parties stated intentions. The waiver of any breach of any provision under this Agreement by any Party shall not be deemed to be a waiver of any preceding or subsequent breach, nor shall any waiver constitute a continuing waiver.

16. Survival. Any obligations which expressly or by their nature are to continue after termination, cancellation, or expiration of this Agreement shall survive and remain in effect after such happening.

17. Assignment. Neither Party may assign this Agreement to a third party without the other Partys prior express written consent, which consent will not be unreasonably withheld or delayed, except in the case of a sale or other transfer of all or substantially all of a Partys assets or equity, whether by sale of assets or stock or by merger or other reorganization, which shall not require the non-assigning Partys consent provided that such successor entity is not in direct competition with Conversant or its Affiliates. Notwithstanding the foregoing, Conversant may assign this Agreement to an Affiliate without the consent of Media Partner.

18. Entire Agreement, Amendment, Counterparts. This Agreement contains the entire agreement and understanding of the Parties, and, supersedes all prior and contemporaneous agreements and understandings between the Parties, whether oral or written, regarding the subject matter hereof. This Agreement may only be amended or modified by a written instrument that describes the alteration, amendment or modification, signed by an authorized representative of each Party; no interlineations to this Agreement will be binding unless signed by an authorized representative of each Party. This Agreement may be signed in one or more counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same Agreement. Besides by original signatures, the signatures to this Agreement may be evidenced by and on facsimile or portable document format (PDF) copies of this Agreement (Copies) reflecting each Party's signature hereto, and provided that such Copies are legible and complete, any such Copies shall be sufficient to evidence the signature of such Party just as if it were an original signature.

19. Binding Effect. This Agreement shall be binding upon and inure to the benefit of the Parties and their respective successors and permitted assigns. Each Party agrees that it has had the opportunity to review this Agreement with an attorney and neither Party shall be considered the drafter.

SCHEDULE 1

DATA TRANSFER ADDENDUM (DTA)
(Controller-to-Controller)

1. Restricted Transfers
   1. The Parties agree that when Media Partner's disclosure of Data to, or permitted collection of Data by, Conversant is a Restricted Transfer it shall be subject to the appropriate Standard Contractual Clauses as follows:
      • 1. in relation to Data that is protected by the EU GDPR, the EU SCCs will apply completed as follows:

(i) Module One will apply.

(ii) in Clause 7, the optional docking clause will apply;

(iv) in Clause 11, the optional language will not apply;

(v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by French law;

(vi) in Clause 18(b), disputes shall be resolved before the courts of France;

(vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I to this DTA; and

(viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this DTA.

• • • 1. in relation to Data that is protected by the UK GDPR, the UK SCCs will apply completed as follows:

(i) For so long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to controllers set out in the European Commissions Decision 2004/915/EC of 27 December 2004 amending Decision 2001/497/EC (Prior C2C SCCs) for transfers of personal data from the United Kingdom, the Prior C2C SCCs shall apply between Media Partner and Conversant on the following basis:

Appendix 1 shall be completed with the relevant information set out in Annex I to this DTA; and

the optional illustrative indemnification Clause will not apply.

(ii) Where sub-clause (b)(i) above does not apply, but the Media Partner and Conversant are lawfully permitted to rely on the EU SCCs for transfers of personal data from the United Kingdom subject to completion of a UK Addendum to the EU Standard Contractual Clauses (UK Addendum) issued by the Information Commissioners Office under s.119A(1) of the Data Protection Act 2018, then:

1. The EU SCCs, completed as set out above in clause 2.1(a) of this DTA shall also apply to transfers of such Data, subject to sub-clause (2) below;
2. The UK Addendum shall be deemed executed between the transferring Media Partner and Conversant, and the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of such Data by Media Partner.

(iii) If neither sub-clause (b)(i) or sub-clause (b)(ii) applies, then Conversant and Media Partner shall cooperate in good faith to implement appropriate safeguards for transfers of such Data as required or permitted by the UK GDPR without undue delay.

Annex I

Data Processing Description

This Annex I forms part of the DTA and describes the Processing of the Data.

A. LIST OF PARTIES

Controller(s) / Data exporter(s):

Controller(s) / Data importer(s):

. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Annex II

Technical and Organisational
Security Measures

Description of the technical and organisational measures implemented by the data importer (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.