NEXXEN DATA PROCESSING ADDENDUM
FOR PUBLISHERS
Last Updated February 20 2026
This Nexxen Data Processing Addendum (For Publishers) (this “DPA”) supplements and is incorporated into the Publisher Advertising Services Agreement and any other applicable agreement (each, an “Agreement”, and collectively, the “Agreement”) between Nexxen and the Publisher named in the Agreement (“Publisher”).
This DPA describes the protection and security obligations of the Parties with respect to any Processing of Personal Data carried out in connection with the Services provided under the Agreement and is effective as of the effective date of the Agreement (“Effective Date”). Nexxen and Publisher are individually referred to herein as a “Party” and collectively as the “Parties.” The Categories of Personal Data and Data Subjects processed pursuant to this DPA are described in Annex I hereto, which forms part of this DPA.
1. Definitions
1.1.
Definitions. Capitalized terms not otherwise defined in this DPA shall have the meanings given to them in the Agreement, and, to the extent not defined therein, the meanings assigned under applicable Data Protection Laws.
“Affiliate”
means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity; “control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management of that entity, whether through ownership of voting securities or otherwise.
“Child Data”
means Personal Data of a Data Subject who is a “child,” “minor,” or otherwise under the applicable age threshold requiring parental consent or restricting Processing under applicable Data Protection Laws in the relevant jurisdiction (e.g., under 13 in the United States pursuant to the Children’s Online Privacy Protection Act; under 16, or such lower age as implemented by a Member State, under GDPR/UK GDPR; or any other age threshold established by applicable law), and the terms “Child” and “Children” shall be construed accordingly.
“Consent Framework”
means any industry-standard or legally recognized privacy framework, protocol, or mechanism used to transmit a Data Subject’s legally valid privacy choices, including Consent, opt-out, or other rights regarding the Processing of Personal Data. This includes, but is not limited to, the IAB Transparency and Consent Framework (TCF), the Global Privacy Platform (GPP), US Privacy Strings, Global Privacy Control (GPC), OpenRTB regulatory and privacy signaling mechanisms, required or recognized under applicable Data Protection Laws (including applicable U.S. Privacy Laws), as well as any successor or replacement framework required or recognized under applicable Data Protection Laws.
“Consent Signals”
means any standardized data string, flag, or digital signal transmitted through a recognized Consent Framework that reflects a Data Subject’s exercise of legally recognized privacy rights, such as granting or withdrawing Consent, opting out of Sale or Sharing, exercising other rights regarding the Processing of Personal Data, or indicating Child-directed status or age-related restrictions (including COPPA/Child-directed flags).
“Data Breach”
means “data breach,” “breach of the security of the system,” “personal data breach”, “security breach,” “breach of security,” or “breach of system security,” and other analogous terms referenced in applicable Data Protection Laws.
“Data Protection Law”
means, to the extent applicable in the relevant jurisdiction(s) all data protection and privacy laws applicable to the Processing, protection and privacy of Personal Data under the Agreement, including: (a) the European Data Protection Laws; (b) US Privacy Laws, including any US Privacy Law that draws a distinction between a data “Controller” and a data “Processor” or a “Business” and a “Service Provider” or similar terms; (c) the Australian Privacy Principles and the Australian Privacy Act (1988); (d) the Canadian Federal Personal Information Protection and Electronic Documents Act (“PIPEDA“) and any relevant substantially similar provincial law; and (e) all legally binding requirements issued by the competent data protection authorities: (i) governing the processing and security of information relating to individuals and providing rules for the protection of such individuals’ rights and freedoms with regard to the Processing of Personal Data relating to them; (ii) specifying rules for the protection of privacy in relation to data processing and electronic communications; or (iii) enacting rights for individuals which are enforceable towards organizations with respect to the Processing of their Personal Data, including rights of access, rectification and erasure.
“European Data Protection Law”
means all data protection and privacy laws and regulations or other legislation enacted in the Member States of the European Economic Area, the United Kingdom and Switzerland and applicable (in whole or in part) to the Processing of Personal Data such as (a) Regulation 2016/679 (“EU GDPR“); (b) the EU e-Privacy Directive (Directive 2002/58/EC); (c) any national data protection laws made under or pursuant to (a) or (b); (d) in respect of the United Kingdom, the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR“), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as continued in force), and any other laws in force in the UK applicable (in whole or in part) to the Processing of Personal Data (together, “UK Privacy Laws“); and (e) the Swiss Federal Act on Data Protection of 25 September 2020 and its corresponding ordinances (“FADP“).
“Excluded Data”
means (a) Special Categories of Personal Data; (b) Sensitive Personal Data; (c) Child Data; (d) Precise Geolocation Data; and (e) Directly Identifiable Personal Data, in each case including any data that directly reveals, is derived, or used to infer from the foregoing, unless expressly permitted under a separate written addendum executed by the Parties and in compliance with applicable Data Protection Laws.
“Nexxen”
means the Nexxen entity, including Nexxen Group LLC and/or any of its Affiliates, that executes and is a party to this DPA that is attached or referenced in the Agreement.
“SCCs”
means (a) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”); and (b) where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office pursuant to Section 119(A) of the UK Data Protection Act (“UK Addendum”).
“Services”
means the platform and/or other services (as described in the Agreement) including services, functions and responsibilities required for proper performance of the services made available by Nexxen and its Affiliates to Publisher.
“Subprocessor”
means any data processor (including any Nexxen Affiliate) appointed by Nexxen to Process Personal Data on behalf of Publisher set out in in the Subprocessor List (as defined in Section 5.5) as updated in accordance with Section 5.5.
“Tracking Technologies”
means any technology or method used to collect, monitor, analyze, or store information about user behavior, device identifiers, or browser activity over time and across Publisher Properties (as defined in the applicable Agreement). This includes, but is not limited to, cookies, web beacons, pixels, SDKs, fingerprinting scripts, tags, device identifiers, locally stored objects, and similar technologies, whether deployed by Nexxen, the Publisher, or by third parties acting on behalf of either Party.
“US Privacy Laws”
means all U.S federal and state privacy laws relating to the protection and Processing of Personal Information in effect in the United States of America, which may include, without limitation, (a) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., together with any amending or replacement legislation and/ or law, including the California Privacy Rights Act of 2020 (collectively, “CCPA”) and any regulations promulgated thereunder, (b) the Virginia Consumer Data Protection Act of 2021, Va. Code Ann. § 59.1-571 to -581, (c) the Colorado Privacy Act of 2021, Co. Rev. Stat. § 6-1-1301 et seq., (d) Connecticut Public Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Monitoring”, (e) the Utah Consumer Privacy Act of 2022, Utah Code Ann. § 13-61-101 et seq., and any other U.S federal and state privacy laws enacted.
“Business,” “Business Purpose,” “Commercial Purpose,” “Consent,” “Consumer,” “Controller,” “Cross Context Behavioral Advertising,” “Data Subject,” “Deidentified,” “De-identified Data,” “Directly Identifiable Personal Data,” “Independent Controller,” “Joint Controller,” “Personal Data,” “Personal Information,” “Precise Geolocation Data,” “Processing,” “Processor,” “Sale,” “Sell,” “Special Categories of Personal Data,” “Sensitive Personal Data,” “Service Provider,” “Share,” “Targeted Advertising” and “Third Party” shall have the meanings given to those terms (or analogous terms) in Data Protection Laws.
1.2.
Interpretation. References to any law, regulation, directive, statute, code, decision, or other legislative provision (each, a “Law”) in this DPA shall be deemed to include such Law as amended, extended, re-enacted, consolidated, superseded, or replaced from time to time, together with any legally binding implementing measures or binding decisions issued by a competent authority thereunder. Where a reference is made to a specific legal instrument, that reference includes any successor or equivalent legislation applicable in the relevant jurisdiction. Data Protection Laws shall be interpreted broadly to promote compliance with the most protective applicable standard, and where a term is defined differently under multiple Data Protection Laws, the most stringent or protective definition shall apply.
2. Authorizations
2.1.
Each Party represents and warrants that any disclosure or receipt of Personal Data under this DPA shall comply with applicable Data Protection Laws, including all required notices, authorizations, and/or consents from relevant public authorities or Data Subjects. Each Party is solely responsible for ensuring it has obtained all necessary rights and Consents for its own disclosure or receipt of such Personal Data from or to the other Party.
2.2.
The Parties shall not provide or make available Excluded Data to the other Party in connection with the Services, and if either Party becomes aware that Excluded Data has been provided, it shall promptly notify the other Party and delete such data as soon as practicable. Each Party further agrees that the other Party has no responsibility or liability for any Excluded Data provided to it in breach of this DPA, whether inadvertently or otherwise. Each Party shall be solely responsible for ensuring no Excluded Data is made available through its systems or integrations. To the extent any Excluded Data is transferred to the other Party in breach of this DPA, the transferring Party shall be solely liable for any resulting claims, losses, or regulatory consequences.
3. Cooperation Between the Parties
3.1.
Each Party shall:
3.1.1.
Cooperate in good faith to comply with Data Protection Laws and to enable the other Party to meet and perform its respective obligations under this DPA, including by: (a) maintaining appropriate documentation regarding its Processing activities, compliance with Data Protection Laws and with this DPA, and (b) appointing a data protection officer, where legally required, or otherwise designating a point of contact for data protection matters, and, upon request, providing such contact information.
3.1.2.
In the event of an investigation, proceeding, or formal request for information or documentation by or from a supervisory authority relating to the Processing of Personal Data under the Agreement, promptly and adequately deal with enquiries from the other Party to the extent such enquiries relate to the responding Party’s Processing of Personal Data under the Agreement, with each Party bearing its own costs unless otherwise agreed in writing.
3.1.3.
Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with the Processing of Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing, including, for the Publisher, in relation to the Publisher Properties, and to protect Personal Data against a Data Breach.
3.1.4.
If a Party is unable to meet its obligations under this DPA and/or applicable Data Protection Laws, it shall promptly notify the other Party. If the non-performing Party fails to cure such inability within thirty (30) days following notice, the other Party may terminate the Agreement; provided, however, that any failure involving Excluded Data or unlawful Processing shall constitute a material breach permitting immediate termination. Nexxen may also suspend the Services until such breach is cured. Any termination under this Section shall be without prejudice to any other rights or remedies available under the Agreement, this DPA, applicable Data Protection Laws, or applicable law, including any legally required notifications to supervisory authorities or affected Data Subjects.
3.2.
Publisher shall:
3.2.1.
Implement and maintain age-gating, age-screening, and/or other industry-standard, risk-based technical and organizational measures (which may include age estimation and, where applicable, verifiable parental consent mechanisms), as required under applicable Data Protection Laws and regulatory guidance, to prevent Child users from accessing Publisher Properties or ad inventory through which Personal Data is collected or otherwise made available to Nexxen, and to avoid the collection or Processing of Child Data without a valid lawful basis, including parental consent where required. Publisher is solely responsible for the design, implementation, and operation of such measures, and Nexxen shall have no obligation to implement, monitor, or verify them.
3.2.2.
Not collect, transmit, upload, or otherwise make available Child Data to Nexxen in connection with the Services. Except to the extent permitted under applicable law, Publisher shall not: (a) use Nexxen Materials to create profiles of Children; (b) facilitate behaviorally targeted advertising, profiling, or the sharing of identifiers relating to Children; or (c) collect, transmit, upload, or otherwise Process Child Data. If any Publisher Property, ad inventory, or traffic source is Child-directed, Child-focused, or otherwise subject to Children’s privacy restrictions under applicable law, Publisher shall promptly notify Nexxen in writing and, where applicable, implement and transmit all required technical signals (including the RTB “COPPA = 1” flag and any analogous child- or age-related flags or parameters required under applicable law or industry specifications) in accordance with applicable industry protocols (including applicable Consent Framework specifications). Nexxen shall rely on Publisher’s designation of whether any Publisher Property, ad inventory, or traffic source is child-directed and shall have no obligation to investigate or independently assess Publisher’s compliance with this Section. For purposes of this Section, “Nexxen Materials” means the Services and any proprietary or confidential technology, platforms, products, or materials provided by Nexxen, including Tracking Technologies, APIs, and related documentation.
3.2.3.
Ensure that: (a) it has obtained and will maintain all legally required consents, notices, and other lawful bases necessary to permit Nexxen’s Processing and use of any Personal Data made available to Nexxen in connection with the Services, including Processing by Nexxen acting as an Independent Controller, Joint Controller, or Processor (as applicable), and any onward transfers or disclosures of such Personal Data, in accordance with the Agreement and this DPA; (b) each Data Subject receives adequate disclosure regarding Publisher’s disclosure of such Personal Data to Nexxen and Nexxen’s Processing and use thereof, and that such disclosure contemplates and permits Nexxen to Process and use such Personal Data in accordance with Nexxen’s Privacy Policy available at: https://nexxen.com/services-privacy-policy/ and applicable Data Protection Laws; its consent mechanisms comply with applicable Consent Frameworks and maintain records of user choices as required by applicable Data Protection Laws. Upon request, Publisher shall provide Nexxen with an accurate visual representation of its consent mechanism (and how Nexxen is included therein), or a means of accessing such consent mechanism, for purposes of audit and diligence. Publisher shall pass all required Consent Signals to Nexxen in accordance with applicable law. Publisher acknowledges and agrees that Nexxen is entitled to rely on such Consent Signals as conclusive evidence of valid consent or other applicable lawful basis. Nexxen shall have no obligation to verify such signals, the age of any Data Subject or the child-directed status of any Publisher Property or ad inventory, except where explicitly required under applicable Data Protection Laws.
4. Obligations of the Parties when acting as Independent Controllers
4.1.
This Section 4 applies solely to Processing of Personal Data in connection with the Services under the applicable Agreement, where each Party, acting as an Independent Controller, determines the purposes and means of its own Processing activities and compliance with Data Protection Laws and, as between the Parties, each Party shall be solely responsible for such Processing and any breaches of Data Protection Laws relating thereto.
4.2.
Each Party shall:
4.2.1.
Comply with all requirements and principles under applicable Data Protection Laws in its capacity as a Controller (including, without limitation, purpose limitation, data minimization, accuracy, storage limitation, security, integrity and confidentiality, transparency, and Data Protection by Design and by Default), and not perform its obligations under this DPA in such a way as to cause the other Party (where such other Party is otherwise in compliance with Data Protection Laws) to breach any of its obligations under Data Protection Laws.
4.2.2.
Take all measures reasonably necessary to address any Data Breach relating to the Personal Data it Processes in connection with the Services, to the extent such Personal Data was shared or made available under this DPA, mitigate its effects, reasonably act to prevent a recurrence of such Data Breach, and promptly notify the other Party without undue delay after becoming aware of such Data Breach. Each Party shall provide only such information as is reasonably necessary and legally permitted to enable the other Party to respond to supervisory authorities and the affected Data Subjects as required under Data Protection Laws, subject always to any applicable confidentiality obligations, third-party rights, and legal privilege; provided, however, that the Party experiencing the Data Breach shall retain sole and primary responsibility for all required notifications, remedial measures, and regulatory cooperation.
4.2.3.
Cooperate, upon reasonable request, in the preparation of any required data protection impact assessments; solely to the extent applicable to and relating to the other Party’s independent Processing activities.
4.2.4.
Carry out any required assessment, consultation and/or notification to competent supervisory authorities or Data Subjects, in relation to the Processing it carries out.
4.2.5.
Handle any Data Subject’s requests or complaints it receives relating to its own Processing of Personal Data, including requests to exercise rights under applicable Data Protection Laws, (such as access, rectification, erasure, objection and withdrawal of Consent), and promptly inform the other Party if it receives a Data Subject request that relates to the other Party’s respective Processing activities. Neither Party shall be required to respond to any Data Subject request that pertains solely to the other Party’s Processing or controlled data.
4.2.6.
Prominently post and maintain a legally sufficient, publicly available, privacy policy/ privacy notice, that describes, in a legally sufficient manner, all categories of Personal Data Processed including the use of Tracking Technologies by third parties, and that provides, through such notice and elsewhere on Publisher Properties, all information required under applicable Data Protection Laws regarding the Processing of Personal Data, including legally sufficient mechanisms for Data Subjects to “opt out” of uses of their Personal Data as required by applicable Data Protection Laws (including the Sharing of their Personal Data or use of their Personal Data for Targeted Advertising) and to request “deletion” of their Personal Data. Any such opt-out mechanism shall include, where required by applicable Data Protection Laws, participation in or links to opt-out programs maintained by the Digital Advertising Alliance (DAA), the European Interactive Digital Advertising Alliance (EDAA), or any applicable equivalent or successor self-regulatory organization.
5. Obligations of Publisher and Nexxen when acting respectively, as Controller and Processor
5.1.
This Section 5 shall apply to Nexxen’s Processing of Personal Data in connection with the Services under the applicable Agreement, for which Publisher is acting as a Controller or Business (as applicable), and Nexxen is acting as a Processor or Service Provider (as applicable), as further described in Annex I, Part B “Controller-to-Processor Processing of Personal Data”.
5.2.
Publisher represents and warrants that:
5.2.1.
it will comply with its obligations as Controller under applicable Data Protection Laws in its Processing of Personal Data and any processing instructions it issues to Nexxen;
5.2.2.
(a) it has provided notice and obtained (or will obtain) and will maintain all permissions, Consents (including Consent Signals) and other lawful bases required under applicable Data Protection Laws; (b) such permissions, consents, and lawful bases permit Nexxen to Process and use, and permit onward transfers or disclosures of, any Personal Data collected through Tracking Technologies or other means deployed on Publisher Properties, or otherwise uploaded, shared, or made available to Nexxen, as necessary to provide the Services pursuant to the applicable Agreement (including this DPA); (c) all such Personal Data is collected and made available to Nexxen, whether by Publisher or by any third party on its behalf (“Controller Representative”), in compliance with Data Protection Laws and this DPA; (d) Publisher is responsible for all data, including Personal Data, and remains solely liable for any defects in such data or any lack of rights or authority to collect, Process, use, disclose, or otherwise make such data available; and (e) Publisher acknowledges that Nexxen is entitled to rely on, and pass through, valid Consent Signals received through any recognized Consent Framework and does not verify or validate the legal sufficiency of such Consent Signals;
5.2.3.
it follows industry standard and risk based technical and organizational measures for data minimization, data accuracy and transparency mechanisms, including when uploading data or enabling Nexxen’s collection via Tracking Technologies; and
5.2.4.
it shall ensure each Controller Representative complies with the relevant obligations contained in this Section 5, and for the purposes of this Section 5, each Controller Representative shall be deemed to be Publisher’s Processor. Publisher acknowledges that Nexxen is entitled to rely on Publisher’s compliance with this Section as conclusive evidence of lawful Processing and onward transfer of Personal Data under this Agreement.
5.3.
The details of the Processing of Personal Data by Nexxen in its capacity as a Processor are set out in Annex I, Part B to this DPA. Publisher shall notify Nexxen in writing of any changes to the Categories of Personal Data and, prior to making available new Categories of Personal Data, the Parties shall amend Annex I, Part B in writing. Without limiting Section 2.2 or Section 3.2, Publisher shall not, and shall ensure that no Controller Representative shall, upload, share, or otherwise make available to Nexxen any Excluded Data. Any breach of this Section 5.3 constitutes a material breach entitling Nexxen to terminate the Agreement and this DPA immediately on written notice.
5.4.
When Nexxen Processes Personal Data in its capacity as a Processor on behalf of the Publisher in its capacity as a Controller, Nexxen will:
5.4.1.
Process Personal Data (a) in compliance with applicable Data Protection Laws, and (b) only in accordance with Publisher’s documented instructions (as set forth in the Agreement, in this DPA, or as directed by Publisher or Publisher’s authorized users through the Services). Nexxen is not responsible for determining if Publisher’s Processing instructions are compliant with applicable law. However, Nexxen shall notify Publisher in writing if, in its reasonable opinion, Publisher’s Processing instructions infringe applicable Data Protection Laws, provided that Publisher acknowledges that Personal Data may be Processed on an automated basis in accordance with Publisher’s use of the Services, which Nexxen does not monitor.
5.4.2.
Not: (a) retain, use, or disclose Personal Data outside of the direct business relationship between itself and Publisher; (b) Sell or Share any Personal Data, or Process Personal Data for Cross Context Behavioral Advertising or Targeted Advertising; and (c) otherwise engage in any Processing of Personal Data that is prohibited or not permitted by Processors or Service Providers under Data Protection Laws.
5.4.3.
Comply with any applicable restrictions under Data Protection Laws on combining the Personal Data with Personal Data that Nexxen receives from, or on behalf of, another person or persons, or that Nexxen collects from any interaction between it and any Data Subject.
5.4.4.
Ensure that any employees or personnel it authorizes to Process the Personal Data are subject to an appropriate duty of confidentiality.
5.5.
Publisher provides a general authorization to Nexxen for the use of Subprocessors to Process Personal Data in accordance with this Section 5.5, including its Affiliates and those Subprocessors listed in Annex III to this DPA (“Subprocessor List”).
5.6.
Nexxen shall (a) enter into a written agreement with its Subprocessors, which includes data protection terms that ensure at least the same standard of protection as set forth in this DPA; and (b) remain fully liable to Publisher for any breach of the Agreement and this DPA that is caused by an act, error or omission of its Subprocessors to the extent that Nexxen would have been liable for such act, error or omission had it been caused by Nexxen.
5.7.
At least thirty (30) calendar days prior to the date on which any new Subprocessor shall commence Processing Personal Data, Nexxen shall update the Subprocessor List and provide Publisher with notice of that update.
5.8.
Publisher may object to Nexxen’s appointment of a new or replacement Subprocessor on reasonable grounds relating to data protection by notifying Nexxen in writing within thirty (30) calendar days after receiving notice pursuant to Section 5.7. In such an event, Nexxen and Publisher will discuss those objections in good faith with a view to achieving resolution. If the Parties are not able to achieve resolution, within thirty (30) calendar days from Nexxen’s written notification, Publisher, as its sole and exclusive remedy, may terminate the Agreement with respect to only those aspects which cannot be provided by Nexxen without the use of the new or replacement Subprocessor. Nexxen will provide Publisher with a pro rata reimbursement of any prepaid, but unused fees (if any) under the Agreement following the effective date of such termination.
5.9.
Publisher is responsible for responding to and complying with Data Subject requests (“DSR”). Nexxen shall, taking into account the nature of the processing, provide reasonable assistance, solely to the extent required under applicable law and only with respect to Personal Data Processed under this Section 5, to enable Publisher to respond to the DSR. If a Data Subject sends a DSR to Nexxen directly and where Publisher is identified or identifiable from the request, Nexxen will promptly forward such DSR to Publisher and Nexxen shall not, unless legally compelled to do so, respond directly to the Data Subject except to refer them to the Publisher to allow Publisher to respond as appropriate.
5.10.
Nexxen will provide reasonably requested information regarding the Services to Publisher for Publisher’s fulfillment of any legal obligation to (a) perform a data protection impact assessment related to the Processing of Personal Data; and/or (b) consult with supervisory authorities as required by applicable Data Protection Laws, provided that Publisher does not otherwise have access to the relevant information.
5.11.
Nexxen has implemented and will maintain appropriate technical and organizational measures appropriate to the nature and risks of the Personal Data to protect the Personal Data from a Data Breach and to preserve the security, integrity, and confidentiality of the Personal Data, which policies, practices and procedures shall comply with all applicable Data Protection Laws. At a minimum, such measures shall include the measures identified in Annex II (the “Security Measures“). Nexxen agrees to keep the Security Measures under review and update them where necessary so that they remain appropriate, provided that such updates and modifications do not result in the degradation of the overall security.
5.12.
In the event of a Data Breach, Nexxen shall notify Publisher within 72 hours, and will provide reasonable assistance to Publisher, upon request, in connection with any required notification requirements to supervisory authorities or Data Subjects (as applicable), taking into account the nature of the Processing, the information available to Nexxen, and any restrictions on disclosing the information (such as confidentiality). Publisher remains solely responsible for all notifications to authorities and Data Subjects.
5.13.
Where and only to the extent Nexxen acts as a Processor under this Section 5 and Publisher acts as a Controller under this DPA, Publisher shall have the right, upon written request, to receive documentation from Nexxen evidencing Nexxen’s compliance solely with its Processor obligations under this DPA. Nexxen shall make available to Publisher, and/or its appropriately qualified third-party representative (provided such representative is not a competitor of Nexxen and enters into a confidentiality agreement acceptable to Nexxen), access to reasonably requested documentation evidencing Nexxen’s compliance with its obligations under this DPA in the form of the relevant audits or certifications listed in the Security Measures. Such requests must be limited in scope, proportionate, and necessary to verify compliance. Such audits are performed (a) at least once annually; (b) according to ISO 27001 standards or such other alternative standards that are substantially equivalent to ISO 27001; and (c) by independent third party security professionals selected by Nexxen. Except in the circumstances of a Data Breach, Publisher’s audits pursuant to this Section 5.13 shall consist of a confidential audit report, including information regarding any independent, third-party audit of Nexxen’s or Subprocessors’ systems, processes, policies, practices and procedures (subject to any restrictions on disclosing the information (such as confidentiality)). Except in the circumstances of a Data Breach or such audit is required by a supervisory authority, Publisher’s audits pursuant to this Section 5.13 shall be limited to once per rolling twelve (12) month period. Nexxen’s obligation to report or respond to a Data Breach pursuant to this DPA is not and will not be construed as an acknowledgement by Nexxen of any fault or liability of Nexxen with respect to the Data Breach. For the avoidance of doubt, as part of any audit undertaken Nexxen will not be required to give Publisher access to Nexxen’s other clients’ data or systems or Confidential Information unrelated to the Services or this DPA.
5.14.
Except to the extent required otherwise by Data Protection Laws, Nexxen will destroy all Personal Data upon (a) written request of Publisher or (b) termination of the Agreement. Following the deletion or return mentioned above, some Personal Data may reside on Nexxen’s backup and logging systems. Nexxen shall not Process this Personal Data for any other purpose and shall ensure it is permanently deleted or irreversibly overwritten following its technological process.
6. EU, UK, and Swiss Cross-Border Data Transfers
6.1.
The Parties acknowledge that their activities under the Agreement may involve cross-border transfers of Personal Data. Each Party may only engage in cross-border Processing of Personal Data or onward cross-border transfers of Personal Data shared in connection with the Services only if it has implemented and maintains a valid data transfer mechanism under Data Protection Laws. Each Party shall remain solely responsible for ensuring that its transfers are lawful, including when transferring Personal Data to its own Processors, Affiliates, or third parties.
6.2.
To the extent required under applicable Data Protection Laws, the Parties agree that the EU SCCs, as defined in the SCCs, are incorporated by reference into and form part of this DPA and shall prevail in the event of any conflict, solely with respect to restricted transfers subject to the EU GDPR. For purposes of the EU SCCs: (a) Module 1 (Controller to Controller) applies where Nexxen acts as a Controller, and Module 2 (Controller to Processor) applies where Nexxen acts as a Processor; (b) Clause 7 (the optional docking clause) is included; (c) For Module 2: Clause 9, Option 2 (General Written Authorization) applies, with the authorized Subprocessor List set out in Annex III (available at https://nexxen.com/dpa-sub-processor/), and subject to thirty (30) days’ prior notice of changes; (d) Clause 11 (Redress) does not apply; (e) Under Clause 13 (Supervision) designates the Irish Data Protection Commission, unless not permitted, in which case the competent authority where the Data Subjects are located shall apply; (f) Under Clause 17 (Governing law), Option 1 (Ireland); (g) Under Clause 18 (Choice of forum and jurisdiction), Courts of Ireland; and (h) Annexes I and II of the EU SCCs are set out as Annex I and Annex II to this DPA, and Annex III (Subprocessors) is set out as referenced above, in each case for the applicable SCC Module.
6.3.
To the extent required under UK Privacy Laws, the Parties agree that the UK Addendum is incorporated by reference into and forms part of this DPA and shall apply solely to UK-restricted transfers. In the event of any conflict, the UK Addendum shall prevail with respect to such transfers. For purposes of the UK Addendum, the Tables are completed as follows: (a) Table 1 (Parties): the Parties’ details are as set forth in the Agreement and, where applicable, the EU SCCs; (b) Table 2 (Approved EU SCCs): the approved EU SCCs are the EU SCCs incorporated pursuant to Section 6.2; (c) Table 3 (Appendix Information): the Appendix Information is set out in Annexes I, II, and III to this DPA; and (d) Table 4 (Ending this Addendum): neither Party shall have the termination right set out in Section 19 of the UK Addendum.
6.4.
To the extent required under applicable Data Protection Laws, with respect to transfers of Personal Data subject to the FADP, the EU SCCs are incorporated by reference into and form part of this DPA and shall apply with the following mandatory adaptations required under Swiss law: (a) references to the EU GDPR in the EU SCCs shall be construed as references to the FADP, solely to the extent the transfer is subject exclusively to the FADP; (b) references to a “Member State” shall not be interpreted so as to prevent Swiss Data Subjects from exercising their rights or bringing claims in Switzerland, including before the courts of their habitual residence, in accordance with Clause 18(c) of the EU SCCs; and (c) for purposes of Annex II (Competent Supervisory Authority): (i) where the transfer is subject exclusively to the FADP, the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner (“FDPIC”); and (ii) where the transfer is subject to both the FADP and the EU GDPR, the FDPIC shall be the competent authority for matters governed by the FADP, and the supervisory authority identified in the EU SCCs shall apply for matters governed by the EU GDPR.
7. Processing subject to the US Privacy Laws
7.1.
The following definitions apply to this Section 7:
7.1.1.
“Advertising Purposes” means all Restricted Purposes in addition to (a) activities that constitute Targeted Advertising or Cross Context Behavioral Advertising under US Privacy Laws, including any processing that involves displaying ads to a Consumer selected using the Consumer’s cross context behavioral data, and (b) creating or supplementing user profiles for such purposes
7.1.2.
“Restricted Processing Signal” means any flag, indicator, or signal transmitted through a Consent Framework that indicates a Consumer’s opt-out choice specifically under US Privacy Laws, including but not limited to the Sale, Sharing, or Processing of Personal Data for Targeted Advertising, Cross Context Behavioral Advertising, or profiling purposes.
7.1.3.
“Restricted Purposes” means advertising-related Processing that qualifies as a Business Purpose under CCPA, which includes first-party advertising, contextual advertising, advertising or marketing services that do not include Cross Contextual Behavioral Advertising, Targeted Advertising, or profiling, internal research, frequency capping, measurement, auditing, security and integrity, debugging, fraud detection and prevention, and ensuring and measuring viewability, to the extent such Processing is permissible for a Service Provider under applicable US Privacy Laws and where required, is carried out in accordance with Consent Signals.
7.2.
Applicability. This Section 7 applies only when the receiving Party Processes Personal Data shared by the disclosing Party (a) that is subject to US Privacy Laws; and (b) where no Restricted Processing Signal is present. If a Restricted Processing Signal is present, the receiving Party will only Process Personal Data for Restricted Purposes and will not facilitate or engage in any Processing that is not for Restricted Purposes, including any Cross Context Behavioral Advertising, Targeted Advertising, profiling, or Sale, or Sharing of any Personal Data associated with such Restricted Processing Signal.
7.3.
Purpose Limitations. Disclosing Party makes Personal Data available to receiving Party only for Advertising Purposes. Receiving Party will Process Personal Data only for such Advertising Purposes as permitted under US Privacy Laws and subject to the Agreement. No additional uses or disclosures are authorized unless expressly permitted in writing by the disclosing Party.
7.4.
CCPA – Roles and Compliance Obligations. The Parties agree that for the purposes of the Services under the Publisher Advertising Services Agreement, Nexxen is a Third Party and Publisher is a Business. Receiving Party will comply with applicable obligations under CCPA, including providing legally required privacy protections, and will notify disclosing Party without undue delay if receiving Party determines it can no longer meet its obligations under CCPA.
7.5.
Verification of CCPA Compliance. Upon disclosing Party’s reasonable request, receiving Party will provide reasonable information to demonstrate Processing of Personal Data consistent with disclosing Party’s obligations under CCPA, such as an attestation or a copy of a relevant third-party security certification. Nexxen shall not be required to disclose confidential, proprietary, or non-relevant materials.
7.6.
Unauthorized Use Remediation. If disclosing Party reasonably believes that receiving Party is engaged in the unauthorized use of Personal Data provided by disclosing Party, disclosing Party may notify receiving Party of such belief using the contact information provided in the Agreement, and the Parties will work together in good faith to stop or remediate the allegedly unauthorized use of such Personal Data, as necessary. Notwithstanding anything to the contrary, the disclosing Party may take reasonable and appropriate steps to ensure that the receiving Party uses the Personal Data consistent with the disclosing Party’s obligations under CCPA.
7.7.
Onward Disclosure Obligations. To the extent permitted by the Advertising Purposes and the Agreement, if receiving Party makes an onward disclosure of Personal Data provided to it by disclosing Party, including through any Sale or Sharing of the Personal Data, receiving Party will impose terms substantially similar to those in this Section 7.
7.8.
U.S. DOJ Bulk Sensitive Data Rules
7.8.1.
Solely for purposes of this Section, the terms “access,” “country of concern,” and “covered person” shall have the meanings ascribed to such terms in 28 CFR Part 202 Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (“DOJ Bulk Sensitive Data Rules”).
7.8.2.
Each Party represents and warrants that it is not a covered person or controlled directly or indirectly by a covered person or located in a country of concern. Each Party will immediately notify the other Party if it foresees a change that would cause it to become such a covered person or country of concern.
7.8.3.
Without limitation to each Party’s other obligations in this DPA or Agreement, a Party shall not: (a) transfer any data that would be subject to the DOJ Bulk Sensitive Data Rule (“Data”) to, or otherwise enable access to Data by (1) a covered person or country of concern or (2) absent equivalent protections to this Section, any subcontractor, affiliate, or third party; or (b) engage in any activity or conduct that would result in a violation of the DOJ Bulk Sensitive Data Rules by the other Party. Each Party shall promptly report to the other Party any known or suspected violations of this Section.
7.8.4.
A Party may immediately suspend the other Party’s access to the Data or any portion thereof and terminate the Agreement (i) upon receipt of notice or report of the other Party’s known or suspected violation of this Section, or (ii) if a Party believes in good faith that the other Party has failed to comply with this Section and/or is using the Data in a manner that violates any applicable laws or regulations, or that would otherwise damage such Party’s customers, partners, business, or reputation.
8. Indemnity and Liability
8.1.
Indemnity. Publisher shall defend, indemnify, and hold harmless Nexxen, its Affiliates, and their respective officers, directors, employees, and agents against any losses, liabilities, claims, actions, proceedings, damages, fines, penalties, judgments, settlements, and any related costs or expenses (including, without limitation, reasonable costs, expenses, and legal fees incurred in investigating, preparing for, or defending against any regulatory inquiry, investigation, or enforcement action, claim, or litigation, whether commenced or threatened) to which Nexxen or the Parties may become subject, arising out of, relating to, or in connection with any breach of, failure to comply with, or omission of Section 2.2, Section 3.2 or Section 5.3 by Publisher, any Controller Representative, or any other third party acting on the Publisher’s behalf or for Publisher’s benefit. The indemnification provided in this Section 8.1 shall survive the termination or expiration of the Agreement.
8.2.
Limitation of Liability. The Parties agree that all liabilities between them under this DPA and the SCCs will be subject to the disclaimers, limitations and exclusions of liability and other terms of the Agreement, except that such disclaimers, limitations and exclusions of liability will not apply to a Party’s liability (a) under Section 8.1; (b) to Data Subjects under the third party beneficiary provisions of the SCCs, and (c) to the extent limitation of such liability is prohibited by (i) any applicable Data Protection Laws; or (ii) under the SCCs.
9. General Provisions
9.1.
Updates. If Nexxen updates this DPA to account for changes in Data Protection Law concerning privacy or data security, or changes in the legal landscape based on enforcement or guidance related to Data Protection law (“Updates”), provided Nexxen shall not materially reduce its obligations hereunder or materially impact Client’s obligations hereunder, the Parties agree such Updates to the DPA will apply to this DPA automatically as of the date such Updates are posted.
9.2.
Survival. The provisions of this DPA shall survive the termination or expiration of the Agreement for so long as Nexxen, its Processors, or Subprocessors continue to Process Personal Data.
9.3.
Change in Law. Notwithstanding anything to the contrary in the Agreement or this DPA, in the event of a change in Data Protection Laws or a determination or order from a supervisory authority or competent court affecting this DPA or a Party’s Processing of Personal Data pursuant to this DPA, the Parties shall, upon either Party’s request promptly amend this DPA as reasonably necessary to ensure continued compliance with Data Protection Laws or any regulatory or court decisions. Until such amendment is finalized, each Party may implement any interim measure necessary to ensure compliance.
9.4.
Governing Law and Jurisdiction. This DPA shall be governed by and construed in accordance with the governing law, jurisdiction, and venue provisions in the Agreement, unless otherwise required by applicable Data Protection Law.
9.5.
Order of Precedence. Unless stated otherwise, in case of a conflict between the provisions of A) this DPA and US Privacy Laws, or B) this DPA, the EU SCCs, the UK Addendum or the FADP, the provisions providing the most stringent protection to Personal Data and the rights of individuals shall govern. For the avoidance of doubt, any changes required under US Privacy laws, the EU SCCs, the UK Addendum or the FADP shall only apply to the Processing of Personal Data which is subject to the applicable Data Protection Laws. If the EU SCCs, the UK Addendum or the FADP are superseded by new or modified mechanism, the new or modified mechanism shall be deemed to be incorporated into this DPA, and the Parties will promptly comply with such mechanism. In the event of any conflict or discrepancy between the Data Protection Laws, the SCCs, this DPA, and the Agreement, the following order of precedence will apply: (1) Data Protection Laws; (2) the SCCs, where and to the extent applicable; (3) this DPA; and (4) the Agreement. Nothing in the Agreement shall be interpreted to limit or waive any mandatory rights or obligations imposed by applicable Data Protection Laws.
ANNEX I
The Parties are deemed to have signed Annex I of the SCCs by entering into the DPA. The data exporter’s and data importer’s address and contact person are set forth in the Agreement.
A. Controller-to-Controller Processing of Personal Data
The data exporter’s and data importer’s address and contact person are set forth in the Agreement.
| Data Exporter and Data Importer | Data Exporter: Either Party, when making a cross-border transfer covered by the Agreement that requires the SCCs to be implemented. Data Importer: Either Party, when receiving a cross-border transfer covered by the Agreement that requires the SCCs to be implemented. |
| Categories of Data Subjects Whose Personal Data is Processed |
|
| Categories of Personal Data Processed | Identifiers and technical data, including:
|
| Nature and Purpose of Transfer and further Processing | Nexxen providing and Publisher receiving the Services:
|
| Retention of Transferred Personal Data | Personal Data will be retained by each Party in accordance with its respective data retention policies. |
| Transfers to Sub-Processors | Not applicable. |
| Sensitive or Special Category Data | None. |
| Frequency of the Transfer | Continuous for the Term of the Agreement. |
B. Controller-to-Processor Processing of Personal Data
| Data Exporter and Data Importer | Each Party can be a data exporter or data importer respectively. Each Party may in this setup be a Controller or Processor respectively. |
| Categories of Data Subjects Whose Personal Data is Processed | Data Subjects whose Personal Data is Processed by a Party on behalf of the other Party in connection with the Services set out in the Agreement and this DPA. |
| Categories of Personal Data Processed | Identifiers and pseudonymous data made available by the Data Exporter, including:
Contact and Identity customer data, such as hashed emails. |
| Nature and Purpose of Transfer and further Processing | Facilitating curated programmatic advertising deals across Nexxen supply inventory, including
|
| Retention of Transferred Personal Data | Personal Data will be retained by each Party in accordance with the Party’s data retention policies. |
| Transfers to Sub-Processors | See Annex III. |
| Sensitive or Special Category Data | None. |
| Frequency of the Transfer | Continuous for the Term of the Agreement. |
ANNEX II - Security Schedule
This security schedule (the “Schedule”) represents security controls to be complied with when either Party acts as a data importer of Personal Data. Data importer shall implement the following information security practices and procedures, as to Personal Data it receives as a data importer:
- Security Governance: Data importer will maintain an information security management program aligned with ISO 27001 or comparable industry standards, including documented policies, procedures, and controls designed to protect Personal Data throughout the service lifecycle.
- Security Assessments: Security assessment rights, audit procedures, scope, frequency, and any related obligations shall be governed exclusively by the Agreement, which is incorporated herein by reference, and shall apply only to the extent Nexxen acts as a Processor under the DPA.
- Third Party and Personnel Security: Data importer will maintain appropriate security assurance controls to manage data security risks for third party services to ensure the protection of Personal Data. Data importer will maintain appropriate security and privacy awareness programs to proactively protect Personal Data.
- Physical, Device and Network Security: Data importer will maintain appropriate physical, environmental, device, and network security controls designed to protect Personal Data against unauthorized access, loss, or disclosure, including access controls, monitoring, and industry-standard endpoint and network protections.
- Access Control: Data importer will apply access controls based on the principle of least privilege, including authentication controls, logging, and periodic access reviews, with enhanced protections for privileged access.
- Business Continuity and Availability:Data importer will maintain a business continuity and disaster recovery program, including periodic testing, designed to support service availability and recovery from operational disruptions. Upon reasonable written request, data importer will respond to questions regarding the effectiveness of such controls.
- Application and Vulnerability Security: Data importer will maintain secure software development, change management, and vulnerability management practices consistent with industry standards, including vulnerability identification and remediation.
- Encryption Data importer will use appropriate encryption or equivalent safeguards to protect Personal Data in transit and during approved external transfers.
- Data Breach: Data Breach notification, cooperation, mitigation, and responsibility shall be governed exclusively by the Agreement, which is incorporated herein by reference.