Data Processing Addendum

This Data Processing Addendum (the “DPA”), is entered into by and between JWP, Inc. dba JWX or any other entity specified in the applicable order form and its Affiliates (“JWX”) and the customer on the applicable order form (“Customer”) (each individually a “Party” and collectively the “Parties”). This DPA governs all agreements between the Parties, including but not limited to, the applicable Order Form and the JWX Terms and Conditions (collectively, the “Agreement”). This DPA shall be effective as of the Effective Date of the Agreement.

In consideration of the mutual agreements contained in the Agreement, and other good and valuable consideration the receipt and sufficiency of which are acknowledged, the parties agree as follows:

 

1.    Definitions.

In addition to capitalized terms defined elsewhere in this DPA, the following terms shall have the meanings ascribed to them herein. All capitalized terms not defined herein shall have the meanings set forth in the Agreement.

1.1.    “adequacy decision,” “data importer,” “data exporter,” “process,” “processing,” “Restricted Transfers,” “sub-processor,” and “supervisory authority” shall each have the meaning ascribed to it under Data Protection Law.

1.2.    “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.

1.3.    “Business” and “Controller” shall have the meanings ascribed to it under Data Protection Law and shall be used interchangeably herein.

1.4.    “Consumer” and “Data Subject” shall have the meanings ascribed to it under Data Protection Law and shall be used interchangeably herein.

1.5.    “Covered Data” means the Personal Data provided by one Party to the other Party in conjunction with the Agreement and for the purposes described in the Agreement.

1.6.    “Data Privacy Framework” or “DPF” means the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework, and the UK Extension to the EU-US Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce, as may be amended, superseded, or replaced from time to time.

1.7.    “Data Privacy Framework Principles” or “DPF Principles” means the Data Privacy Framework Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time.

1.8.    “Data Protection Law” means all applicable laws and regulations applicable, including, as applicable, laws and regulations of the European Union (“EU”), the European Economic Area (“EEA”) and their member states, Switzerland and the United Kingdom (“UK”), including without limitation, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”) and EU Directive 2002/58/EC on Privacy and Electronic Communications (“e-Privacy Directive”) or, the superseding e-Privacy Regulation once effective, and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), and as applicable, the laws and regulations of the United States, including without limitation, the Children’s Online Privacy Protection Act (“COPPA”), the Video Privacy Protection Act (“VPPA”), the California Invasion of Privacy Act (“CIPA”), the Illinois Biometric Information Privacy Act (“BIPA”), Texas’ Capture or Use of Biometric Identifier Act (“CUBI”), and all state-specific laws including the California Consumer Privacy Act of 2018 and its amendments including the California Privacy Rights Act (collectively, the “CCPA”), the Virginia’s Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Oregon Consumer Privacy Act (“OCPA”), the Texas Data Privacy and Security Act (“TXDPSA”), the Florida Digital Bill of Rights (“FDBR”), the Montana Consumer Data Privacy Act (“MTCDPA”), the Iowa Consumer Data Protection Act (“IADPA”), the Delaware Personal Data Privacy Act (“DEPDPA”), the Nebraska Data Privacy Act (“NEDPA”), the New Hampshire Privacy Act (“NHPA”), the New Jersey Data Privacy Act (“NJDPA”), the Tennessee Information Privacy Act (“TIPA”), the Minnesota Consumer Data Privacy Act (“MNCDPA”), the Maryland Online Data Privacy Act (“MDODPA”), the Indiana Consumer Data Protection Act (“INCDPA”), the Kentucky Consumer Data Protection Act (“KYCDPA”), the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”), the Oklahoma Consumer Data Privacy Act (“OCDPA”), the Louisiana Data Privacy Act (“LDPA”), the Alabama Personal Data Protection Act (“APDPA”), and the Vermont Data Privacy and Online Surveillance Act (“VDPOSA”).

1.9.    “Data Subject Request” means any right afforded to a Data Subject under Data Protection Law, including, but not limited to, the rights of access, correction, deletion, portability, and to opt-out of certain processing activities such as cross-context behavioral or targeted advertising.

1.10.    “Member States” means a member of the EU.

1.11.    “Personal Data” and “Personal Information” shall have the meanings ascribed to it under Data Protection Law and shall be used interchangeably herein.

1.12.    “Sensitive Data” means online account access credentials; a first name or initial and last name; a Social Security number; a driver's license number or other state or government identification number; medical or health insurance information; geolocation data, contents of a consumer's mail, email, and text messages, personal biometric data used to identity an individual; an account number, debit card number, or credit card number in combination with any required security code, access code, or password that would permit access to or use of such account or card; Protected Health Information (as defined by HIPAA); children’s personal data (as defined under Data Protection Law) or special categories of personal data, as referenced in Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR); or otherwise defined under Data Protection Law.

1.13.    “Services” means the Services as defined in the Agreement.

1.14.    “Signal(s)” means the technical privacy signals developed by industry standards or self-regulatory guidelines, including without limitation, the IAB Transparency and Consent Framework (the “IAB TCF Framework”), the IAB Global Privacy Platform (the “GPP”), DAA Ad Choices, COPPA Flag, and any other signal(s) whether now known or hereafter created that transmit or otherwise indicate an action by a Data Subject with respect to their Personal Data processing.

 

2.    Independent Controllers.

The Parties acknowledge and agree that with regard to the Covered Data, each Party is an independent Controller. Under CCPA, each Party shall be designated as an independent Business. Each Party shall individually determine the purposes and means of its processing of Covered Data. 

 

3.    Compliance.

3.1.    Each Party shall comply with Data Protection Law in connection with the Agreement. If either Party becomes aware that processing Covered Data for the purposes described in the Agreement infringes Data Protection Law, such Party shall promptly inform the other. Notwithstanding the foregoing, neither Party shall be under any obligation to actively monitor the other Party's compliance with Data Protection Law. Each Party shall promptly inform the other if it is unable to comply with this DPA or Data Protection Law in connection with the Agreement. If the non-complying Party cannot comply within a reasonable period of time, or is in substantial or persistent breach of this DPA, the complying Party shall be entitled to remediate the non-compliant action and/or terminate the DPA and the Agreement insofar as it concerns processing of Covered Data.

3.2.    The Parties shall enable Data Subjects to exercise their rights under Data Protection Law (such as providing access, deletion, and opt-out rights) and respond to such requests within the timeframe as determined by Data Protection Law; and

3.3.    The Parties shall comply with applicable self-regulatory standards and guidelines, including without limitation, standards and guidelines from the Interactive Advertising Bureau (“IAB”) and the Digital Advertising Alliance (“DAA”) and its international counterparts or similar industry self-regulatory standards, guidelines, or principles, as amended or superseded from time to time (“Industry Guidelines”). 

 

4.    Customer Obligations.

4.1.    Customer shall:

4.1.1.    Obtain any and all required consents from Visitors (as defined in the Agreement) as required under Data Protection Law to allow JWX to lawfully process the Personal Data in accordance with the Agreement and this DPA;
4.1.2.    Implement legally sufficient notice required under Data Protection Law and Industry Guidelines on its Sites (as defined in the Agreement), including: (a) its Privacy Policies and (b) a conspicuous link to a functional opt-out pages/tools as required by Data Protection Law and Industry Guidelines, such as opt-out pages/tools provided by the DAA and European Interactive Digital Advertising Alliance; and
4.1.3.    Send appropriate  Signals to allow JWX to ensure a Data Subject’s request to consent, opt-out and other Data Subject requests are honored in compliance with Data Protection Law.

4.2.    Customer shall not share, disclose, pass, or transfer, or otherwise make available to JWX any Sensitive Data.

4.3.    Customer shall not use the Services for the purpose of processing biometric data to identify an individual. 

 

5.    Security.

The Parties shall implement and maintain appropriate technical and organizational measures in order to protect the Covered Data from: (i) accidental or unlawful destruction; and (ii) loss, alteration, unauthorized disclosure of, or access to, the Covered Data (a “Security Incident”). Each Party shall ensure that any person it authorizes to process the Covered Data (an “Authorized Person”) is bound by an appropriate obligation of confidentiality (whether statutory or contractual). 

6.    Security Incidents.

If either Party becomes aware of a confirmed Security Incident related to Covered Data, that Party shall inform the other Party without undue delay and shall provide reasonable information and cooperation to fulfill any data breach reporting obligations it may have under (and in accordance with the timescales required by) Data Protection Law. Further, the Party reporting the Security Incident shall, at its own cost and expense, take such reasonably necessary measures and actions to remedy or mitigate the effects of the Security Incident and shall keep the other Party informed of all material developments in connection with the Security Incident.

 

7.    Cross Border Transfers. 

7.1.    DPF. If the Services involves the transfer of Personal Data of Data Subjects in the EEA or the UK, to a country or territory outside of those regions which has not received an applicable adequacy decision, the Parties agree that the DPF applies with respect to Restricted Transfers of Covered Data to the US from the EEA, UK, and/or Switzerland as JWX is certified under the DPF program.

7.2.    SCCs. The parties agree that where the DPF does not apply with respect to a Restricted Transfer, the Standard Contractual Clauses set out by the European Commission Decision 2021/914/EU and approved for use in data transfers under the UK GDPR, located at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en#ntc12-L_2021199EN.01003701-E0012 (the “SCCs”) will apply. The Parties represent that they do not believe the laws and practices in any country to which Personal Data is transferred for purposes of the Agreement will prevent the importing Party from fulfilling its obligations under this DPA or the SCCs. By entering into this DPA, the Parties are deemed to have signed the EU SCCs incorporated herein, including their Annexes.

7.3.    Ex-EEA Transfers. Where the Parties enter into the SCCs, including but not limited to where there is a transfer outside of the EEA (or UK as applicable) not governed by an adequacy decision, the SCCs shall be completed as follows:

7.3.1.    Module 1 shall apply;
7.3.2.    The optional docking clause in Clause 7 does not apply;
7.3.3.    All square brackets in Clause 13 are hereby incorporated as applicable;
7.3.4.    In Clause 17, the EU SCCs will be governed by the laws of Ireland;
7.3.5.    In Clause 18(b), disputes will be resolved before the courts of Ireland;
7.3.6.    Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I(a)(b), and (c) attached hereto; and
7.3.7.    Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II attached hereto.

7.4.    Ex-UK Transfers. Where the Parties enter into the SCCs, including but not limited to where there is a transfer outside of the UK not governed by an adequacy decision, the SCCs will apply in accordance with Section 7.3 as well as the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for International Data Transfers issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022 and as amended or replaced thereafter (the “IDTA”). The IDTA will be incorporated by reference and apply as follows:

7.4.1.    Table 1 of the IDTA will be deemed completed with the information set out in the Agreement. 
7.4.2.    Table 2 of the IDTA will be deemed completed with the information set out in section 8.1 above. Any conflict between the terms of the SCCs and the IDTA will be resolved in accordance with Section 10 and Section 11 of the IDTA. 
7.4.3.    Table 4 will be deemed completed by selecting “either party.”

 

8.    Indemnification.

8.1.    Indemnification. Each party will indemnify, defend and hold harmless the other party and such party’s parents, subsidiaries, affiliates, assigns, licensees, subcontractors, service providers and each of their respective entities’ officers, directors, members, employees, representatives and agents from and against any and all third-party claims, damages, liabilities, demands, and causes of action, and any expenses associated therewith arising out of or resulting from: (i) breach of any of the obligations, representations, or warranties set forth in this DPA; and (ii) any claim that the indemnifying Party is in violation of applicable law, including Data Protection Law.

8.2.    Indemnification Procedure. The procedure for indemnification pursuant to Section 8.1 above shall be governed by the terms set forth in the third section of Section 15 (Indemnification Procedure) of the Terms and Conditions.  

 

9.    Limitation of Liability.

EACH PARTY’S LIABILITY SHALL BE GOVERNED BY THE TERMS SET FORTH IN SECTION 14 (LIMITATION OF LIABILITY) OF THE TERMS AND CONDITIONS.

 

10.    Government Requests.

Unless legally prohibited, each Party shall promptly inform the other Party if it receives a request or demand from a governmental or regulatory body relating to the processing of Covered Data and shall fully cooperate with the other Party in connection with any response to such request or demand.

 

11.    General Terms.

11.1.    Termination and Survival. This DPA and all provisions herein shall so long as the Agreement is in effect.

11.2.    Counterparts. This DPA may be executed in any number of counterparts and any Party (including any duly authorized representative of a Party) may enter into this DPA by executing a counterpart.

11.3.    Ineffective Clause. If individual provisions of this DPA are or become ineffective, the effectiveness of the remaining provisions shall not be affected. The Parties shall replace the ineffective clause with a legally allowed clause, which will accomplish the intended commercial intention as closely as possible.

11.4.    Conflicts. In case of contradictions between this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail.

11.5.    Applicable Law and Jurisdiction. The applicable law and jurisdiction as set forth in the Agreement apply to this DPA.

 

ANNEX I

 

A.   LIST OF PARTIES

Data exporter(s):

Name: As provided in the Agreement

Address: As provided in the Agreement

Contact person’s name, position and contact details: As provided in the Agreement

Activities relevant to the data transferred under these Clauses: Use of the Services

Signature and date: As provided in the Agreement

Role: Controller 

        
Data importer(s):

Name: As provided in the Agreement

Address: As provided in the Agreement

Contact person’s name, position and contact details: As provided in the Agreement

Activities relevant to the data transferred under these Clauses: Providing the Services

Signature and date: As provided in the Agreement

Role: Controller

 

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose Personal Data is transferred
Visitors of the Customer Sites (as defined in the Agreement)

Categories of Personal Data transferred
Identifiers such as: IP address, device identifiers such as MAIDs, CTV IDs, other pseudonymous identifiers, cookie ID, device metadata, user agent, non-precise geolocation, session-related info (timestamp, page URL, language, engagement, other session insights), user score, browser 'fingerprint' (web browser, operating system, screen resolution, and other settings)

Associated metadata such as: URL, page insights, media insights, ad completion, video completion, device type, timestamp, session ID, ad insights, device type, operating system, video click, ad click

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Continuous basis
 
Nature of the processing
JWX will collect, process, store and disclose Covered Data as required to provide the Services (as detailed in the Agreement) to Customer.
 
Purpose(s) of the data transfer and further processing
JWX will process Covered Data for the purposes of providing the Services (as detailed in the Agreement) to Customer.
 
The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period
For the duration of the agreement and for up to 1 year thereafter, or longer as needed for record-keeping, legal obligation, etc.

 

C.   COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority of Ireland. 

 

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

1.    Information Security Policies and Standard

1.1.    JWX’s security measures shall include, at a minimum, measures designed to:

1.1.1.    Prevent unauthorized persons from gaining access to Personal Data Processing systems (physical access control);
1.1.2.    Prevent Personal Data Processing systems being used without authorization (logical access control);
1.1.3.    Ensure that persons entitled to use a Personal Data Processing system gain access only to such Personal Data as they are entitled to access in accordance with their access rights and that, in the course of Processing or use and after storage, Personal Data cannot be read, copied, modified or deleted without authorization (data access control);
1.1.4.    Ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage, and that the target entities for any transfer of Personal Data by means of data transmission facilities can be established and verified (data transfer control);
1.1.5.    Ensure that Personal Data is Processed solely in accordance with the Client’s instructions (control of instructions);
1.1.6.    Ensure that Personal Data is protected against accidental destruction or loss (availability control); and
1.1.7.    Ensure that Personal Data collected for different purposes can be processed separately (separation control).

1.2.    The aforementioned measures are kept up to date, and revised whenever relevant changes are made to the information system that uses or houses personal data, or to how that system is organized.

1.3.    Security policies and standards include:

1.3.1.    Data breach investigation;
1.3.2.    System access control;
1.3.3.    User privilege control;
1.3.4.    Software development and change control;
1.3.5.    Personal Data security;
1.3.6.    Business continuity planning;
1.3.7.    Electronic communication security;
1.3.8.    System administrative security; and
1.3.9.    Access to computer facilities.

 

2.    Physical Security

2.1.    JWX will maintain adequate security systems at all JWX sites at which an information system that uses or houses use Personal Data is located.

2.2.    JWX reasonably restricts access to such personal data appropriately, including through the use of restricted building access, and key card access.

 

3.    Organizational Security

3.1.    When media are to be disposed of or reused, procedures have been implemented to prevent any subsequent retrieval of any use of Personal Data stored on them before they are withdrawn from the inventory, including through destruction of storage devices or deletion of data.

3.2.    When media are to leave the premises at which the files are located as a result of maintenance operations, procedures have been implemented to prevent undue retrieval of personal data stored on them, including through the use of authentication controls and limited access to personal data.

3.3.    All personal data security incidents are managed in accordance with appropriate incident response procedures.

 

4.    Network Security

4.1.    JWX maintains network security using commercially available equipment and techniques, including firewalls, intrusion detection and/or prevention systems, and access control lists.

 

5.    Access Control

5.1.    Only authorized staff can grant, modify or revoke access to an information system that uses or houses Personal Data.

5.2.    User administration procedures define user roles and their privileges, how access is granted, changed and terminated; addresses appropriate segregation of duties; and defines the logging/monitoring requirements and mechanisms.

5.3.    Access rights are implemented adhering to the “least privilege” approach.

5.4.    JWX implements commercially reasonable physical and electronic security to create and protect passwords, including through the use of commercially available password manager services and user password salting and encryption.

 

6.    Personnel

6.1.    JWX implements a security awareness program to train personnel about their security obligations. This program includes training about data classification obligations; physical security controls; security practices and security incident reporting.

 

7.    Business Continuity

7.1.    JWX implements appropriate disaster recovery and business resumption plans, including through the use of regular data backups, security logs and designated personnel.

 

Last Revised: October 2026