This Data Protection Addendum (“DPA”) is integrated directly into and forms an essential part of the Master Services Agreement or programmatic trade terms (“Agreement”) executed between Adorphic Group (including Adorphic Ltd and its global subsidiaries) and the participating Demand-Side Platform, agency, or marketing partner (“Demand Partner”).
This DPA governs the cross-platform processing, utilization, and transmission of pseudonymized end-user personal data encountered during real-time bidding (RTB) auction sequences, impression delivery tracking, and performance analysis through the Adorphic programmatic ad exchange infrastructure.
Both Adorphic and Demand Partner contractually represent, warrant, and covenant that they shall remain in absolute individual compliance with all applicable Data Protection Laws. This includes, but is not limited to, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and United States state-level privacy statues (such as the CCPA/CPRA) as they apply to the respective datasets handled in the advertising auction chain.
For the operational purposes of executing real-time bidding campaigns under European and UK frameworks, the parties explicitly acknowledge and agree that Adorphic and Demand Partner act as separate, independent Data Controllers regarding the personal data processed. Neither party acts as a joint controller or as a data processor on behalf of the other. Each party determines its own independent business means and processing purposes for handling the auction parameters, bidding history logs, and profile attributes.
To ensure compliance with user choice across the OpenRTB bidding environment, the parties establish the following mandatory enforcement layers:
Demand Partner must ingest, decode, and strictly respect the Transparency and Consent String (TC String) transmitted via Adorphic's bid requests in accordance with the rules of the IAB Europe Transparency & Consent Framework (TCF v2.2). Demand Partner shall not execute tracking cookies or build behavioral interest categories if the user consent signal indicates an explicit refusal or opt-out.
Demand Partner will process all outbound bid metadata in strict compliance with the CCPA/CPRA rules. If an item contains an explicit 'Do Not Sell or Share' indicator, or if Global Privacy Control (GPC) opt-out headers are registered, Demand Partner must treat that data as restricted and cease cross-context behavioral marketing or sharing profiles downstream.
Demand Partner is contractually required to implement and continuously maintain rigorous administrative, technical, and physical safety barriers designed to safeguard programmatic data vectors from unauthorized exposure, alteration, or unlawful extraction.
In the event that Demand Partner identifies an active data security vulnerability or unexpected third-party compromise that exposes auction log elements or tracking metrics containing UK/EEA or US consumer pseudonymized signals, Demand Partner must notify Adorphic's compliance monitoring division via privacy@adorphic.com within 48 hours of detection.
Demand Partner agrees to process personal data transmitted via the Adorphic marketplace strictly to evaluate, submit, optimize, and fulfill bid placement requests. Demand Partner is explicitly prohibited from extracting, harvesting, or repurposing Adorphic bid stream components to reconstruct permanent profile graphs, re-identify real-world identities, or maintain target tables longer than thirteen (13) months from initial transmission.
To the extent that personal data originating from the UK or EEA is transferred out of its native boundary zone to Demand Partner infrastructure situated in non-adequate third countries (e.g., specific regional cloud storage arrays lacking local adequacy ratings), the parties hereby execute and integrate the standard contractual clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) as an irrevocable part of this document.
This Data Protection Addendum and any associated data-handling claims shall be governed, construed, and interpreted in absolute alignment with the laws of England and Wales. The parties unconditionally submit to the exclusive jurisdiction of the courts of London, United Kingdom for the ultimate resolution of any structural privacy or operational DPA disputes.