This Data Protection Addendum (“Supply DPA”) is integrated directly into and forms an essential part of the Adorphic Master Data Protection Terms, the Supply & Media Eligibility Policy, and any Master Services Agreement or programmatic supply terms (collectively, the “Agreement”) executed between Adorphic Group (including Adorphic Ltd and its global subsidiaries) and the participating publisher, application developer, media owner, or inventory aggregation network (“Supply Partner”).
This Supply DPA governs the collection, processing, and transmission of pseudonymized end-user personal data that originates from the Supply Partner’s Digital Properties and is passed into the Adorphic programmatic infrastructure during real-time bidding (RTB) auction sequences, impression delivery, and measurement. Where this Supply DPA and the Master Data Protection Terms address the same subject, this Supply DPA governs for supply-side integrations.
Both Adorphic and the Supply Partner contractually represent, warrant, and covenant that they shall remain in individual compliance with all applicable Data Protection Laws. This includes, but is not limited to, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and United States state-level privacy statutes (such as the CCPA as amended by the CPRA), as they apply to the respective datasets each party handles within the advertising supply chain.
For the operational purposes of transacting real-time bidding under European and UK frameworks, the parties explicitly acknowledge and agree that Adorphic and the Supply Partner act as separate, independent Data Controllers in respect of the personal data each processes. Neither party acts as a joint controller or as a data processor on behalf of the other. Each party independently determines its own business means and processing purposes for the auction parameters, impression records, and identifiers it handles.
As the party holding the direct relationship with the end-user, the Supply Partner carries primary responsibility for lawful data collection at the point of origin. The Supply Partner shall not transmit any personal data to Adorphic unless the requirements of this section are satisfied.
The Supply Partner shall maintain a clear, accurate, and accessible privacy notice on every Digital Property from which programmatic requests originate. That notice must disclose the collection and onward sharing of personal data for programmatic advertising, the categories of data involved, the categories of recipients (including Adorphic and downstream demand partners), and the rights available to end-users. The Supply Partner shall establish and be able to evidence a valid legal basis for processing and for transmission to Adorphic before any request is sent.
For Digital Properties that serve users in the United Kingdom or the European Economic Area, the Supply Partner shall deploy an IAB-registered Consent Management Platform (CMP) and operate within the IAB Europe Transparency & Consent Framework (TCF v2.2). The Supply Partner shall capture end-user choices, generate a valid Transparency and Consent String (TC String), and transmit that TC String, unaltered, within each OpenRTB bid request sent to Adorphic. Adorphic may drop or refuse to process requests that lack a valid consent signal where one is required.
For traffic originating in the United States, the Supply Partner shall implement and honor applicable US state privacy signals, including where relevant the IAB Global Privacy Platform (GPP) string and the frameworks of the IAB Multi-State Privacy Agreement, and shall register and respect Global Privacy Control (GPC) and “Do Not Sell or Share” opt-out preferences. The Supply Partner shall transmit the corresponding signal with each request, and where an opt-out is present, shall not transmit personal data for cross-context behavioral advertising.
Every request the Supply Partner sends to Adorphic must reflect authentic, authorized inventory and a transparent, verifiable supply chain.
Ads.txt and App-Ads.txt: The Supply Partner shall maintain accurate, IAB-compliant /ads.txt and /app-ads.txt files on all authorized properties, correctly declaring Adorphic’s account with the appropriate DIRECT or RESELLER designation.
Supply Chain Object: The Supply Partner shall include complete and un-manipulated OpenRTB SupplyChain (“schain”) objects that represent every intermediary node handling data or monetary flow from the publication source to Adorphic.
Sellers.json: The Supply Partner acknowledges that Adorphic publishes seller records in accordance with the OpenRTB SupplyChain specification, and shall provide accurate business information to support that transparency.
Authorized Inventory Only: The Supply Partner shall not transmit data from any property or inventory that it does not own or that it is not exclusively and verifiably authorized to represent.
The Supply Partner shall implement and continuously maintain rigorous administrative, technical, and physical safeguards designed to protect personal data shared with, or received from, Adorphic against unauthorized access, disclosure, alteration, or unlawful extraction. In the event that the Supply Partner identifies a data security vulnerability or third-party compromise affecting such data, the Supply Partner shall notify Adorphic’s compliance monitoring division at privacy@adorphic.com within 48 hours of detection, and shall cooperate in good faith on containment and any required notifications.
Personal data transmitted between the parties shall be processed strictly to solicit bids for, deliver, and measure advertising served on the Supply Partner’s inventory. The Supply Partner is expressly prohibited from enriching, re-identifying, or repurposing Adorphic bid-stream or demand-side data to construct persistent identity graphs or to re-identify real-world individuals. The Supply Partner shall not retain such data for longer than is necessary for reconciliation, billing, and reporting, and in any event no longer than thirteen (13) months from the date of transmission.
Each party is responsible for responding to end-user rights requests (including access, deletion, and opt-out) in respect of the personal data it controls. Because the Supply Partner holds the direct relationship with the end-user, it shall serve as the first point of contact for its users, shall relay or coordinate any request that requires action by Adorphic, and the parties shall cooperate in good faith and within the timeframes required by applicable Data Protection Laws.
To the extent that personal data originating from the United Kingdom or the EEA is transferred to infrastructure situated in a third country that lacks an adequacy determination, the parties hereby incorporate and execute the standard contractual clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), as applicable, as an integral and irrevocable part of this Supply DPA.
Adorphic may verify the Supply Partner’s compliance with this Supply DPA through reasonable audits, automated technical checks, and verified third-party assessments. Confirmed non-compliance, unlawful data collection, or breach of the consent and transparency obligations set out above may result in the suspension or termination of traffic in accordance with the Supply & Media Eligibility Policy, and, where fraud or unlawful collection is identified, the withholding of associated marketplace disbursements.
This Supply DPA and any associated data-handling claims shall be governed, construed, and interpreted in accordance with the laws of England and Wales. The parties unconditionally submit to the exclusive jurisdiction of the courts of London, United Kingdom for the resolution of any dispute arising out of or in connection with this Supply DPA.