SUPPLY & MEDIA POLICY

Effective Date: 19 November, 2023

Introduction

For the purposes of this Adorphic Supply & Media Policy (the “Supply Policy”), the term “site,” as used herein, means a website or a mobile or CTV app or any other digital property.

Adorphic uses commercially reasonable efforts to provide participating buyers and sellers with a safe, transparent, and fair marketplace. Your use of Adorphic’s Technology is governed by your contract with Adorphic, which requires compliance with this Supply Policy as it may be updated by Adorphic from time to time. The obligations set forth herein are the minimum standards for publishers (“you”) wishing to participate in the Adorphic Technology.

Adorphic may update this Supply Policy at any time by posting notice of such changes on its website or by otherwise providing notice. By using the Adorphic Technology following such posting or notice, you agree to any updated version of this Supply Policy.

With respect to ensuring compliance with the foregoing, please note that Adorphic reserves the right to suspend or remove sites from Adorphic if it reasonably suspects or determines, in its sole discretion, that any of the Supply Policies have been violated.

Content Guidelines

Minimum content requirements

In order to be a part of the Adorphic Technology, sites must contain substantive, original content, and demonstrate signs of user engagement.

Adorphic does not work with sites that:

• Contain content of little to no value to the user (e.g., boilerplate text, text from Wikipedia, stale news stories, etc.).
• Feature mainly links or content taken from other sites without meaningful commentary or curation.
• Have little content other than ads.
• Have little to no evidence of an engaged user base.
• Appear designed primarily to display ads.
• Are parked or undeveloped domains.

Banned categories

In addition to the foregoing requirements, sites whose core function is to incentivise users to view ads, sites that are proxy sites, and sites featuring the following may not participate in Adorphic Technology:

• Pornographic or highly suggestive content or images.
• Sales of weapons or ammunition.
• P2P file-sharing, torrent, or anything that facilitates or promotes copyright infringement.
• Extreme violence.
• Hate content, including sites that advocate violence or discrimination against a specific race, religion, gender, sexual orientation, or nationality, or discrimination based on age, disability, or medical condition.
• A pattern of false or misleading information or news.
• Excessive profanity.
• Promotion of illegal drugs or drug paraphernalia.
• Promotion of black-hat hacking, cracking, or warez.
• Any other content that is illegal, promotes illicit or harmful activity, or infringes on the rights of others, including sites that provide “how-to” information on bomb-making, lock-picking, and similar topics.
• Defamatory or libelous content.
• Distribution of viruses and/or malware.
• Pay per click or pay per search programs.
• Video chat and unmoderated live streaming.
• Significant unmoderated UGC (user-generated content).

Restricted Categories

Please notify your Account Manager if your site contains any of the following content or collects from end users information about any of the following categories, as special restrictions or limitations may apply:

• Adult humor.
• Online gambling (including, in some jurisdictions, fantasy sports and/or daily fantasy sports).
• Medical or health-related information, advice, or services.
• Sexual health or history (including sexuality or dating history).
• Significant user-generated content, adequately and proactively moderated.
• Sale of alcohol.
• Sale of tobacco.
• Sale of prescription drugs.

Better Ads Standards

In order to be a part of the Adorphic Technology, sites must be in compliance with the Better Ads Standards developed by the Coalition for Better Ads. For more information, see www.betterads.org.

Slideshows

A slideshow is a series of images or other content where the user may advance by selecting a forward icon, page number, or other similar link. The below guidelines apply to all web pages where slideshows are a prominent page feature (hereafter called “slideshow pages”). All of the following requirements apply for slideshow pages:

• Each slideshow page may contain a maximum of three ads.
• All ads must be positioned at or above the lowest part of the slideshow. For mobile implementations, a single ad may also appear immediately below the slideshow content.
• Slideshow pages that automatically advance without a user click may not load new ads.
• The content of each slide must differ materially from the previous slide’s content. For example, minor changes to the slide’s text or image do not constitute a material change and are not sufficient to load new ads.
• Auto-refresh is not permitted on slideshow pages.

Implementation Guidelines

Basic guidelines

• The publisher site may not initiate a download or change settings without the user’s knowledge and consent.
• App installations may not trigger additional app installs (i.e., bundling) without explicit disclosure and user consent.
• The publisher may not mask or cloak the site’s URL, or employ any means to obscure the true source of traffic.
• The publisher may not artificially inflate impressions, clicks, or requests, or source traffic from pop-ups, pop-unders, forced redirects, or similar means.
• The publisher site may not install or distribute malware, viruses, or other similar malicious code.
• The publisher may not include or launch fake error messages or system flags.
• A substantial portion of the publisher’s site must be accessible without a login or without requiring a user to provide an email address or other type of verification.
• The publisher must not employ any means to induce, encourage or trick the user (i) into clicking on an ad or (ii) granting consent to the placement of cookies on their browser or personal data collection. Placing arrows or text such as “Click here” next to an ad is strictly prohibited.
• Publisher sites deemed unsafe by reputable third-party malware-detection services may be suspended without further notice, at Adorphic’s sole discretion, from the Adorphic Technology until all user safety issues are addressed to the satisfaction of Adorphic.
• Publisher sites must clearly and conspicuously post a privacy policy that complies with all applicable law and, if required by applicable law, a cookie policy.
• The publisher’s inventory specifications and criteria provided to the Adorphic Technology must be true and accurate.
• The publisher must comply with all industry group guidelines/principles that the publisher claims to abide by (as well as any guidelines/principles that are required by the industry groups of which the publisher is a member or in which the publisher participates).
• The publisher must collect, obtain, disclose, and use data in compliance with its posted privacy policy and all applicable laws (including all applicable privacy laws), including by acquiring all necessary and required permissions to collect, use, transfer, and otherwise process data using cookies or other identifiers.
• The publisher must comply with any applicable Digital Advertising Alliance Self-Regulatory Principles, including provisions related to obtaining consent for the collection, use, and transfer of precise geolocation data, and with the IAB Europe OBA Framework if applicable.
• The publisher must further reasonably support Adorphic in efforts to ensure its and its demand side partners’ compliance with each of the foregoing principles and frameworks, as applicable.

Ad number and position

• The publisher must not edit or modify ads in any way, including but not limited to, by resising the ads.
• Ads must be clearly separated from other page content. It must always be clear to the user what is an ad and what is site content.
• Ads may not be obscured or altered in any way. For ads shown in iframes, the iframe must allow the entire creative to be fully visible to the user.
• Ads may not appear in pop-up or pop-under windows.
• Ads may not appear in the body of emails.
• Ads must appear within standard web pages or mobile apps. Ads may not appear in other downloadable applications.
• For mobile apps, ads may not appear outside of the publisher’s app (e.g., on the user’s lockscreen).
• Apps must be hosted on one of these official app stores: Apple iTunes store, Google Play Store, Amazon App Store, or Microsoft App Store.
• The page may not contain an excessive number or density of ads. For most pages, no more than 3-4 ads are appropriate.

Ad Refresh

Publishers may load new ads only when:

• The user navigates to a new page or screen.
• The current page is substantially updated with new content AND at least 1 minute has passed since the last refresh.
• The ad unit has remained in view for at least 30 seconds, as measured by an MRC-accredited verification company.

In no event may a publisher refresh an ad unit more than 20 times per user session.

Audience

• The publisher must acquire traffic primarily from organic sources and shall use best efforts to ensure that none of the traffic is fraudulent.

Site Ownership

• Inventory from applications, including browser plug-ins and toolbars, that insert advertisements into the body of third-party web pages or other online properties without the website’s permission, is not acceptable.

Video

• Video ads may not serve within display banner ad units.
• Suppliers of video inventory are required to ensure no more than one video plays on a page at a time.
• VAST video content should maintain a reasonable balance between content and advertising (e.g., a 30-second ad should not accompany a video with only 15 seconds of content).

Compliance with Laws and Data Privacy

General Compliance

You will comply, and ensure all your sites comply, with all applicable laws and regulations related to your use of the Adorphic Technology. This includes, but is not limited to, privacy and data protection laws such as:

• EU General Data Protection Regulation (GDPR).
• U.S. federal and state privacy legislation, including:some text
  • The Children’s Online Privacy Protection Act (COPPA).
  • The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
  • U.S. state privacy laws in California, Colorado, Connecticut, Florida, Montana, Oregon, Texas, Virginia, Utah, or other applicable state privacy laws.

You must have a privacy notice that clearly discloses any data collection, sharing, and usage that occurs as a result of your use of the Adorphic Technology. This notice must inform consumers that third parties, including Adorphic, may place and read cookies or use similar technologies to collect information to facilitate ad serving on your website.

Restrictions on Personal Data Transfer

You must not transfer or provide the following personal data to Adorphic or make use of it within the Adorphic Technology unless explicitly approved:

• Full name.
• Direct contact information (address, telephone number, or email address, excluding device identifiers).
• Social security number, driver’s license number, other state or government identification numbers, biometric data, or account or payment card numbers.
• Sensitive or special categories of personal data (as defined in applicable privacy laws and regulations).

Data Related to Minors

You must not transfer personal data of a child under 13 to Adorphic unless you have been approved as part of the Child-Safe Marketplace. Similarly, you must not transfer personal data of minors under 18 unless you include an appropriate Year of Birth or relevant IAB OpenRTB flag in the ad request to comply with restrictions on data collection from minors.

Compliance with Advertising Self-Regulatory Principles

You must comply with the:

• United States Digital Advertising Alliance Self-Regulatory Principles (DAA) published at www.aboutads.info.
• Corresponding DAA-designated frameworks established in other countries or regions.
• Enhanced notice obligations for First Parties as defined in the DAA Self-Regulatory Principles.

You agree that Adorphic may:

• Receive and store personal data made available by you.
• Transmit information (including personal data) to third parties.
• Take administrative actions to make your inventory available to potential buyers.
• Create segments for ad targeting purposes.
• Provide reports through our user interface.
• Facilitate accounting, collections, and disbursements of payments.
• Take other actions to fulfil the Services outlined in our agreement with you.

GDPR Compliance

You shall comply with the IAB Standard Terms and Conditions for Internet Advertising, including:

• IAB European Transparency & Consent Framework Policies (TCF).
• IAB’s Global Privacy Platform (GPP).

Where necessary, you must obtain and pass through valid, specific, and informed consent for the processing of personal data by Adorphic and its partners, as required by the TCF. This consent must include Adorphic as a data processor for the purposes it is registered under TCF.

Both you and Adorphic are controllers of personal data processed within the Adorphic Technology:

• Adorphic is responsible for the processing of personal data once it has been passed to Adorphic and its sharing within the Adorphic Technology.
• You are responsible for providing valid notice and consent to share data with Adorphic and ensuring the accuracy of the information passed.

U.S. State Law Compliance

Under U.S. State Privacy Laws, you are classified as a "controller" or "business," and Adorphic is a "controller" or "third-party business" regarding the personal data you provide.

Adorphic as Processor

If Adorphic has agreed to act as your "processor" or "service provider" for certain personal data under a written contract, the Adorphic Data Processor Terms will apply to such data. In this case, the U.S. State Law Compliance section of this Supply Policy will not apply to that personal data. All other sections of this Supply Policy remain in force.

Opt-Out Requirements

You must provide consumers with:

• Notice of Adorphic’s processing activities, including cross-context behavioural and targeted advertising.
• The ability to opt out of such processing activities, including via industry-standard global privacy controls where required.

When a consumer opts out, you must pass an industry-standard Opt-Out Signal (endorsed by the IAB via the OpenRTB specification) to Adorphic. Upon receipt, Adorphic will:

• Restrict its processing activities to avoid cross-context behavioural or targeted advertising.
• Pass the Opt-Out Signal to demand-side partners to enforce similar restrictions.
• Cease selling personal data received from you.

Data Sharing Between Sender and Recipient

Whenever you or Adorphic (the "Sender") shares personal data subject to U.S. State Privacy Laws with the other (the "Recipient"), the Recipient agrees to:

• Use the personal data only for the purposes specified in this Supply Policy and any written agreement with the Sender.
• Comply with U.S. State Privacy Laws, including Opt-Out Signals.
• Allow the Sender to take reasonable steps to ensure compliance with the Sender’s obligations under U.S. State Privacy Laws.
• Notify the Sender if the Recipient determines that it can no longer meet its obligations.
• Grant the Sender the right to take reasonable steps to stop unauthorised use of the personal data.

Policy Precedence

If there is any conflict between this Supply Policy and other agreements between Adorphic and you, the Supply Policy will prevail.