Version 1.0 — Effective 19 October 2026This Data Processing Addendum (this "Addendum") forms part of the Aptivada Service and License Agreement (the "Agreement") between Aptivada, LLC, doing business as Audience ("Audience"), and the customer that is party to that Agreement ("Customer"). It is incorporated into the Agreement by reference and takes effect on the effective date of the Agreement. No separate signature is required. Except as otherwise set forth herein, capitalized terms used herein without definition shall have the respective meanings given to them in the Agreement.
A counter-signable version of this Addendum is available on request from legal@audience.io.This Addendum replaces and supersedes the Addendum to Service and License Agreement relating to the California Consumer Privacy Act dated on or about December 9, 2019, if any, between the parties.
1. Definitions
1.1. "Applicable Privacy Law" means all privacy, data protection and data security laws applicable to a party's processing of Personal Information under the Agreement, including the CCPA and, where applicable, the GDPR.
1.2. "CCPA" means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 to 1798.199.100), and any related regulations.
1.3. "Contracted Business Purposes" means the services described in Appendix A for which Audience receives or accesses Personal Information.
1.4. "GDPR" means Regulation (EU) 2016/679 and, where applicable, that Regulation as incorporated into the law of the United Kingdom.
1.5. "Personal Information" means personal information, personal data, or any equivalent term as defined under Applicable Privacy Law, that Audience processes on Customer's behalf under the Agreement.
1.6. "Security Incident" means a breach of Audience's security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Information.
1.7. "Subprocessor" means a third party engaged by Audience to process Personal Information in connection with the Contracted Business Purposes.
1.8. Terms defined in Applicable Privacy Law, including controller, processor, service provider, business, data subjectand consumer, carry the same meaning in this Addendum.
2. Roles of the Parties
2.1. Customer is the controller, or business, of the Personal Information. Audience is the processor, or service provider, and processes Personal Information solely on Customer's behalf.
2.2. Customer determines what Personal Information is collected through each experience it configures, the purposes for which it is collected, and how it is used. Audience provides the platform.
2.3. Where Customer is itself acting as a processor for a third-party controller, Customer warrants that it has the authority of that controller to engage Audience and to give the instructions described in this Addendum.
3. Audience's Obligations
3.1. Documented instructions. Audience will process Personal Information only on Customer's documented instructions. The Agreement, this Addendum, and Customer's configuration and use of the platform constitute those instructions. Audience will inform Customer if it believes an instruction infringes Applicable Privacy Law.
3.2. Purpose limitation.Audience will only collect, use, retain, or disclose Personal Information for the Contracted Business Purposes. Audience will not sell or share Personal Information, will not use it for cross-context behavioral advertising, and will not combine it with Personal Information received from any other source except as permitted by Applicable Privacy Law.
3.3. Service analytics. As provided in the Agreement, Audience may analyze information relating to the provision, use and performance of the Services, and may use and disclose that information in aggregated or de-identified form for service improvement, diagnostics and benchmarking. Audience will not disclose Personal Information in identifiable form for these purposes, and will not re-identify or attempt to re-identify aggregated or de-identified data.
3.4. Proportionality. Audience will limit the collection, use, retention and disclosure of Personal Information to what is reasonably necessary and proportionate to achieve the Contracted Business Purposes.
3.5. Confidentiality. Audience will ensure that personnel authorized to process Personal Information are subject to binding obligations of confidentiality, and will restrict access to those personnel who require it to provide the Contracted Business Purposes.
3.6. Security.Audience will implement and maintain appropriate technical and organizational measures to protect Personal Information, as described in Appendix B. Audience will not materially reduce the overall level of protection those measures provide during the term.
3.7. No re-identification.Audience will contractually prohibit Subprocessors from attempting to re-identify any aggregated, de-identified or anonymized data.
3.8. Notices to individuals.Where the Contracted Business Purposes require Audience to present a privacy notice to individuals on Customer's behalf, Audience will present the notice Customer approves in writing, and will not alter it without Customer's prior written consent.
3.9. Legally required disclosure.If a law requires Audience to disclose Personal Information for a purpose unrelated to the Contracted Business Purposes, Audience will first inform Customer and give Customer an opportunity to object or challenge, unless the law prohibits such notice.
4. Subprocessors
4.1. Authorization.Customer authorizes Audience to engage the Subprocessors listed in Appendix C. Customer further generally authorizes Audience to engage additional Subprocessors in accordance with this Section.
4.2. Notice and objection.Audience will notify Customer at least thirty (30) days before a new Subprocessor begins processing Personal Information. Customer may object on reasonable data protection grounds within that period, in which case the parties will discuss in good faith; if the matter is not resolved, Customer may terminate the affected services.
4.3. Subprocessor obligations.Audience will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those in this Addendum, and remains responsible for each Subprocessor's performance.
4.4. List on request.Upon Customer's written request, Audience will provide an up-to-date list of Subprocessors, including each Subprocessor's name, location, the services provided, and the categories of Personal Information disclosed to it.
5. Data Subject and Consumer Requests
5.1. Customer administrators can search, export, correct and permanently delete an individual's records directly in the platform. Audience also makes available application programming interfaces by which those actions can be performed, which Customer may integrate with its own privacy request tooling.
5.2. Audience will promptly comply with any Customer request or instruction to provide, amend, transfer, restrict, or delete Personal Information, or to stop, mitigate or remedy any unauthorized processing.
5.3. If Audience receives a request directly from an individual relating to Customer's Personal Information, Audience will not respond substantively, and will forward the request to Customer without undue delay and in any event within ten (10) business days.
5.4. Audience will provide reasonable assistance to Customer in responding to verifiable requests, taking into account the nature of the processing and the information available to Audience.
6. Security Incidents
6.1. Audience will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer's Personal Information, and will take appropriate steps to contain and remediate it.
6.2. Audience's notification will describe, to the extent known at the time, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed. Where the full picture is not available, Audience will provide an initial notification and supplement it as information becomes available.
6.3. Customer is responsible for determining whether the incident requires notification to individuals or to any regulatory authority, and for making any such notification. Audience will provide reasonable cooperation and information to support that determination.
6.4. Audience's notification of an incident is not an acknowledgement of fault or liability.
7. Retention, Return and Deletion
7.1. Audience retains Personal Information for the duration of the Agreement so that Customer can access entry history, consent records and audience profiles. Customer may delete individual records or entire experiences at any time.
7.2. Customer may export its Personal Information from the platform in standard formats at any time during the term, and for a period of thirty (30) days following termination or expiry as provided in the Agreement.
7.3. Upon Customer's written request, or in any event within ninety (90) days following termination or expiry of the Agreement, Audience will delete Customer's Personal Information from production systems. Encrypted backups are purged on their normal rotation cycle thereafter.
7.4. Audience will not retain, anonymize or aggregate Customer's Personal Information for its own use following termination, except where retention is required by law.
8. Audits and Information
8.1. Audience maintains a SOC 2 Type II attestation covering the platform, refreshed annually by an independent auditor.
8.2. Upon Customer's written request, and subject to confidentiality obligations, Audience will make available its then-current SOC 2 report, penetration test summary, security program documentation and policies, which Customer may use to verify Audience's compliance with this Addendum.
8.3. Where Applicable Privacy Law requires Customer to be able to audit Audience directly, Customer may do so no more than once in any twelve (12) month period, on reasonable prior written notice, during business hours, subject to confidentiality obligations, and at Customer's expense, provided that Customer will first consider whether the documentation described in Section 8.2 is sufficient.
9. International Transfers
9.1. Audience processes Personal Information in the United States. Audience's hosting infrastructure is located in United States regions.
9.2. Where the GDPR applies to Customer's Personal Information and that Personal Information is transferred outside the European Economic Area or the United Kingdom, the parties agree that the applicable Standard Contractual Clauses approved by the European Commission, and the United Kingdom Addendum where relevant, are incorporated into this Addendum by reference and apply to that transfer. Audience acts as the data importer and Customer as the data exporter.
10. Warranties
10.1. Each party will comply with its obligations under Applicable Privacy Law in connection with the processing of Personal Information.
10.2. Audience warrants that it has no reason to believe that any requirement of Applicable Privacy Law prevents it from performing under this Addendum, and will promptly notify Customer of any change in Applicable Privacy Law that may adversely affect its performance.
10.3. Customer warrants that it has provided all notices and obtained all consents required under Applicable Privacy Law for Audience to process Personal Information as contemplated by the Agreement.
11. General
11.1. This Addendum forms part of the Agreement. In the event of a conflict between this Addendum and the Agreement with respect to the processing of Personal Information, this Addendum controls. For the avoidance of doubt, Section 7.3 of this Addendum establishes an obligation to delete Personal Information following termination, and supersedes any provision of the Agreement under which deletion is discretionary.
11.2. This Addendum continues for the duration of the Agreement and for so long thereafter as Audience retains any Personal Information.
11.3. Audience may update Appendix B and Appendix C from time to time to reflect current practice, provided that no update materially reduces the protections afforded to Personal Information.
APPENDIX A
PROCESSING PURPOSES AND DETAILS
Contracted Business Purposes:Provision and operation of digital audience experiences, including contests, sweepstakes, quizzes, polls, surveys, forms, voting and scan campaigns; collection of entries and opt-in selections; winner selection and prize fulfillment support; delivery of opt-in data to destinations Customer configures; fraud and abuse prevention; and reporting and analytics within Customer's account.
Nature of processing:Collection, storage, organization, retrieval, use, disclosure to Customer and to destinations Customer configures, and erasure.
Duration:The term of the Agreement, and the retention period described in Section 7.
Categories of data subjects:Members of the public who participate in experiences published by Customer, and Customer personnel who administer the platform.
Categories of Personal Information, as classified under Cal. Civ. Code § 1798.140:
Only the fields Customer chooses to collect on a given experience are captured. Customer controls, at the experience level and at the account level, whether optional fields including date of birth, mailing address, location and media upload are presented.
APPENDIX B
SECURITY MEASURES
Audience maintains an information security program covering the platform, assessed annually under SOC 2 Type II. Measures include:• Hosting in United States regions across multiple availability zones, with network isolation, firewalls, a web application firewall, and no public administrative access• Encryption in transit and encryption at rest for databases, storage and backups• Role-based access control on the principle of least privilege, unique accounts, and multi-factor authentication on staff accounts• Logical segregation of each customer's data in a dedicated account• Centralized logging and monitoring, with alerting on infrastructure, databases and message queues, and malware detection• Daily database backups, a documented and tested Disaster Recovery Plan, and a Business Continuity Plan• Vulnerability management, security patching, code review, and a documented software development lifecycle• Independent third-party penetration testing• Background checks, confidentiality agreements, security awareness training, an Acceptable Use Policy and a Code of Conduct for personnel• A documented Incident Response Plan, tested annually, including notification to affected customers
APPENDIX C
APPROVED SUBPROCESSORS
A current list is maintained on the Audience Trust Center and is available on request.This Appendix lists Subprocessors that process Personal Information submitted through Customer's campaigns. Vendors that process only Audience's own business records, including information about Customer's personnel who hold platform accounts, are not Subprocessors for the purposes of this Addendum; Audience is the controller for that information and it is addressed in the Audience privacy policy.Software that Audience licenses and operates on its own infrastructure is not a Subprocessor, because the vendor does not receive Personal Information.Where Customer connects its own destination systems, including a customer relationship management platform, email service provider, or customer data platform, Audience transmits data to those systems at Customer's direction using credentials supplied by Customer. Those providers are Customer's own processors, not Audience Subprocessors, and Customer remains responsible for them.