Appendix 2 Data Protection to Publisher Agreement
Version 2019 August 19
1. Definitions and Interpretations
1.1. For the purposes of this Joint Data Cooperation Agreement, capitalized terms shall have the following meanings, unless defined elsewhere hereto or in the Agreement:
“Business Day” shall mean any day except any Saturday, Sunday or a public holiday in the respective countries of incorporation of the Parties to this Joint Data Cooperation Agreement;
“Competent Data Protection Authority” shall mean a competent data protection authority which, by way of example, could be the Austrian Data Protection Authority [die österreichische Datenschutzbehörde];
“Data Protection Legislation” shall mean all applicable data protection legislation, including the GDPR, any national data protection legislation, and any regulations, mandatory guidelines or any other mandatory codes of practice issued by any Competent Data Protection Authority, each as amended from time to time;
“GDPR” shall mean Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as amended from time to time;
“Shared Personal Data” has the meaning given to it in clause 3.1 of this Joint Data Cooperation Agreement.
1.2. For the purposes of this Joint Data Cooperation Agreement, the terms “controller”, “joint controllers”, “processor”, “data subject”, “personal data”, “process”, “processing”, “data breach” and “profiling” shall have the meanings attributed to them in the GDPR.
2. Purpose of the Joint Data Cooperation Agreement
2.1. The purpose of this Joint Data Cooperation Agreement is to determine the roles and responsibilities of each Party in respect of the processing of Shared Personal Data during the provision of the Services under the Agreement in order to ensure the Parties’ compliance with the applicable Data Protection Legislation.
2.2. The Parties acknowledge that they shall be considered joint data controllers regarding the Shared Personal Data. Accordingly, the Parties have entered into this Joint Data Cooperation Agreement in order to meet the requirements of GDPR in respect of joint controllers.
3. Shared Personal Data
3.1. The Parties shall have joint controllership over some or all of the following types of information, which may be considered to be personal data under the Data Protection Legislation, in the course of their business relationship:
a. IP address of the device
b. Device type (unique device identifiers), operating system, browser type, screen resolution
c. Cookie ID and other online identifiers, tracking cookies, other cookies
d. Date and time of access of Publisher digital properties (if applicable)
e. Pages visited – before, on and after the end user lands on Publisher digital properties and Services (if applicable)
f. Language used to display the Publisher digital properties and Services (if applicable)
g. Information on the time of day and how often the Publisher’s end user has been using the Content Products
h. Geographic data (including country, region, postal code and/or GPS data)
i. Referring URL and domain
j. Gender, Demographics (if applicable)
k. Mouse events (movements, location, and clicks)
l. Other Impression Data which may be considered to be personal data
(collectively, the “Shared Personal Data”).
3.2. The data subjects whose Shared Personal Data is processed shall be the end users of the Publisher.
3.3. The processing of Shared Personal Data shall consist of and is further described in Exhibit 1 to this Appendix:
a. Publisher granting access through the placement of codes, tags, pixels and/or other similar technologies on Publisher digital properties and/or transferring to Sportradar Shared Personal Data for advertising purposes, analytics and for improvement of the end users’ online experience;
b. Sportradar processing (including profiling) Shared Personal Data for advertising purposes including targeted programmatic advertising and associated analytics and fraud detection and prevention and for improvement of the end-user’s online experience; for avoidance of doubt, the processing of the Shared Personal Data by Sportradar may also include monitoring the behavior of the end users of the Publisher and segmenting them into different groups with respect to their online behavior.
3.4. The Parties may not process Shared Personal Data in a way that is incompatible with the purposes under this Joint Data Cooperation Agreement in relation to the Agreement as set out above.
4. Term
4.1. This Joint Data Cooperation Agreement shall run conterminously with the Agreement.
4.2. Upon termination of the Agreement for any reason the Parties shall proceed in accordance with clause 5.10 of this Joint Data Cooperation Agreement.
5. Obligations of the Parties
5.1 Information Duty
5.1.1. Publisher shall provide the data subjects with information regarding the collection and processing of the Shared Personal Data, including the existence of profiling and the consequences of such profiling, in accordance with the applicable Data Protection Legislation.
5.1.2. Publisher shall have a valid lawful basis as required by and in accordance with the Data Protection Legislation in order to process Shared Personal Data.
5.1.3. Publisher shall obtain any unambiguous consent of the data subjects as required by and in accordance with the Data Protection Legislation before granting access and/or transferring to Sportradar any Shared Personal Data. In particular, Publisher shall invite the data subjects to consent to receiving marketing messages via specific channels (e.g. by ticking an ‘opt-in’ box confirming that they wish to receive marketing messages), including by Sportradar as a third party acting as a controller of the Shared Personal Data. Publisher shall provide effective procedures allowing the data subjects at any time to ‘opt-out’ from having their personal data used for the purposes of receiving targeted advertising. Publisher shall keep records to demonstrate what the data subjects have consented to, including what they were told, and when and how they consented, and provide copies of such records to Sportradar upon request.
5.1.4. Publisher shall not rely on legitimate interest as a lawful basis for processing Shared Personal Data unless the Parties to the Agreement explicitly agree otherwise in writing.
5.1.5. The Parties to the Agreement shall agree on an appropriate mechanism for transferring consent signals that inform Sportradar when a data subjects has consented to receiving targeted advertising or legitimate interest signals, including by Publisher integrating with the IAB Europe Transparency and Consent Framework or in other standardized way, prior to commencement of the Agreement.
5.1.6. Publisher shall ensure that its privacy statements and any other form of communication relating to the collection and processing of the Shared Personal Data are clear and provide sufficient information to the data subjects in order for them to understand what of their personal data is collected and shared, the circumstances in which it will be shared and the purposes for the data sharing. In particular, Publisher shall include an explicit reference to Sportradar as an entity with whom their personal data is shared in its privacy statements as described in Exhibit 2 to this Joint Data Cooperation Agreement.
5.1.7. Publisher shall provide Sportradar with its privacy statements, consent forms and any other communication relating to the collection and processing of the Shared Personal Data for inspection prior to commencement of the Agreement. Sportradar shall notify Publisher if it requires any amendment to the privacy statements or communication and, if such privacy statement or communication does not provide any or some of the necessary information required under the Data Protection Legislation, Publisher shall make such amendments.
5.1.8. Publisher shall provide Sportradar (upon request) with all the information necessary to demonstrate compliance with its obligations under the Data Protection Legislation.
5.2. Rights of Data Subjects
5.2.1. The Parties shall cooperate as set out below in this clause 5.2 of the Joint Data Cooperation Agreement with respect to data subject requests to exercise rights:
a. to access, rectification, erasure and object;
b. to restriction of processing;
c. to data portability;
d. in relation to automated decision making and profiling.
5.2.2. Publisher shall respond to any data subject requests concerning the Shared Personal Data and shall forward any such data subject request and any information on any actions with respect to the request to Sportradar without undue delay and in any event within 72 hours. In the event that Sportradar receives any data subject requests concerning the Shared Personal Data, Sportradar shall forward such requests to Publisher for a response to the data subjects.
5.2.3. Sportradar shall provide reasonable and prompt assistance to Publisher (within 5 (five) Business Days of such request for assistance) as is necessary to enable Publisher to comply with data subject requests and to respond to any other queries or complaints of any kind whatsoever from data subjects.
5.2.4. The Parties to the Agreement shall maintain a record of data subject requests, the decisions made and any information that was exchanged. Records shall include copies of the request for information, details of the personal data accessed and shared and where relevant, notes of any meetings, correspondence or phone calls relating to the request.
5.3. Processors
The Parties to the Agreement may use one or more processors and sub-processors provided that each of them shall comply with any applicable Data Protection Legislation.
5.4. Records
Both Parties to the Agreement shall at their own cost keep a record of any processing of Shared Personal Data carried out under this Joint Data Cooperation Agreement.
5.5. Data Protection Impact Assessment
Upon request, the Parties shall provide each other with reasonable cooperation and assistance needed to carry out a data protection impact assessment (if applicable) in accordance with the Data Protection Legislation related to the processing of Shared Personal Data under this Joint Data Cooperation Agreement.
5.6. Complaints
In the event of a dispute or claim brought by a data subject or a Competent Data Protection Authority concerning the processing of Shared Personal Data against either or both Parties, the Parties shall inform each other about any such disputes or claims without delay and shall cooperate with a view to settling them amicably in a timely manner.
5.7. Data Security
5.7.1. Both Parties shall implement appropriate technical and organizational measures to:
a. ensure a level of security appropriate to the risk involved to protect all Shared Personal Data from unauthorized use, alteration, access or disclosure, and loss, theft, and damage;
b. ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c. restore the availability and access to Shared Personal Data in a timely manner in the event of a physical or technical incident;
d. test, assess and evaluate the effectiveness of technical and organisational measures implemented for ensuring the security of the processing of the Shared Personal Data;
e. pseudonymise and encrypt the Shared Personal Data, as appropriate;
f. prevent a Data Breach.
5.7.2. Both Parties shall keep accurate records of the security measures which they have in place and shall make such records available to the other Party upon request.
5.8. Data Breach
The Parties to the Agreement shall notify the other Party of any potential or actual accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Shared Personal Data (“Data Breach“) as soon as possible and in any event within 48 (forty-eight ) hours of identification of any potential or actual loss in order to consider what action is required to resolve the issue in accordance with the Data Protection Legislation.
5.9. Audit Rights
Each Party to the Agreement has the right at its own cost to appoint an independent auditor to inspect the other Party’s compliance with the provisions laid down in this Joint Data Cooperation Agreement. Such audit may only be undertaken, on reasonable notice during normal business hours, once per calendar year or in the event of any reasonably suspected breach of any obligation under this Joint Data Cooperation Agreement. The Party being audited shall provide all necessary assistance to the conduct of any such audits.
5.10. Shared Personal Data after Termination
5.10.1. Both Parties acknowledge that after the termination of the Agreement each Party may continue to process the Shared Personal Data as a separate data controller for the purposes under clause 3.3 above provided that each Party shall comply with the obligations for controllers under the Data Protection Legislation.
5.10.2. In the event that Publisher receives any data subject requests concerning the processing of Shared Personal Data by Sportradar after the termination of the Agreement, Publisher shall forward such requests to Sportradar for a response to the data subjects. Sportradar shall remain solely responsible for any obligations under the Data Protection Legislation regarding the compliance with any data subject requests in respect of processing Shared Personal Data by Sportradar.
5.11. Confidentiality
5.11.1. Both Parties shall maintain the duty of confidentiality regarding the Shared Personal Data.
5.11.2. Both Parties warrant and represent that the individuals authorized to process Shared Personal Data are subject to binding obligations of confidentiality and shall comply with the relevant security measures, of which they must be duly informed.
6.Indemnity and Limitation of Liability
Indemnities and limitations of liability shall be as set forth in Appendix 1 GTC to the Agreement with respect to the obligations of the Parties resulting from this Joint Data Cooperation Agreement.
7. Survival
Clause 5.10 shall survive the termination or the expiry of this Joint Data Cooperation Agreement and the Agreement.
8. Contact Point
The following contact person within Sportradar can be contacted in respect of queries, complaints or notifications of any kind whatsoever regarding this Joint Data Cooperation Agreement or the Data Protection Legislation and for the purposes of receipt of notices under this Joint Data Cooperation Agreement:
Name and position: Stefano Celardo (Data Protection Officer)
Tel.: +43 1 256 31 41 548
E-mail: [email protected]
9. Miscellaneous
9.1. In the event of any conflict between the terms of this Joint Data Cooperation Agreement and any provision of the Agreement and any other agreement between the Parties, this Joint Data Cooperation Agreement shall prevail solely with respect to any data protection matters.
9.2. Exhibits 1 and 2 shall be incorporated and made part of this Joint Data Cooperation Agreement.
9.3. Notwithstanding the governing law of the Publisher Agreement (which shall be governed by the law set forth in section § 4 of the main body of the Publisher Agreement), this Joint Data Cooperation Agreement shall be governed by and construed in accordance with the Austrian law. All disputes arising out of or in connection with this Joint Data Cooperation Agreement shall be subject to the exclusive jurisdiction of the Austrian courts.
9.4. The provisions of this Joint Data Cooperation Agreement are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision and the rest of this Joint Data Cooperation Agreement shall remain in full force and effect.
9.5. Any amendment to this Joint Data Cooperation Agreement must be made in writing upon mutual agreement by the Parties.
Exhibit 1 to the Joint Data Controllership Agreement
| Category of Processing Operations | Processing Operations | Cookie Name |
Functionality | Applicability of the Processing Operations (Yes/No) |
| A. No Usage of Scripts (i.e. creatives w/o scripts) | Creatives without 3rd party scripts hosted by the Publisher. Reporting based on Publisher numbers. | No 3rd Party cookies required. Cookies set by the Publisher’s ad server. Consent responsibility lies with the Publisher. | Required for frequency capping during delivery. Cookie is set by the Publisher’s ad server. | Yes |
| B. Usage of Scripts for Tracking (i.e. creatives include scripts, w/o reading or writing cookies) | Advertising material with scripts from Sportradar or its clients, to enable the performance tracking (Creative exchange, counting the Views and clicks, Measuring the visibility, etc,). Definitive marking of the end user is prohibited. | No 3rd party cookie required (see category A) | The cookie from the Publisher’s ad server controls the Campaign in reference to Targeting and Frequency Capping. The pixels from Sportradar’s or its client’s ad server measures the campaign. However, the end user is not marked. |
Yes |
| C.1. Delivery of the Scripts and Setting of Cookies (i.e. creatives with scripts are delivered, cookies are used for easy campaign performance measurement) | Advertising material with scripts From Sportradar or its clients, to easily track the performance (Creative exchange, counting the views and clicks, measuring the visibility). Definitive marking of the end user is prohibited. |
To be listed and named by Sportradar. | Cookies will be set by Sportradar or its clients on the Publisher’s digital properties and controls the campaign in reference to targeting and frequency capping. The pixels from Sportradar’s or its client’s ad server measures the campaign. However, the end user is not marked for the purpose of profiling and users are not targeted on 3rd party pages. |
Yes |
| C.2. Delivery of the Scripts and Setting and Reading of Cookies (i.e. creatives with scripts are delivered, cookies are used for the advanced campaign performance measurement) | Advertising material with scripts from Sportradar or its clients, for the extended performance tracking (same as category B, as well as setting of Cookies on the Publisher’s digital properties, e.g. for Frequency Capping, Audience Verification, Ad Fraud, Brand Safety, Attribution for the purpose of performance documentation |
To be listed and named by Sportradar. | Cookies will be set by Sportradar or its clients on the Publisher digital properties. The Publisher supports the setting of the cookie and gathers consent. Targeting users on any third party website is not permitted. | Yes |
| D. Usage of Scripts, Setting and Reading Cookies, “Retargeting” (i.e. creatives with scripts are delivered, reading of already set cookies) |
Creatives include scripts by Sportradar or its clients, including the permission to read cookies and use the information for targeting. This includes cookies that have been previously set and where consent has been gathered in the past. Definitive marking of the end user is prohibited. | To be listed and named by Sportradar. | Cookies will be set by Sportradar or its clients on the Publisher digital properties. The Publisher supports the setting of the cookie and gathers consent. | Yes |
| E. Usage of Scripts, Setting and Reading Cookies (“Retargeting”) to Improve Campaign Delivered on Publisher Digital Properties (i.e. creatives with scripts, setting cookies and reading already set cookies on Publisher digital properties) | Creatives include scripts by Sportradar or its clients, including the permission to read cookies and use the information for targeting. This includes cookies that have been previously set and consent has been gathered in the past. | To be listed and named by Sportradar. | Cookies will be set by Sportradar or its clients on the Publisher digital properties. The Publisher supports the setting of the cookie and gathers consent. Targeting users on any third party website is not permitted. | Yes |
| F. Usage of Scripts, Setting and Reading Cookies to Improve Cross Device Campaigns Delivered on Publisher Digital Properties (i.e. creatives with scripts, setting cookies, reading already set cookies on Publisher digital properties to improve campaign performance) |
Creatives include scripts by Sportradar or its clients that collect preference, interests and device based information on users across a large number of properties (including the Publisher’s). The information will be used to build statistical audience segments for targeted campaign delivery on the Publisher digital properties (as well as others sites). | To be listed and named by Sportradar | Cookies will be set by Sportradar or its clients on the Publisher digital properties. The Publisher supports the setting of the cookies and gathers consent. | Yes |
| G. Usage of Scripts, Setting and Reading Cookies for Targeting (i.e. setting retargeting cookies to identify the end user on websites and be able to retarget them on other sites). | Creatives include scripts by Sportradar or its clients that will be used to identify the end user and retarget the end user across properties. | To be listed and named by Sportradar | Cookies will be set by Sportradar or its clients on the Publisher digital properties. The publisher supports the setting of the cookies and gathers consent. | Yes |
| H. Data selling | Publisher shares targeting data with Sportradar in order to resell them to an advertiser (i.e. subscription information) | N/A | N/A | No |
EXHIBIT 2 TO THE JOINT DATA COOPERATION AGREEMENT
Reference to Sportradar in Publisher’s privacy statements pursuant to clause 5.1.6 of the Joint Data Cooperation Agreement
Example:
“Third Parties
(…)
We disclose your personal data to Sportradar AG (Feldlistrasse 2, CH-9000 St. Gallen, Switzerland, VAT identification number CHE-113.910.142 MWST) which acts as a joint data controller for advertising purposes, including targeted programmatic advertising and associated analytics and fraud detection and prevention, and improvement of your experience. In particular, Sportradar AG processes your personal data in order to collect information about your activities on our [Publisher digital property], build a clearer understanding of who our audience is and segment our audience into different groups in accordance with your and our other users’ online behavior in order to better serve more relevant advertising. Should you need more information regarding the processing of your personal data carried out by Sportradar AG, please click on this link to see Sportradar AG’s Privacy Notice and on this link to see Sportradar AG’s Cookie Notice.
(…)”
