Intro

Marmar Invest B.V. (“Marmar Invest B.V.”, “we”, “our” or “us”) uses reasonable efforts to provide participating advertisers/Demand Side Platform (“DSP” or “Demand Partner”) and publishers/Supply Side Platform (“SSP”) with a safe, transparent, and fair RTB platform. Your use (“you” or “your”) of Marmar Invest B.V.’s platforms (“Platform(s)”) is governed by your contract with Marmar Invest B.V., which requires compliance with this Addendum (hereinafter the “DPA”) as it may be updated from time to time.

In case you are participating on the supply side (Publisher/SSP), please refer to the “Publisher DP Addendum”; if your participation is on the demand side (Advertiser/DSP), please refer to the “Demand Partner DP Addendum.”

Marmar Invest B.V. may update this DPA at any time without prior notice. All amendments will be posted on our website at Marmar Invest B.V. (the “Website” or “Site”) and will be effective immediately upon posting. By using our platform, you agree to any updated version of this DPA.

Furthermore, Marmar Invest B.V. reserves the right to suspend your participation and your platform if it reasonably suspects, in its sole discretion, that any of the provisions of this DPA or applicable laws have been violated.

Publisher DP Addendum

This Publisher DP Addendum (the “DPA”) is entered into by and between Marmar Invest B.V. Ltd, a company located at Parallelweg Oost 21, 5555XA Valkenswaard, The Netherlands (hereinafter “Marmar Invest B.V.”) and you (the “Publisher” or “you”), and supplements and forms part of the Marmar Invest B.V. Publisher’s Master Services Agreement (the “Agreement”) or any other written or electronic agreement between Marmar Invest B.V. and the Publisher/SSP. This DPA is effective as of the date the Agreement is executed (the “Effective Date”).

In consideration of the mutual obligations set out herein, the parties agree that the following terms and conditions shall be added as an addendum to the Agreement.

1. Definitions

“Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data;
“Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller;
“Sub-processor” means any person appointed by or on behalf of Marmar Invest B.V. to process Personal Data on its behalf in connection with the Agreement;
“CPRA” means the California Privacy Rights Act of 2020, Cal. Civ. Code §§ 1798.100 et seq.;
“Government Authority Request” means any subpoena, warrant, or other judicial, regulatory, governmental, or administrative order, demand, or request (whether formal or informal) by a governmental or regulatory authority seeking access to or disclosure of Personal Data;
“Demand Partners” means Marmar Invest B.V.’s media buying clients, including but not limited to advertisers, demand side platforms, DSPs, ad exchanges, agencies, and ad networks;
“Applicable Privacy Law” means all applicable laws and regulations relating to the protection of personal data (including, without limitation, the GDPR, CPRA, the e‑Privacy Directive, and any national data protection laws).

2. Notice Requirements

Publisher agrees that it is responsible for ensuring that all data subjects (and end‑users) are appropriately notified about the data collection and use practices on the Publisher Assets through the Services. The Publisher shall prominently post and maintain a publicly available privacy notice that complies with this DPA, Applicable Privacy Law, and the Privacy Requirements. The notice shall include, at a minimum:

• A statement that Personal Data may be collected for advertising purposes;
• A description of the Personal Data categories collected and the purposes for which they are processed;
• The Publisher’s details;
• A link or description of the mechanisms available for data subject choice; and
• Any additional information required by law.

3. Prohibited Data Sharing

The Publisher shall not use Marmar Invest B.V. Services to publish or launch any content that is intended for or likely to be accessed by children under Applicable Privacy Law. Prior to launching any Publisher Assets on the Marmar Invest B.V. Services, the Publisher must either flag such content or notify Marmar Invest B.V. in writing. Additionally, any Personal Data of children must be provided to Marmar Invest B.V. or its Demand Partners only in accordance with Applicable Privacy Law.

4. Data Subject Rights

If Marmar Invest B.V. receives a request from a Data Subject to exercise its rights (including the right to be informed, access, rectification, erasure, restriction of processing, data portability, or to object), Marmar Invest B.V. will, to the extent legally permitted, promptly notify and forward such request to the Publisher. Marmar Invest B.V. will use commercially reasonable efforts to assist the Publisher in complying with its obligations under Applicable Privacy Law.

5. Non‑compliance

If the Publisher is unable to fulfill its obligations with respect to obtaining consent or providing notice regarding Personal Data, the Publisher must immediately notify Marmar Invest B.V. in writing.

6. Sub‑Processors

Marmar Invest B.V.’s current list of Sub‑Processors is set out in Annex D (“Sub‑processor List”) and is hereby approved by the Publisher. Where Marmar Invest B.V. engages a new Sub‑Processor for specific processing activities, similar data protection obligations as set forth in this DPA will be imposed on such Sub‑Processor by contract or another form of undertaking.

7. Personal Data Breach and Security Incident

The Publisher must promptly inform Marmar Invest B.V. if it or any of its Sub‑Processors become aware of a Personal Data Breach or any Security Incident affecting Personal Data. Such notification shall, at a minimum, (I) describe the nature of the breach, the number of Data Subjects affected, and the categories and numbers of Personal Data records involved; (II) provide the name and contact details of the Publisher’s data protection representative; and (III) detail any remediation actions taken. The Publisher must also inform affected Data Subjects as required by Applicable Privacy Law.

8. Standard Contractual Clauses

For the purposes of the Standard Contractual Clauses (SCCs), the parties agree that: (i) Marmar Invest B.V. shall be deemed the “data importer” and the Publisher the “data exporter”; (ii) Module 2 (Transfer Controller to Processor) applies to the processing of the data submitted under the Agreement; (iii) Annex A of this DPA replaces Annex I of the SCCs, and Annex B replaces Annex II; and (iv) in the event of any conflict between this DPA and the SCCs, the provisions of the SCCs (as applicable) shall prevail (see Annex E).

9. California Region

The following additional terms apply with respect to Data Subjects who are California residents:

1. For the purposes of this “California” section, the definitions of “Controller,” “Processor,” “Sub‑Processor,” and “Data Subject” shall be interpreted in accordance with the CPRA.
2. Notwithstanding any other provision of this DPA, the Publisher shall process Personal Data only to perform the Services for the Permitted Purposes and/or in accordance with the Publisher’s documented lawful instructions. Marmar Invest B.V. may de‑identify or aggregate Data as necessary for Service delivery.
3. Each party shall comply with applicable CPRA requirements regarding the sale or sharing of Personal Data, including providing an opt‑out mechanism to Data Subjects.

10. Inspection and Audit Rights

Either party may, upon reasonable notice and during normal business hours, inspect the other party’s compliance with this DPA. Such inspections will be conducted in a manner that minimizes disruption to the processing of Personal Data.

11. Standard Contractual Clauses (Re‑affirmation)

The parties reaffirm their commitment to the SCCs as set forth in Annex E. In the event of any conflict between the terms of this DPA and the SCCs, the SCCs shall prevail for the purposes of data transfers.

12. Miscellaneous

(a) Subcontracting: The Publisher may appoint third parties to process Personal Data only if such third parties agree in writing to comply with the Publisher’s instructions and implement appropriate security measures as described in Annex C.
(b) Security: The Publisher shall implement and maintain technical and organizational measures that are at least as protective as those described in Annex C to safeguard Personal Data.
(c) International Transfers: The Publisher shall not process Personal Data outside of the European Economic Area unless it has taken the necessary measures to ensure compliance with the GDPR and other applicable laws.
(d) Cooperation and Data Subject Rights: In the event that either party receives a Data Subject Request or any related correspondence, it shall promptly notify the other party and cooperate to address the request in accordance with Applicable Privacy Law.
(e) Change in Law: If any change in Applicable Privacy Law requires material changes to the Services or processing methods, Marmar Invest B.V. may amend this DPA upon giving at least 30 days’ notice.
(f) Survival: This DPA shall survive termination or expiry of the Agreement, and the Publisher may continue to process Personal Data provided such processing complies with this DPA and Applicable Privacy Law.
(g) Governing Law: This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions set out in the Agreement.

Annex A – List of Parties

Processor / Data Importer

Name:	Marmar Invest B.V.
Address:	Parallelweg Oost 21, 5555XA Valkenswaard, The Netherlands
Contact person’s name, email, and position:	Yannick, CEO, [email protected]
Activities relevant to personal data transfers:	See Annex B
Signature and date:	See Agreement
Role:	Processor

Controller / Data Exporter

Name:	See Agreement
Address:	See Agreement
Contact person’s name, email, and position:	See Annex B
Activities relevant to personal data transfers:	See Agreement
Signature and date:	See Agreement
Role:	Controller

Annex B – Description of Transfer

Defined terms are as set out in the Publisher Agreement.

Categories of Data Subjects whose Personal Data is transferred:

• End users of the Publisher Assets or end users viewing ads delivered to the Publisher Assets;
• Publisher Personnel;

Categories of Personal Data Transferred:

End Users:

• Identifiers: Identifier for Advertising (IFA); User ID; Buyer ID; Device ID; IP address; User Agent;
• Demographic information: Location, year of birth, gender;

Publisher Personnel:

• Contact details (first name, last name, email, country, address, telephone);
• Bank details;

Recipients: Sub‑Processors (vendors) and supervisory authorities;

Sensitive Data Transferred (if applicable): None.

Frequency of Transfer:

• End Users – Continuous
• Publisher Personnel – At registration and when information is updated

Nature of the Processing: Provision of the Services.

Purpose(s) of Data Transfer and Further Processing:

• End Users: For the designated purposes as defined in the Agreement;
• Publisher Personnel: For business relationship and account management purposes.

Retention Period: Personal Data will be retained in accordance with the Marmar Invest B.V. Privacy Policy.

Data Protection Enquiries: Data Importer and Data Exporter contact details are provided in Annex A.

Competent Supervisory Authority: For data protected by the EU GDPR, the relevant EU supervisory authority; for data protected under the Netherlands DPA, the Commissioner for Personal Data Protection.

Annex C – Technical and Organizational Security Measures

EXPLANATORY NOTE: The following measures are described in specific terms to ensure an appropriate level of security.

Overview: Marmar Invest B.V. implements robust technical and organizational measures, including certifications where applicable, to protect Personal Data.

Type of Measure	Details
Confidentiality	Access controls, encryption, and strict authentication protocols ensure that only authorized personnel may access Personal Data.
Availability & Adaptability	Regular monitoring of systems, redundancy, and backup procedures are in place to maintain data availability and service continuity.
Restoration Capability	Disaster recovery plans and regular data backups ensure timely restoration in the event of a loss or incident.
Testing & Evaluation	Security measures are reviewed and tested at least annually to ensure their continued effectiveness.
User Identification & Authorization	Access to Personal Data is restricted through stringent authentication and “need-to-know” principles.
Physical Security	Facilities housing Personal Data are secured and accessible only to authorized personnel.

Annex D – Sub‑Processors List

Entity Name	Sub‑Processing Activities	Entity Country
AdKernel	Data processing services	US
Amazon Web Services (AWS)	Data center services	US
MySQL	Database services	DE
MongoDB	Database services	DE
DynamoDB	Database services	DE

Annex E – Standard Contractual Clauses (SCCs)

Preamble: To comply with the GDPR, SCCs provide approved safeguards for transferring Personal Data from the EU/EEA to third countries. On 4 June 2021, the European Commission issued modernized SCCs, which replace previous versions. These clauses are available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en.

The parties agree to be bound by the SCCs. In particular, (i) Marmar Invest B.V. is the “data importer” and the Publisher is the “data exporter”; (ii) Module 2 (Transfer Controller to Processor) applies; (iii) Annex A to this DPA replaces Annex I of the SCCs, and Annex B replaces Annex II; and (iv) in the event of any conflict, the SCCs will prevail (see above).

---

 

End of Document