Data Processing Agreement

Last Updated: January 1, 2025

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Beijing Coolplay Tribe Technology Co., Ltd. ("CoolplayClub," "Processor," "we," "us") and the client ("Controller," "you") and governs our processing of personal data on your behalf.

1. Definitions

"Personal Data" — any information relating to an identified or identifiable natural person processed in connection with the Services.
"Processing" — any operation performed on personal data, including collection, storage, transmission, analysis, and deletion.
"Sub-processor" — any third party engaged by CoolplayClub to process personal data on behalf of the Controller.
"Data Subject" — the individual to whom personal data relates.
"EEA" — European Economic Area.
"SCCs" — Standard Contractual Clauses adopted by the European Commission.

2. Scope and Roles

You act as the Controller of personal data. We act as the Processor, processing personal data on your behalf in accordance with your documented instructions. This DPA applies to all personal data we process through our advertising technology services.

3. Nature and Purpose of Processing

We process personal data for the following purposes:

• Operating programmatic advertising auctions (real-time bidding)
• Delivering, measuring, and optimizing advertising campaigns
• Detecting and preventing invalid traffic and ad fraud
• Providing analytics and reporting dashboards
• Frequency capping and audience segmentation
• Cross-device attribution and measurement

4. Categories of Data

The personal data processed may include:

• Online identifiers (IP addresses, cookie IDs, device IDs, advertising IDs)
• Browser and device information (user agent, OS, screen resolution, language)
• Connection data (timestamps, referrer URLs)
• Pseudo-anonymized behavioral data (interest segments, browsing categories)
• Campaign interaction data (impressions, clicks, conversions)

We do not process sensitive personal data (special categories under GDPR Article 9) without explicit consent.

5. Data Subject Categories

Data subjects include end users who interact with digital advertising on publisher websites and applications connected to our advertising exchange.

6. Controller Obligations

As Controller, you warrant that:

• You have a lawful basis for processing personal data through our platform
• You provide appropriate transparency notices to data subjects about our processing
• You respond to data subject rights requests and provide necessary assistance to CoolplayClub
• Your use of our Services complies with applicable data protection laws

7. Processor Obligations

As Processor, we commit to:

• Process personal data only on your documented instructions
• Ensure personnel authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist you in fulfilling data subject rights requests
• Assist with data protection impact assessments and prior consultations
• Notify you without undue delay of any personal data breach
• Delete or return all personal data upon termination of services
• Make available information necessary to demonstrate compliance

8. Sub-Processors

You authorize us to engage the following categories of sub-processors:

• Cloud infrastructure providers (hosting, CDN, storage)
• Data analytics and monitoring services
• Customer support and communication platforms
• Fraud detection and security services

We maintain an up-to-date list of sub-processors. We will notify you of any new sub-processor engagements and provide an opportunity to object.

All sub-processors are bound by contractual obligations no less protective than this DPA.

9. Security Measures

We implement and maintain:

• Encryption in transit (TLS 1.3 minimum) and at rest (AES-256)
• Multi-factor authentication and role-based access controls
• Network segmentation, firewalls, and intrusion detection systems
• Regular vulnerability scanning and penetration testing
• 24/7 security monitoring and incident response procedures
• Business continuity and disaster recovery plans
• Annual SOC 2 Type II audits (or equivalent independent certification)

10. International Data Transfers

Personal data may be transferred and processed globally. For transfers from the EEA, UK, or Switzerland to countries without adequacy decisions, we rely on approved transfer mechanisms including Standard Contractual Clauses (SCCs), Binding Corporate Rules, or other legal mechanisms as applicable.

11. Data Retention and Deletion

Advertising bid stream data: retained up to 90 days for billing and fraud detection.
Aggregated analytics: retained up to 26 months.
Account data: retained for the duration of the agreement plus 180 days.
Upon termination, we delete or return all personal data within 60 days, unless retention is required by law.

12. Audit Rights

Upon reasonable notice and no more than once per year, you may audit our compliance with this DPA. Audits shall be conducted during business hours with minimal disruption. You may engage an independent auditor subject to confidentiality obligations. We will provide SOC 2 reports and other relevant certifications to satisfy audit requirements.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set forth in the Terms of Service. Nothing in this DPA limits either party's liability for damages caused by its violation of applicable data protection laws.

14. Term and Termination

This DPA remains in effect for the duration of the Services. Upon termination, we will delete or return personal data as specified in Section 11. Provisions that by their nature should survive termination shall continue in effect.

15. Governing Law

This DPA is governed by the laws specified in the Terms of Service. Any disputes shall be resolved as set forth therein.

16. Contact

Data Protection Officer: dpo@coolplayclub.com
Privacy inquiries: privacy@coolplayclub.com