AUDIENCE DATA PROCESSING AGREEMENT (DPA)

Agreement on Contracted Data Processing for clients of the Audience (“Client“) by and between Air Smart Advertising Solutions FZ-LLC (4, Internet City Road Al Sufouh 2, Dubai, Commercial Office - DIC-Bldg 04-101, Commercial Office - DIC-Bldg 04-FL1C1) (“Yandex”).

By using opt-in check-box you declare that you agree to the following regulations. By proceeding, you confirm that you have a business established in the territory of a member state of the European Economic Area or Switzerland, or that, for other reasons, you are subject to the territorial scope of the national implementations of the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, (General Data Protection Regulation; hereinafter – "GDPR"). You further agree that if the aforementioned is not the case, this DPA between you and Yandex shall be void.

This DPA enters into force on 25 May 2018 if you have agreed to the DPA prior to or on such date, or on the date on which you agreed to the DPA, if such date is after 25 May 2018.

This DPA is an addition to the Audience: Terms of Service (https://yandex.com/legal/audience_tos) (“Audience TOS”). In the event of a contradiction between these clauses and the Audience TOS, the terms and conditions under this DPA shall prevail.

If you are accepting this DPA on behalf of the Client, you warrant that: (a) you have full legal authority to bind the Client to this DPA; (b) you have read and understand this DPA; and (c) you agree, on behalf of the Client, to this DPA.

“Client Data” shall mean any kind of data provided by or in connection with the Client. Client Data can possibly contain personal data.

“Personal Client Data" shall mean any kind of Client Data which is personal data and which is processed by Yandex as part of the DPA.

“Personal Data”, "Processing”, “Data Controller”, “Processor” shall have the meaning as defined in GDPR.

"Audience Service" shall mean the online service available to the Client on https://audience.yandex.ru, allowing Client to upload the Client Personal Data, to ensure technical processing of such data by Yandex, to use the results of such processing for the purposes of serving targeted advertising to the Users, to receive information and statistical data regarding uploaded Client Personal Data, as well as to provide access to such data to the third parties subject to the Audience TOS and terms of the DPA hereunder, and for other means of using the Services.

"Segment" shall mean the group of Client Personal Data used for the purposes of placement, management of placement, targeting of ads in the Internet, formed basing on the analysis of the Users’ behavior in the Internet and respective forecast of interests or groups of interests associated with such Users.

2. GENERAL

2.1 Subject matter of the Agreement: Yandex shall provide you with the services as described in this DPA and the Audience TOS and may process Client Data as part of the performance of services pursuant to this DPA and the Audience TOS.

2.2 Subject matter, nature and purpose of the Data Processing: The Audience Service serves only legal purposes for the Data Processing, including (i) serving targeted advertising to the users of the Internet and (ii) providing you with statistical data of your use of the Audience Service. For these purposes, Yandex may collect Client Data in the form of Segments uploaded by you using Client Interface of the Audience Service. Client Data will be evaluated by the Processing software to make available the results of such Processing in the interface of the respective advertising platform, including but not limited to Yandex.Direct (https://direct.yandex.ru), for the purposes of serving users of the Internet with targeted advertising.

2.3 Group of affected persons: Users of the Internet or other persons whose data is provided by the Client.

2.4 Type of data: Data uploaded to the Audience Service which may include device_id’s, CRM data, phone numbers, email addresses, MAC-addresses, but without limitation of the foregoing.

2.5 Duration and data deletion: This DPA is valid until and the duration of the Processing shall be equal to the term of providing you with the Audience Service or the services provided to you under the Audience TOS. The rights, benefits and obligations of this DPA shall commence with the first use of the Audience Service and shall terminate with termination of the agreed services under the Audience TOS.

2.6 With respect to the Processing of Personal Client Data as part of this DPA, you and Yandex (hereinafter – Parties) act as independent Controllersof Personal Client Data within the meaning of GDPR. The Parties are separately responsible for the compliance with GDPR.

3. RIGHTS AND OBLIGATIONS OF THE PARTIES

3.1 The Parties shall be independently responsible for the permissibility of the Processing of Personal Client Data as well as the protection of the rights of the data subject and the confidentiality of Personal Client Data in accordance with applicable law.

3.2 The Client is obliged to ensure that there is: (a) a sufficient legal basis for the disclosure of Personal Client Data to Yandex and further processing of Personal Client Data by Yandex, its affiliates and partners; (b) a notification of data subjects on the disclosure of Personal Client Data to Yandex and the subsequent processing of personal data by Yandex, its affiliates and partners.

3.3 Each of the Parties is obliged to ensure the confidentiality and security of Personal Client Data received from the other Party in connection with the conclusion, execution, amendment or termination of the Audience TOS.

3.4 At the request of the other Party, each of the Parties shall, within a reasonable time, provide the other Party with sufficient evidence of the fulfillment of its obligations under clauses 3.2-3.3 of the DPA.

3.5 Yandex and its affiliates have the right to process Personal Client Data received from the Client in connection with the conclusion, execution, amendment or termination of the Audience TOS in accordance with the Privacy Policy available at the link: https://yandex.com/legal/confidential, including disclosing Personal Client Data to partners.

3.6 You declare that you exclusively Process Personal Client Data (if existing) for the purpose of serving the users of the Internet with targeted advertising and receive statistic reports of your use of the Audience Service.

4. STANDARD CONTRACTUAL CLAUSES

4.1 lf the General Data Protection Regulation (GDPR) and/or Swiss or UK personal data legislation is applied to you, the transfer of Personal Customer Data to Yandex from you is governed by this section.

The Parties hereby conclude the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) (module one) (“SCC”).

4.2 The Parties agree to include Clause 7 (docking clause) in the SCC.

4.3 For the purposes of Clause 17 of the SCC, the Parties specify Option 1 as follows:

These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of Netherlands.

4.4 The Parties agree to specify Clause 18(b) of the SCC as follows:

Any dispute arising from these Clauses shall be resolved by the courts of Netherlands.

4.6 Annex I and Annex II are attached to this DPA.

5. CHANGES TO DPA

5.1 Yandex may change the DPA at any moment and is obliged to notify the Client of any essential changes to the DPA within a reasonable time or specified period of time as may be required to comply with the applicable law. Materiality of changes is determined at the discretion of Yandex. Yandex shall be entitled not to notify you about non-essential editorial changes.

5.2 If you object to any such change, you must terminate the DPA and stop using the service as described in clause 2.5 of the DPA.

Annex I

A. List of parties

Data exporter:

	Name:	The relevant party to the Audience TOS (https://yandex.com/legal/audience_tos)
	Address:	N/A
	Contact person’s name, position and contact details:	N/A
	Activities relevant to the data transferred under these Clauses:	Rendering of Audience Service
	Signature and date:	N/A
	Role (controller/processor):	Controller

Data importer:

	Name:	Air Smart Advertising Solutions FZ-LLC
	Address:	4, Internet City Road Al Sufouh 2, Dubai, Commercial Office - DIC-Bldg 04-101, Commercial Office - DIC-Bldg 04-FL1C1
	Contact person’s name, position and contact details:	As defined in the Agreement
	Activities relevant to the data transferred under these Clauses:	Rendering of Audience Service
	Signature and date:	N/A
	Role (controller/processor):	Controller

B. Description of transfer

Categories of data subjects whose personal data is transferred: Users of the Internet.

Categories of personal data transferred: Personal data of end users (data uploaded to the Audience Service which may include device_id’s, CRM data, MAC-addresses and other data provided by the data exporter to importer).

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): The data is transferred on a one-off and a continuous basis.

Nature of the processing: Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure and destruction.

Purpose(s) of the data transfer and further processing: The data exporter transfer personal data to data importer for the purpose of provision of the Audience Service in accordance with the Audience TOS.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The period of provision of the Audience Service to data importer plus the time for the deletion of personal data according to the applicable legislation.

C. COMPETENT SUPERVISORY AUTHORITY

Dutch Data Protection Authority

Annex II

The following key elements are implemented by Yandex as technical and organisational measures to ensure the safety of data:

1. An information security policy is established and reviewed regularly to provide direction and support in accordance with the business requirements, relevant laws, and regulations.

2. Responsibilities for information security tasks are assigned to effectively manage information security.

3. Security practices are implemented for employees and contractors during their employment. All employees receive training in information security.

4. Inventory of assets and appropriate protection responsibilities are defined.

5. Employees and contractors have access only to information and assets related to their job functions.

6. Encryption and key management is used to protect information, data masking measures are applied when necessary.

7. Secure data transfer is ensured using the TLS/HTTP protocol.

8. Offices, rooms and other facilities are secured to prevent unauthorized access, damage, and interference to premises and information.

9. Best information security practices, such as secure development, access management, software update installation and incident response, are described and implemented.

10. Data centers provide fault tolerance and transmit data over secure channels.

11. Firewalls, multi-factor authentication, and detection of unauthorized access are implemented to secure networks.

Date: 13.03.2025

Previous version of the document: https://yandex.com/legal/audience_dpa_ch/25052018/