Data Processing Addendum (DPA)

1. Purpose and Scope

This DPA applies to the processing of Personal Data (or Personal Information) by Voxus on behalf of the Advertiser to provide digital media technology and attribution services. Voxus acts as a Processor (under GDPR/LGPD) or Service Provider (under CCPA), while the Advertiser acts as the Controller or Business.

2. Nature of Processing

• Subject Matter: Provision of technology for digital media and advertising attribution.
• Duration: The duration of the underlying Terms of Service.
• Nature: Collection and processing of pseudonymized identifiers for audience segmentation and ad delivery optimization.
• Purpose: Media segmentation, attribution of results (conversions), and performance analysis.

3. Categories of Data and Data Subjects

• Categories of Data: The system processes online identifiers including IP addresses, Cookie IDs, Mobile Advertising IDs (MAIDs), browsing events (URLs, clicks, views), and technical "user agent" strings.
• Data Subjects: Internet users visiting the Advertiser’s mobile or desktop website.
• Special Categories: Voxus does not collect or store direct identifiers (names, emails, IDs) or sensitive personal data.

4. Voxus' Obligations

Voxus agrees to:

• Processing Instructions: Process personal data only as necessary to provide the services and in accordance with the Advertiser's documented instructions.
• Confidentiality: Ensure that all personnel authorized to process the data have committed themselves to confidentiality.
• Security Measures: Implement appropriate technical and organizational measures, such as pseudonymization and high-level hash algorithms, to protect data against unauthorized access or loss.
• Data Subject Rights: Assist the Advertiser in responding to requests from users wishing to exercise their rights (access, deletion, or opt-out).
• International Transfers: Ensure that any data transferred outside the country of origin (e.g., from the EU to the US or Brazil) is protected by legal safeguards such as Standard Contractual Clauses (SCCs).

5. Advertiser Obligations

The Advertiser is responsible for:

• Legal Basis: Obtaining the necessary consent or establishing a legal basis (e.g., legitimate interest) for the collection and sharing of data with Voxus.
• Transparency: Maintaining an up-to-date privacy policy that informs users about the use of Voxus' tracking technologies.
• Privacy by Default: Implementing "Privacy by Default" principles to ensure user data is handled responsibly.

6. Data Retention and Deletion

• Retention Schedule: User segmentation data is retained for 7 days, and anonymized event logs are kept for 15 days.
• Deletion: Data is automatically purged from Voxus systems after the retention period or upon the termination of the service agreement.