Dynamic Yield: Data Processing Addendum

Last Updated November 2022

This Data Processing Addendum ("Addendum") forms an integral part of the Agreement between Customer, MCI and the Dynamic Yield entity listed in the applicable Order Form or Agreement ("Dynamic Yield") (together referred to as the “Parties”, and individually as a “Party”), which govern Customer's right to use certain services designed to automatically personalize Customer's content through Dynamic Yield's Platform, and applies to the extent that Dynamic Yield or any of its trusted Sub-Processors collect or processes Personal Data, or has access to Personal Data, in the course of Dynamic Yield’s performance under the Agreement, as specified in Exhibit A, which is attached and incorporated hereto by reference.

All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

1. Definitions
   1. "Approved Jurisdiction" means a member state of the EEA, or other jurisdiction as may be approved as having adequate legal protections for data by the European Commission.
   2. "Breach Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
   3. "CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq.
   4. "Data Protection Legislation" means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement, including, where applicable, EU Data Protection Law and the CCPA.
   5. “Data Controller”, “Data Processor”, “data subject”, “process” and “processing” shall have the meanings ascribed to them in the Data Protection Legislation. Where applicable, Data Controller shall be deemed to be a "Business", Data Processor shall be deemed to be the "Service Provider", and "data subject" shall be deemed to be a "Consumer" as these terms are defined under the CCPA.
   6. "EEA" means those countries that are member of the European Economic Area.
   7. “EU Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC), their national implementations in the EEA, and all other data protection laws of European Union (“EU”) countries, the United Kingdom (“UK”), Monaco, and Switzerland, each as applicable, and as may be amended or replaced from time to time.
   8. "Personal Data" means any information which (i) can be related to an identifiable individual, including any information that can be linked to an individual or used to directly or indirectly identify an individual, and (ii) supplied by Customer to Dynamic Yield pursuant to the Agreement or which Dynamic Yield or any of its Sub-Processors generate, collect, store, transmit, or otherwise process on behalf of Customer in connection with the Agreement. Personal Data may include information which is related to Customer’s users, employees, and other individuals (collectively, "End Users").
   9. “Security Measures” mean commercially reasonable security-related policies, standards, and practices commensurate with the size and complexity of Dynamic Yield’s business, the level of sensitivity of the data collected, handled and stored, and the nature of Dynamic Yield’s business activities.
   10. “Standard Contractual Clauses” mean the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council from June 4th 2021.
   11. “Sub-Processors” mean any affiliate, agent or assign of Dynamic Yield that may process Personal Data pursuant to the terms of the Agreement, and any unaffiliated processor engaged by Dynamic Yield.
   12. “UK Addendum” means the addendum to the Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022).
2. Roles. Dynamic Yield acts as a Data Processor on behalf of Customer and Customer acts as a Data Controller for the processing of Personal Data in the context of the Services, as described in Exhibit A.
3. Compliance with Laws
   
   1. Each Party shall comply with its respective obligations under the Data Protection Legislation.
   2. Dynamic Yield shall provide reasonable cooperation and assistance to Customer in relation to Dynamic Yield’s processing of Personal Data in order to allow Customer to comply with its obligations as a Data Controller under Data Protection Legislation.
   3. Dynamic Yield agrees to notify Customer promptly if it becomes unable to comply with the terms of this Addendum and take reasonable and appropriate measures to remedy such non-compliance.
   4. Throughout the duration of the Agreement, Customer agrees and warrants that: (a) it has a mechanism in place to ensure that: (i) End Users have been informed of Dynamic Yield’s use of Personal Data as required by Data Protection Legislation; (ii) End Users' consents and permits applicable to Dynamic Yield's Services are properly obtained and recorded; (iii) End Users can withdraw such consent at any time;(b) Personal Data has been and will continue to be collected, processed and transferred by it in accordance with the relevant Data Protection Legislation; (c) it will not share any special categories of Personal Data, as this term is defined in the Data Protection Legislation and (d) any instruction to Dynamic Yield in connection with the processing of Personal Data, has been and will continue to be carried out in accordance with the relevant Data Protection Legislation. Customer shall bear sole liability in any case of violation of this section; and (e) it will, upon commercially reasonable request, provide Dynamic Yield with records of consents and permits obtained from End Users in accordance with 3.4(a)(ii).
4. Processing Purpose and Instructions
   
   1. The duration of the processing under the Agreement is determined by the Parties, as set forth in the Agreement.
   2. Dynamic Yield shall process Personal Data only to deliver the Services in accordance with Customer’s documented instructions, the Agreement and the Data Protection Legislation. Unless permitted under the Agreement or this Addendum, Dynamic Yield shall not otherwise modify, amend, disclose or permit the disclosure of any Personal Data to any third party unless authorized or directed to do by Customer.
   3. Dynamic Yield will not use Personal Data for any use other than as expressly provided in the Agreement or this Addendum. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Dynamic Yield and Customer by way of written amendment to the Agreement, and will include any additional fees that may be payable by Customer to Dynamic Yield for carrying out such instructions.
5. Reasonable Security and Safeguards
   
   1. Dynamic Yield represents, warrants, and agrees to use Security Measures as set out in set out in Exhibit B, to (i) protect the availability, confidentiality, and integrity of any Personal Data collected, accessed, used, or transmitted by Dynamic Yield in connection with this Agreement, and (ii) protect such data from Breach Incidents.
   2. The Security Measures are subject to technical progress and development and Dynamic Yield may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by Customer.
   3. Dynamic Yield shall take reasonable steps to ensure the reliability of its staff and any other person acting under its supervision who have access to and process Personal Data. Dynamic Yield shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
   4. Customer is responsible for using and configuring the Services in a manner which enables Customer to comply with Data Protection Legislation, including implementing appropriate technical and organizational measures.
6. Breach Incidents
   

   Upon becoming aware of a Breach Incident, Dynamic Yield will notify Customer without undue delay and will provide information relating to the Breach Incident as reasonably requested by Customer. Dynamic Yield will use reasonable endeavors to assist Customer in mitigating, where possible, the adverse effects of any Breach Incident.

7. Security Assessments and Audits
   

   Dynamic Yield audits its compliance against data protection and information security standards on a regular basis. Such audits are conducted by Dynamic Yield’s internal audit team or by third party auditors engaged by Dynamic Yield.

   Dynamic Yield shall, upon reasonable and written notice of at least thirty (30) days in advance and subject to obligations of confidentiality, allow its data processing procedures and documentation to be inspected annually by external independent auditors jointly selected by the Parties, in order to ascertain compliance with this Addendum. The external independent auditors cannot be a competitor of Dynamic Yield or MCI, and the Parties will mutually agree upon the scope, timing, and duration of the audit. Dynamic Yield shall cooperate in good faith with audit requests by providing access to relevant knowledgeable personnel and documentation during regular business hours.

8. Cooperation and Assistance
   
   1. If Dynamic Yield receives any requests from individuals or applicable data protection authorities relating to the processing of Personal Data under the Agreement, including requests from individuals seeking to exercise their rights under the Data Protection Legislation, Dynamic Yield will promptly redirect the request to Customer. Dynamic Yield will not respond to such communication directly without Customer's prior authorization, unless legally compelled to do so. If Dynamic Yield is required to respond to such a request, Dynamic Yield will promptly notify Customer and provide Customer with a copy of the request, unless legally prohibited from doing so.
   2. If Dynamic Yield receives a legally binding request for the disclosure of Personal Data which is subject to this Addendum, Dynamic Yield shall (to the extent legally permitted) notify Customer upon receipt of such order, demand, or request. Notwithstanding the foregoing, Dynamic Yield will cooperate with Customer with respect to any action taken pursuant to such order, demand or request, including ensuring that confidential treatment will be accorded to such disclosed Personal Data.
   3. Upon reasonable notice, Dynamic Yield shall provide reasonable assistance to Customer in:
      1. allowing data subjects to exercise their rights under the Data Protection Legislation;
      2. ensuring compliance with any notification obligations of Brach Incidents to the supervisory authority and communication obligations to data subjects, as required under Data Protection Legislation;
      3. Ensuring compliance with its obligation to carry out Data Protection Impact Assessments (“DPIA”) or prior consultations with data protection authorities with respect to the processing of Personal Data. Any assistance to Customer with regard to DPIA or prior consultations will be solely at Customer's expense.
9. Use of Sub-Processors
   
   1. Customer shall be deemed to have consented to the engagement of the Sub-Processors listed in Exhibit C hereto.
   2. Customer provides a general consent to Dynamic Yield to engage onward Sub-Processors (including for the provision of cloud computing services and for personalized search solutions), provided that Dynamic Yield has entered into an agreement with the Sub-Processor containing data protection obligations that are as restrictive as the obligations under this Addendum (to the extent applicable to the services provided by the Sub-processor). Prior to engaging any new Sub-Processor, Dynamic Yield will notify Customer (email acceptable) and allow Customer thirty (30) days to object. If Customer has legitimate objections to the appointment of any new Sub-Processor(s), the parties will work together in good faith to resolve the grounds for the objection for no less than thirty (30) days.
   3. Customer acknowledges that as part of the Services which Dynamic Yield provides, it may engage with Sub-Processors which provide additional technological solutions which may be provided as part of Dynamic Yield's services to the Customer. These service providers may also collect End Users’ data (including Personal Data) from Customer’s online platform, such as country of origin, search queries performed by End Users, features of End Users’ browser and the operating system, details about pages visited, etc. The engagement with these service providers will be done in accordance with the provisions of this section.
   4. Dynamic Yield will be responsible for any acts, errors, or omissions of its Sub-Processors that cause Dynamic Yield to breach any of its obligations under this Addendum.
10. International Data Transfers
    
    1. Dynamic Yield may transfer and process Personal Data to and in other locations around the world where Dynamic Yield or its Sub-processors maintain data processing operations as necessary to provide the Services as set forth in the Agreement.
    2. When Dynamic Yield (or its Sub-processors) processes Personal Data from the EEA, UK or Switzerland in a jurisdiction that is not an Approved Jurisdiction, Dynamic Yield and Customer (and if applicable the relevant Sub-Processor), will conclude the Standard Contractual Clauses as follows: The applicable parties shall be deemed to have entered into the applicable Module of the Standard Contractual Clauses and the UK Addendum, which are incorporated to this Addendum by reference, in accordance with Exhibit D. If such Standard Contractual Clauses are superseded by new or modified Standard Contractual Clauses, the new or modified Standard Contractual Clauses shall be deemed to be incorporated in this Addendum and the Parties will promptly begin to comply with them. Dynamic Yield will abide by the obligations set forth under the Standard Contractual Clauses for data importer.
11. Data Retention and Destruction

    Dynamic Yield will only retain Personal Data for as long as Services are provided to Customer in accordance with this Agreement . Following expiration or termination of the Agreement, upon Customer’s request Dynamic Yield will delete or return to Customer all Personal Data in its possession as provided in the Agreement except to the extent Dynamic Yield is required by applicable law to retain some or all of the Personal Data (in which case Dynamic Yield will implement reasonable measures to prevent the Personal Data from any further processing). The terms of this Addendum will continue to apply to such Personal Data.

12. Obligations under the CCPA
    1. Dynamic Yield shall not Sell the Personal Data (as the term "Sell" is defined under the CCPA).
    2. Dynamic Yield is prohibited from retaining, using, or disclosing Personal Data for a commercial purpose other than providing the services to Customer under the Agreement and from retaining, using, or disclosing the Personal Data outside of the Agreement.
    3. Dynamic Yield understands its obligations under this Clause 12 and will comply with them.
13. Liability and Indemnification
    

    Customer will indemnify, defend, and hold Dynamic Yield harmless against any claim, demand, suit or proceeding (including any damages, costs, reasonable attorney’s fees, and settlement amounts) made or brought against Dynamic Yield by a third party alleging that Personal Data received by Dynamic Yield from Customer or processed by Dynamic Yield in accordance with Customer’s instructions, is in breach of Data Protection Legislation.

14. General
    
    1. Dynamic Yield acknowledges and agrees that it has no ownership of Personal Data other than as expressly permitted under the Agreement or as authorized by Customer.
    2. Any claims brought under this Addendum will be subject to the terms and conditions of the Agreement, including the exclusions and limitations set forth in the Agreement, provided however that in no event will any party be deemed to have limited its liability under the Agreement with respect to any individual’s data protection rights under this Addendum or pursuant to applicable law.
    3. In the event of a conflict between the Agreement (or any document referred to therein) and this Addendum, the provisions of this Addendum shall prevail.
    4. Dynamic Yield may modify the terms of this Addendum in circumstances such as (i) if required to do so by a supervisory authority or other government or regulatory entity, (ii) if necessary to comply with Data Protection Legislation, or (iii) to implement or adhere to standard contractual clauses, approved codes of conduct or certifications, binding corporate rules, or other compliance mechanisms, which may be permitted under Data Protection Legislation. Dynamic Yield will provide notice of such changes to Customer, and the modified Addendum will become effective, in accordance with the terms of the Agreement.

1. Introduction
   
   • This Exhibit B outlines the technical and organizational measures for safeguarding Personal Data undertaken by Dynamic Yield, in support of our global security framework.
   • We take a systematic approach to data protection, privacy, and security. We believe a robust security and privacy program requires active involvement of stakeholders, ongoing education, internal and external assessments, and installment and enforcement of best practices within the organization.
   • We hold ISO 27001, ISO 27017, ISO 27701, and 27018 certifications.
2. Organizational and Personnel Management
   
   • We appointed a Chief Information Security Officer (CISO) who designs, develops, and deploys our technical architectures, security policies, standards, and awareness program along with our Security team and IT teams and can be reach at CISO@dynamicyield.com.
   • We have also appointed a Data Privacy Officer (DPO), who can be reached at privacy@dynamicyield.com, and who oversees our privacy program.
   • Annual Risk Assessment includes an Information Security Audit, owned, operated and maintained by the CISO. Its result is presented to the steering committee and afterwards to management during management security reviews
3. Physical Security
   
   • Dynamic Yield's physical servers are managed by Amazon Web Services (“AWS”) and overseen by Dynamic Yield’s team. AWS is widely regarded as employing highly protective and industry standard protective measures ensuring the security of physical servers managed by them, relied upon by thousands of technology providers around the world (more on AWS security measures can be found here- https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf).
   • Dynamic Yield has implemented suitable measures in order to prevent unauthorized persons from gaining access to its resources equipment, regardless of whether those resources are directly related to where Personal Data are processed or used. These measures may include all or a combination of any of the following:
     • Maintaining offices which are within facilities requiring registration for entry and accompaniment beyond the front entrance.
     • Strict measures to ensure that all visitors are accompanied, and awareness among employees to challenge any exceptions.
     • Restricted access to areas including any communications or other technological equipment on an employee role basis
     • A high security card key system is utilized to control facility access
     • CCTV video surveillance monitoring on all entry and exit points.
4. HR Security
   
   • Dynamic Yield personnel are trained and briefed about contractual obligations undertaken by Dynamic Yield towards its clients with respect to data security, and their compliance therewith is monitored by company management.
   • All Dynamic Yield employees and contractors are required to sign confidentiality agreements (“NDAs”) that apply during their engagement with Dynamic Yield and post termination.
   • New employees go through an on-boarding process that includes security guidelines, expectations, and code of conduct. All Dynamic Yield’s employees undergo annual security awareness training
   • The CISO communicates with all employees on a regular basis, covering topics such as emerging threats, phishing awareness campaigns, and other industry-related security topics.
   • A formal and communicated disciplinary process is in place against employees who have committed an information security breach.
5. Third Party Security
   
   • Third parties used by Dynamic Yield are checked by 3rd party questionnaires and a certification review prior to engagement to validate that prospective third parties meet Dynamic Yield’s security standards.
   • Once an engagement has been established, an annual review of applicable vendors is being conducted. The annual review is performed by both the DPO, the legal team and the CISO. The procedure takes into account the type of access and classification of data being accessed (if any), controls necessary to protect data, and legal/regulatory requirements.
6. Logical Access Control
   • Access to the AWS console is managed by personal password-protected user accounts, managed through the AWS Identity and Access Management (IAM) service.
   • MFA is enforced while accessing to our production environment
   • All users access the Dynamic Yield systems with a unique identifier and must authenticate via Dynamic Yield's SSO (Single Sign On) platform.
   • We have established a password policy that prohibits the sharing of passwords. All passwords must fulfill defined minimum requirements and are stored in encrypted form.
   • Automatic lock out of the user ID when several erroneous passwords are entered.
   • Automatic time-out of the user terminal if left idle; identification and password required to reopen.
   • Role-based access controls implemented in a manner consistent with the principle of least privilege.
   • Granting of access according to a strict formal procedure and periodic review of the access.
   • Employee’s access to production systems that contain personal data is logged, audited and reviewed on a regular basis.
7. Monitoring & Control
   
   • We utilize a wide range of tools to monitor our environment across data centers on both the server and application level. Security logs are distributed into our main logging aggregation server and continuously reviewed for anomalies by our 24x7 NOC team.
   • We Use of AWS config to assess, audit, and evaluate the configurations of our AWS resources.
8. Security in Development and Support Process
   
   • We use an industry-standard security model in our platform development process.
   • We design, review and test our platform using applicable OWASP Top 10 standards.
   • Our developers and project team members receive training at least once a year in application security while focusing on secure software development.
   • Our production environment is segregated from our development and staging environments with restricted access controls.
   • Periodic penetration testing are carried out by rotating 3rd party companies at least annually.
9. Privacy by Design
   
   • We incorporate Privacy by Design principles for systems and enhancements at the earliest stage of development as well as educate all employees on security and privacy annually
10. Workstation and Laptop Protection
    
    • We use up-to-date Anti-Malware / Anti Virus software on all appropriate laptops
    • We implement protections on end-user devices and monitor those devices to be in compliance with the security standard requiring password protection, screen saver, and patch management.
11. Change Management
    • We follow a strict change management process.
    • Changes are tracked, reviewed and approved to ensure operational changes are aligned with our business objectives and compliance requirements.
12. Account Segregation
    • Our customers’ data is stored separately from all other data, and only accessed as they are required for content sent by the specific component responsible for the content composition.
    • Each customer's Personal Data is encrypted with a different key, thus preventing the risk of data corruption and desegregation between Dynamic Yield customers.
13. Infrastructure & Network Security
    • Remote access via SSL VPN using 2 Factor Authentication.
    • We review our network architecture schema and data flows, including firewall rules and access restrictions on a regular basis.
    • Our WiFi internal corporate LAN is separated from guest Wi-Fi, encrypted by WPA2 – PSK and protected by a complex password.
    • We establish a vulnerability and patch management process for our systems which includes technical vulnerability assessments, patch testing, patch deployment and verification.
14. Encryption
    • Data in Transit - Any personal Data is encrypted during transmission using up to date versions of TLS (1.2 or higher).
    • Data in Rest - Personal data is stored in encrypted RDS with strong encryption algorithm (RSA 4096 key).
15. Media Handling
    • We implement protections to secure portable storage media from damage, destruction, theft or unauthorized copying.
16. System Availability
    
    • All Dynamic Yield data is stored on AWS which is trusted by thousands of businesses to store and serve their data and services. As Dynamic Yield data is all stored on the cloud (AWS) and nowhere on any proprietary physical servers, there is no risk of any disaster affecting Dynamic Yield’s ability to maintain business continuity or data completeness.
    • We perform backups, which are tested regularly.
    • Architecture which eliminates single points of failure, both with regards to AWS based production and relevant Dynamic Yield critical supporting resources, up to and including full disaster recovery.
    • We have sophisticated internal procedures including release control and approvals, following security best practices.
    • We established a business continuity plan that enables the company to respond quickly and remain resilient in the event of most failure modes, including natural disasters and system failures
17. Incident Response
    
    • To ensure effective and orderly response to incidents pertaining to personal data, we defined an incident response plan with detailed procedures.
    • The incident response plan includes a list of possible mitigation actions and clear assignment of roles.
    • In the event of a security breach, Dynamic Yield will notify customers without undue delay after becoming aware of the security breach.
18. Documentation
    
    • Emphasis is placed on documentation, to support the processes and procedures noted in this document and to enable audit should the need arise, in keeping with regulatory dictates and best practices.
19. Compliance
    
    • Dynamic Yield conducts regular internal and external audits of its security, led by the CISO.
    • Dynamic Yield has appointed a Data Privacy Officer responsible for overseeing the implementation of the privacy program at Dynamic Yield.
20. Summary
    
    • We are committed to confidentiality, data privacy and security of our customers and their end-users. We are investing and will continue to invest extensive resources towards maintaining the highest levels of data protection, privacy and security standards. We are compliant with applicable laws and regulations, and are committed to compliance with the EU GDPR, the CCPA and related guidelines.
    • We cannot guarantee that your information may not be disclosed, accessed, altered or destroyed by breach of any of our industry standard safeguards. No method of transmission over the Internet or electronic storage is full-proof. We cannot guarantee absolute security.
    • Our security measures are constantly evolving to keep up with the changing security landscape, so we may update these measures pages from time to time to reflect these technical and organizational changes. If any security measure changes in a manner detrimental to our customers’ interests, we will notify our customers of such changes.

* Does not apply if it is the contracting entity listed in the Order Form

1. Dynamic Yield acts as a Processor of Customer's Personal Data. Accordingly, the Parties shall be deemed to enter into the Controller to Processor Standard Contractual Clauses (Module Two).
2. This Exhibit D sets out the Parties' agreed interpretation of their respective obligations under Module Two of the Standard Contractual Clauses.
3. The Parties agree that for the purpose of transfer of Personal Data between Dynamic Yield (Data Importer) and the Customer (Data Exporter), the following shall apply:
   1. Clause 7 of the Standard Contractual Clauses is applicable.
   2. In Clause 9, option 2 shall apply. The Data Importer shall inform the Data Exporter of any intended changes to the list of Sub-Processor at least thirty (30) days prior to the engagement of the Sub-Processor. Exhibit C shall be updated accordingly.
   3. In Clause 11, Data Subjects shall not be able to lodge a complaint with an independent dispute resolution body.
   4. In Clause 17, option 1 shall apply. The Parties agree that the clauses shall be governed by the law of Ireland.
   5. In Clause 18(b) the Parties choose the courts of Dublin, Ireland as their choice of forum and jurisdiction.
4. The Parties have completed Annexes I–III above, which are incorporated in the Standard Contractual Clauses by reference.
5. To the extent that Personal Data is transferred from or outside of the UK, the Parties shall be deemed to have entered into the UK Addendum, which is incorporated to this Addendum by reference, and completed as follows: (i) in Table 1, the “exporter” is Customer; the “importer” is Dynamic Yield, their details and signatures are included in the Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are those incorporated into this Agreement as per Section 10.2 of the Addendum.; (iii) in Table 3, “Annex 1A, 1B and 2 to the Approved EU SCCs” are Exhibits A, B and C to the Addendum; and (iv) in Table 4, both the “Importer” and the “Exporter” can terminate the UK Addendum.