PRIVACY & COOKIE POLICY

Last updated: 14 August 2026

1. Who We Are

This Privacy & Cookie Policy explains how Adv Central Ltd ("Adv Central", "we", "us" or "our") collects, uses, stores and protects personal data in connection with the Adv Manager platform and related websites, applications and services (the "Platform").

Adv Central Ltd 24a Aldermans Hill London N13 4PN United Kingdom

General contact: [email protected] Finance and billing contact: [email protected]

Where we process personal data relating to an individual's use of the Platform, Adv Central may act as a data controller. Where customers use the Platform to collect, analyse or process tracking data relating to their own users, customers or traffic, Adv Central will generally act as a data processor on the customer's behalf, subject to the applicable Data Processing Agreement.

2. Scope of This Policy

This Policy applies to:

• visitors to our websites;
• customers and prospective customers;
• administrators and authorised users of customer accounts;
• individuals who communicate with us regarding our services;
• personal data processed in connection with account management, billing, security and support; and
• cookies and similar technologies used on our websites and Platform.

This Policy does not replace any separate Data Processing Agreement entered into between Adv Central and a customer.

3. Information We Collect

Depending on how you use the Platform, we may collect:

Account and business information

• name;
• company name;
• business address;
• job title;
• business email address;
• telephone number;
• login credentials and account identifiers;
• information provided during registration or onboarding.

Billing information

Where you purchase a subscription, we may process information relating to:

• subscription plan;
• billing address;
• invoices;
• payment status;
• transaction identifiers;
• renewal and cancellation information.

Payment card and bank account information may be processed directly by third-party payment providers such as Stripe. We do not generally store full payment card details on our own systems.

Technical information

When you access the Platform, we may collect:

• IP address;
• browser and device information;
• operating system;
• login and authentication information;
• timestamps;
• security and audit logs;
• information relating to errors and system performance.

Platform and usage information

We may collect information regarding:

• features used;
• account activity;
• configuration settings;
• API activity;
• interactions with the Platform;
• support requests;
• technical events required to operate and secure the service.

4. Customer Tracking Data

Customers may use the Platform to track advertising, affiliate and performance-marketing activity.

Depending on the customer's configuration, this may include information such as:

• click identifiers;
• campaign and source identifiers;
• IP addresses;
• approximate geographic information;
• device and browser information;
• timestamps;
• conversion and event information;
• traffic-quality and fraud-related signals;
• impression and click events.

Where such information is processed on behalf of a customer, the customer is generally the data controller and Adv Central acts as a data processor.

The customer is responsible for ensuring that its collection and use of tracking data complies with applicable privacy, data protection, electronic communications, cookie and marketing laws, including providing appropriate notices and obtaining consent where required.

5. How We Use Personal Data

We may use personal data to:

• provide and operate the Platform;
• create and administer customer accounts;
• authenticate users;
• provide customer support;
• process payments and manage subscriptions;
• issue invoices;
• communicate with customers regarding the service;
• maintain security and prevent fraud or abuse;
• monitor and improve the reliability and performance of the Platform;
• diagnose technical problems;
• comply with legal and regulatory obligations;
• enforce our contractual rights; and
• protect our legitimate business interests.

We will not use customer tracking data for our own unrelated marketing or commercial purposes unless otherwise agreed with the customer or permitted by applicable law.

6. Legal Bases

Depending on the circumstances, we may process personal data on the following legal bases:

• performance of a contract;
• compliance with a legal obligation;
• legitimate interests;
• consent, where consent is required; and
• other lawful bases available under applicable data protection legislation.

Where processing is based on consent, consent may be withdrawn at any time, subject to applicable legal and contractual limitations.

7. Cookies and Similar Technologies

Our websites and Platform may use cookies and similar technologies.

Strictly necessary technologies

We may use technologies that are necessary to:

• authenticate users;
• maintain secure sessions;
• remember essential account settings;
• protect the Platform against abuse;
• maintain security;
• provide requested functionality.

These technologies are necessary for the operation of the Platform.

Analytics and optional technologies

Where we use non-essential cookies or similar technologies for analytics, advertising, personalisation or other optional purposes, we will provide appropriate information and, where legally required, obtain consent before using them.

We may also use third-party services that place or access cookies or similar technologies. Details of these services and their purposes may be provided through our cookie management interface or cookie notice.

8. Tracking Features Provided to Customers

The Platform may provide customers with features including click tracking, conversion tracking, impression tracking, traffic analysis and fraud detection.

Adv Central provides these features as technical functionality of the Platform. The customer remains responsible for configuring and using such features lawfully.

Where the Platform permits the collection of IP addresses or other technical identifiers, customers are responsible for determining the appropriate legal basis, retention period and information to be provided to their own users.

9. Sharing Personal Data

We may share personal data with:

• payment service providers;
• hosting and cloud infrastructure providers;
• security and fraud-prevention providers;
• analytics and technical service providers;
• professional advisers, including accountants, auditors and lawyers;
• governmental authorities where legally required; and
• other service providers acting on our behalf.

Where third parties process personal data on our behalf, we will take appropriate steps to ensure that suitable contractual and security safeguards are in place.

10. International Transfers

Some of our service providers may process data outside the United Kingdom.

Where personal data is transferred internationally, we will use appropriate safeguards required by applicable data protection legislation, which may include adequacy regulations, international data transfer agreements, standard contractual clauses or other legally recognised mechanisms.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to:

• provide the Platform;
• maintain business and accounting records;
• comply with legal obligations;
• resolve disputes;
• enforce agreements; and
• prevent fraud and abuse.

Retention periods may vary depending on the type of information and the purpose for which it is processed.

Customers remain responsible for defining appropriate retention periods for personal data processed through the Platform on their behalf, subject to the applicable Data Processing Agreement.

12. Data Security

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• other unlawful or unauthorised processing.

No internet-based service can be guaranteed to be completely secure, and customers are responsible for maintaining the confidentiality of their account credentials.

13. Your Rights

Subject to applicable law, individuals may have rights including:

• access to their personal data;
• correction of inaccurate data;
• deletion of personal data;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent; and
• rights relating to automated decision-making and profiling where applicable.

Requests may be submitted to [email protected].

Where Adv Central processes information solely on behalf of a customer, requests may need to be directed to the relevant customer as the data controller.

14. Complaints

If you have concerns regarding our processing of your personal data, please contact us first at [email protected].

You may also have the right to lodge a complaint with the applicable data protection supervisory authority, including the UK Information Commissioner's Office (ICO).

15. Changes to This Policy

We may update this Policy from time to time to reflect changes to our services, technology or legal obligations.

The updated version will be made available through our website or Platform.

16. Contact

Adv Central Ltd 24a Aldermans Hill London N13 4PN United Kingdom

Email: [email protected] Finance: [email protected]

GENERAL TERMS & CONDITIONS

Last updated: 14 August 2026

1. Definitions

In these Terms:

"Adv Central", "we", "us" or "our" means Adv Central Ltd, 24a Aldermans Hill, London N13 4PN, United Kingdom.

"Customer", "you" or "your" means the company or legal entity subscribing to or using the Platform.

"Platform" means the Adv Manager tracking, analytics, traffic intelligence and related software services made available by Adv Central.

"Subscription" means the paid subscription selected by the Customer.

"Authorised User" means an individual authorised by the Customer to access the Platform.

"Customer Data" means data submitted, uploaded, transmitted or processed by the Customer through the Platform.

2. Acceptance

These Terms govern the Customer's access to and use of the Platform.

By creating an account, accessing the Platform or subscribing to a paid plan, the Customer confirms that it has read and accepted these Terms and the Privacy & Cookie Policy.

If the Customer is entering into these Terms on behalf of a company or other legal entity, the person accepting these Terms confirms that they have authority to bind that entity.

3. The Platform

Adv Central provides software for tracking, analysing and managing digital advertising and performance-marketing activity.

Depending on the selected plan, the Platform may include:

• click and conversion tracking;
• impression tracking;
• traffic-quality analysis;
• fraud detection;
• campaign management;
• reporting and analytics;
• APIs and integrations;
• targeting functionality;
• affiliate management tools;
• AI-powered analysis and automation features; and
• other features made available from time to time.

Features available to the Customer depend on the applicable Subscription plan.

4. Account and Security

The Customer is responsible for:

• providing accurate registration information;
• maintaining the confidentiality of account credentials;
• restricting access to authorised users;
• ensuring that Authorised Users comply with these Terms; and
• notifying Adv Central promptly of any unauthorised access.

The Customer is responsible for all activity carried out through its account unless caused by a proven security failure attributable to Adv Central.

5. Subscription

Access to paid features requires an active Subscription.

The Subscription period may be monthly or annual, depending on the plan selected at checkout.

Subscription fees are payable in accordance with the pricing displayed at the time of purchase or otherwise agreed in writing.

Unless otherwise stated, fees are exclusive of applicable taxes, VAT and similar charges.

6. Automatic Renewal

Subscriptions automatically renew for the same period unless cancelled before the applicable renewal date.

For annual subscriptions, Adv Central intends to provide a renewal reminder approximately 30 days before the renewal date.

For monthly subscriptions, Adv Central intends to provide a renewal reminder approximately 15 days before the renewal date.

The Customer may cancel its Subscription before the renewal date in accordance with the cancellation procedure provided by Adv Central.

Cancellation does not automatically entitle the Customer to a refund for the current billing period unless otherwise required by law or expressly agreed by Adv Central.

7. Payment

Payments may be processed through third-party payment providers, including Stripe.

Depending on the payment method made available, the Customer may pay by:

• credit or debit card;
• Direct Debit or other supported bank debit method;
• bank transfer, where specifically made available or agreed; or
• other payment methods offered by Adv Central.

Payment information may be collected and processed directly by the relevant payment provider.

Where a recurring payment method is authorised, the Customer authorises Adv Central and/or its payment provider to collect applicable Subscription fees on the relevant renewal dates.

8. Failed Payments

If a recurring payment fails, Adv Central may:

• request another payment attempt;
• contact the Customer regarding the failed payment;
• restrict access to paid features;
• suspend the account; or
• terminate the Subscription if payment remains outstanding.

The Customer remains responsible for all valid fees incurred before termination.

9. Cancellation

The Customer may cancel its Subscription in accordance with the cancellation procedure made available through the Platform or by contacting Adv Central.

Unless otherwise agreed, cancellation will take effect at the end of the current paid Subscription period.

Adv Central does not generally provide refunds for unused portions of a Subscription period, except where required by applicable law or expressly agreed in writing.

10. Acceptable Use

The Customer must not use the Platform:

• for unlawful purposes;
• to violate applicable privacy or data protection laws;
• to distribute malicious software;
• to conduct fraudulent activities;
• to interfere with the security or operation of the Platform;
• to attempt to gain unauthorised access to systems or accounts;
• to reverse engineer the Platform except where such restriction is prohibited by law;
• to circumvent usage limits or technical restrictions; or
• in any manner that may materially harm Adv Central, its infrastructure or other customers.

11. Customer Responsibilities

The Customer is responsible for ensuring that its use of the Platform complies with all applicable laws and regulations.

This includes, where applicable:

• privacy and data protection laws;
• cookie and tracking requirements;
• electronic marketing laws;
• advertising regulations;
• affiliate marketing rules;
• consumer protection legislation; and
• sector-specific regulations.

The Customer is responsible for obtaining any consent, providing any notice and maintaining any legal documentation required for its own use of tracking and advertising technologies.

12. Customer Data

The Customer retains ownership of Customer Data.

The Customer grants Adv Central a limited right to process Customer Data solely as necessary to provide, maintain, secure and improve the Platform and to fulfil its contractual obligations.

Where Adv Central processes personal data on behalf of the Customer, the parties' obligations will also be governed by the applicable Data Processing Agreement.

13. Aggregated and Technical Data

Adv Central may generate aggregated, statistical and technical information relating to the operation, performance, reliability and security of the Platform.

Where such information is genuinely aggregated or anonymised so that it cannot reasonably be used to identify an individual or Customer, Adv Central may use such information for purposes including:

• service improvement;
• security;
• analytics;
• product development;
• benchmarking; and
• business planning.

14. Intellectual Property

The Platform, including its software, source code, interfaces, design, documentation, trademarks and underlying technology, is owned by or licensed to Adv Central.

The Customer receives a limited, non-exclusive, non-transferable and revocable right to use the Platform during the Subscription period.

No ownership rights in the Platform are transferred to the Customer.

15. AI Features

Certain features may use artificial intelligence or machine-learning technologies.

AI-generated outputs may contain errors or inaccuracies and should not be considered a substitute for professional judgment.

The Customer remains responsible for reviewing and validating AI-generated recommendations, analyses or actions before relying on them where appropriate.

16. Third-Party Services

The Platform may integrate with third-party services, APIs, advertising networks, affiliate networks, payment providers or other external systems.

Adv Central is not responsible for the availability, performance, security, policies or actions of third-party services that are outside Adv Central's reasonable control.

17. Availability

Adv Central will use commercially reasonable efforts to maintain the availability and functionality of the Platform.

Temporary interruptions may occur due to maintenance, upgrades, security incidents, infrastructure failures, third-party outages or circumstances beyond Adv Central's reasonable control.

Any specific service-level commitments will apply only where expressly agreed in writing.

18. No Guarantee of Performance

The Platform provides tracking, analysis and optimisation tools.

Adv Central does not guarantee:

• a specific number of clicks;
• conversions;
• leads;
• revenue;
• advertising performance;
• fraud prevention in every circumstance; or
• any particular commercial result.

19. Suspension and Termination

Adv Central may suspend or terminate access where:

• fees remain unpaid;
• the Customer materially breaches these Terms;
• the Customer uses the Platform unlawfully;
• the Customer creates a material security risk;
• the Customer attempts to abuse or compromise the Platform; or
• suspension is reasonably necessary to protect Adv Central, its infrastructure or other customers.

Where reasonably practicable, Adv Central will provide notice before suspension or termination.

20. Limitation of Liability

To the maximum extent permitted by law, Adv Central will not be liable for indirect, incidental, special or consequential losses, including loss of profits, revenue, business opportunities, goodwill or anticipated savings.

Adv Central's aggregate liability arising out of or in connection with the Platform will be limited to the total Subscription fees paid by the Customer to Adv Central during the 12 months preceding the event giving rise to the claim, except where a different limitation is required by applicable law.

Nothing in these Terms excludes or limits liability that cannot legally be excluded or limited.

21. Indemnity

The Customer agrees to indemnify Adv Central against third-party claims, losses, liabilities and reasonable costs arising from:

• unlawful use of the Platform by the Customer;
• violation of applicable law by the Customer;
• Customer Data;
• the Customer's advertising campaigns; or
• infringement of third-party rights caused by Customer Data or Customer content,

except to the extent caused by Adv Central's own breach, negligence or wilful misconduct.

22. Confidentiality

Each party agrees to keep confidential information received from the other party confidential and to use it only for purposes connected with the business relationship.

This obligation does not apply to information that is publicly available, independently developed or required to be disclosed by law.

23. Changes to the Platform

Adv Central may modify, improve, add or remove features from the Platform from time to time.

Material changes to paid functionality will be handled in accordance with applicable contractual and legal requirements.

24. Changes to These Terms

Adv Central may update these Terms from time to time.

Where changes materially affect the Customer's rights or obligations, Adv Central may provide reasonable notice through the Platform or by email.

Continued use of the Platform following the effective date of updated Terms constitutes acceptance where legally permitted.

25. Governing Law

These Terms and any dispute arising out of or in connection with them shall be governed by the laws of England and Wales, unless mandatory applicable law provides otherwise.

The courts of England and Wales shall have jurisdiction over disputes arising from these Terms, subject to any mandatory rights or jurisdiction that cannot legally be excluded.

26. Contact

Adv Central Ltd 24a Aldermans Hill London N13 4PN United Kingdom

Email: [email protected] Finance: [email protected]

SUBSCRIPTION & BILLING TERMS

Last updated: 14 August 2026

1. Subscription Plans

Adv Central Ltd ("Adv Central") offers paid subscriptions to the Adv Manager Platform on a monthly or annual basis.

The applicable price, features, usage limits and billing frequency are displayed to the Customer before the Subscription is purchased.

By completing the purchase, the Customer confirms that it has reviewed and accepted the applicable pricing and Subscription terms.

2. Billing Frequency

The Customer may select:

• a Monthly Subscription, billed every month; or
• an Annual Subscription, billed once every 12 months.

The applicable Subscription period begins on the date the first payment is successfully processed, unless otherwise stated in the order or subscription confirmation.

3. Automatic Renewal

Subscriptions are automatically renewed at the end of each Subscription period for a further period of the same duration unless cancelled before the renewal date.

For an Annual Subscription, Adv Central intends to send a renewal reminder approximately 30 days before the renewal date.

For a Monthly Subscription, Adv Central intends to send a renewal reminder approximately 15 days before the renewal date.

The reminder may include the applicable renewal amount, renewal date and instructions for cancellation.

4. Authorisation of Recurring Payments

By selecting a recurring payment method, the Customer authorises Adv Central and/or its payment service provider to charge the applicable Subscription fees on each renewal date.

Recurring payments may be processed by Stripe or another payment provider selected by Adv Central.

The Customer is responsible for ensuring that the selected payment method remains valid and authorised.

Stripe processes payments on behalf of businesses and cancellation of a subscription is generally handled directly with the business rather than with Stripe.

5. Payment Methods

Depending on availability, Adv Central may accept:

• credit cards;
• debit cards;
• Direct Debit or other bank debit methods supported by the payment provider;
• bank transfers; and
• other payment methods expressly offered at checkout.

Bank transfer payments may be subject to separate instructions and may not support automatic recurring collection unless expressly agreed.

6. Taxes

Prices displayed by Adv Central may exclude VAT or other applicable taxes unless expressly stated otherwise.

The Customer is responsible for any applicable taxes arising from its purchase, except taxes imposed on Adv Central's income.

Where required, Adv Central will apply VAT or other applicable taxes in accordance with the relevant tax rules.

7. Payment Failures

If a recurring payment fails, Adv Central or its payment provider may attempt to collect the outstanding amount again.

Adv Central may also notify the Customer of the failed payment and request an alternative payment method.

If payment remains outstanding, Adv Central may restrict or suspend access to paid features until the outstanding balance has been settled.

8. Cancellation

The Customer may cancel a Subscription before the next renewal date.

For practical purposes, Customers should submit cancellation requests:

• at least 15 days before the renewal date for Monthly Subscriptions; and
• at least 30 days before the renewal date for Annual Subscriptions.

Where cancellation is received after the applicable notice period, Adv Central may be unable to prevent the next scheduled renewal.

Cancellation normally takes effect at the end of the current paid Subscription period.

9. Refunds

Subscription fees are generally non-refundable once a Subscription period has commenced, except where:

• required by applicable law;
• Adv Central expressly agrees otherwise; or
• the Customer has been charged in error.

Cancellation does not automatically create a right to a refund for the unused portion of the current Subscription period.

10. Price Changes

Adv Central may change Subscription prices from time to time.

Price changes will not normally apply to an already-paid Subscription period.

Where a price change affects a future renewal, Adv Central will provide reasonable notice before the new price becomes effective.

The Customer may cancel the Subscription before the renewal at the new price, subject to the applicable cancellation terms.

11. Downgrades and Upgrades

Where the Platform permits changes between Subscription plans:

• an upgrade may take effect immediately or at the next billing cycle, depending on the applicable plan;
• a downgrade may take effect at the next renewal date unless otherwise agreed;
• differences in price may be calculated according to the applicable billing configuration.

Specific upgrade and downgrade rules may be displayed within the Platform.

12. Chargebacks and Payment Disputes

The Customer agrees to contact Adv Central before initiating a payment dispute or chargeback where the issue can reasonably be resolved directly.

Unauthorised or unjustified chargebacks may result in suspension of the Customer's account while the matter is investigated.

This does not limit any rights the Customer has under applicable law.

13. Invoices and Billing Information

Adv Central may provide invoices electronically.

The Customer is responsible for providing accurate billing information, including:

• legal company name;
• registered/business address;
• VAT or tax identification number where applicable; and
• billing contact details.

14. Suspension for Non-Payment

Where Subscription fees remain unpaid, Adv Central may suspend access to the Platform after providing reasonable notice where practicable.

Suspension does not cancel amounts already due.

Access may be restored after payment of outstanding amounts, subject to any applicable reactivation requirements.

15. Relationship with General Terms

These Subscription & Billing Terms form part of the Adv Central General Terms & Conditions.

In the event of a conflict concerning payment, billing, renewal or cancellation, these Subscription & Billing Terms shall apply to those matters.

All other provisions of the General Terms & Conditions remain applicable.

16. Contact

For commercial and subscription matters:

Adv Central Ltd 24a Aldermans Hill London N13 4PN United Kingdom

Sales: [email protected] Finance & Billing: [email protected]

DATA PROCESSING AGREEMENT

Last updated: 14 August 2026

This Data Processing Agreement ("DPA") forms part of the agreement between:

Adv Central Ltd, a company incorporated in the United Kingdom, with registered address at:

24a Aldermans Hill London N13 4PN United Kingdom

("Adv Central", "we", "us" or "Processor")

and

the company or legal entity subscribing to and using the Adv Manager Platform

("Customer" or "Controller").

Adv Central and the Customer are each a "Party" and together the "Parties".

1. Purpose and Scope

This DPA governs the processing of Personal Data by Adv Central on behalf of the Customer in connection with the Customer's use of the Adv Manager tracking, analytics, traffic intelligence and related services (the "Services").

This DPA applies where the Customer acts as a data controller and Adv Central processes Personal Data on the Customer's behalf as a data processor.

This DPA forms part of the General Terms & Conditions governing the Customer's use of the Services.

2. Definitions

For the purposes of this DPA:

"Applicable Data Protection Law" means applicable laws and regulations relating to the protection of Personal Data, including the UK GDPR and, where applicable to the processing, the EU General Data Protection Regulation ("EU GDPR") and applicable national implementing legislation.

"Controller" means the legal entity that determines the purposes and means of the processing of Personal Data.

"Processor" means the legal entity that processes Personal Data on behalf of the Controller.

"Personal Data" means information relating to an identified or identifiable natural person, as defined by Applicable Data Protection Law.

"Processing" has the meaning given to it under Applicable Data Protection Law.

"Data Subject" means an identified or identifiable individual to whom Personal Data relates.

"Sub-Processor" means any third party appointed by Adv Central to process Personal Data on behalf of the Customer.

3. Roles of the Parties

For Customer Data processed through the Services on the Customer's behalf:

• the Customer acts as the Controller; and
• Adv Central acts as the Processor.

The Customer determines the purposes and means of the processing of Customer Personal Data.

Adv Central will process Customer Personal Data only in accordance with the Customer's documented instructions, except where processing is required by applicable law.

If Adv Central is required by law to process Personal Data other than in accordance with the Customer's instructions, Adv Central will, where legally permitted, inform the Customer of that requirement before carrying out the relevant processing.

4. Subject Matter and Duration

4.1 Subject Matter

The subject matter of the processing is the provision of the Services, including:

• tracking and attribution of digital advertising activity;
• click and conversion tracking;
• traffic analysis;
• fraud and traffic-quality analysis;
• campaign reporting;
• affiliate and source management;
• API and integration services;
• analytics;
• technical support;
• account administration; and
• other functionality requested or configured by the Customer.

4.2 Duration

Processing will continue for the duration of the Customer's use of the Services and for any additional period required to comply with the Customer's documented instructions or applicable law.

Following termination of the Services, Personal Data will be deleted or returned in accordance with Section 13 of this DPA.

5. Nature and Purpose of Processing

Adv Central may process Personal Data for the following purposes:

• providing the Services;
• storing and transmitting Customer Data;
• tracking clicks, conversions and other events configured by the Customer;
• analysing traffic quality;
• detecting potentially fraudulent or automated traffic;
• generating reports and analytics;
• providing technical support;
• maintaining security;
• preventing abuse;
• troubleshooting;
• maintaining service availability and performance; and
• complying with applicable legal obligations.

Adv Central will not use Customer Personal Data for its own independent advertising, marketing or unrelated commercial purposes unless otherwise agreed with the Customer or permitted by Applicable Data Protection Law.

6. Categories of Personal Data

Depending on the Customer's configuration and use of the Services, Personal Data may include:

• IP addresses;
• approximate geographic location;
• device information;
• browser and operating system information;
• timestamps;
• click identifiers;
• campaign identifiers;
• affiliate identifiers;
• source identifiers;
• conversion identifiers;
• landing page and referral information;
• technical event information;
• pseudonymous identifiers;
• online identifiers; and
• other information submitted or generated through the Services by the Customer.

The Customer is responsible for ensuring that it does not intentionally submit Special Category Data or other highly sensitive Personal Data to the Services unless expressly agreed with Adv Central in writing and appropriate safeguards have been established.

7. Categories of Data Subjects

Depending on the Customer's use of the Services, Data Subjects may include:

• website visitors;
• advertising recipients;
• customers and prospective customers;
• leads;
• affiliate traffic users;
• campaign participants;
• users interacting with advertising campaigns;
• employees or representatives of the Customer; and
• other individuals whose Personal Data is processed by the Customer through the Services.

8. Customer Responsibilities

The Customer is responsible for:

• determining the lawful purposes and means of processing;
• ensuring that it has a valid legal basis for processing Personal Data;
• providing appropriate privacy notices to Data Subjects;
• obtaining consent where required;
• complying with applicable cookie, tracking and electronic communications legislation;
• ensuring that tracking technologies are configured lawfully;
• responding to Data Subject requests where required;
• carrying out Data Protection Impact Assessments where required;
• maintaining appropriate records of processing activities where required; and
• providing Adv Central with lawful and documented processing instructions.

The Customer must not instruct Adv Central to process Personal Data in a manner that violates Applicable Data Protection Law.

9. Processing on Documented Instructions

Adv Central will:

• process Personal Data only on documented instructions from the Customer;
• ensure that its personnel authorised to process Personal Data are bound by confidentiality obligations;
• process Personal Data only for the purposes specified in this DPA, the General Terms & Conditions, the Customer's configuration of the Services and other documented instructions; and
• inform the Customer if, in Adv Central's reasonable opinion, an instruction infringes Applicable Data Protection Law, unless prohibited by law from doing so.

Instructions may be provided through the Platform, written communications, configuration settings, account documentation or other documented means.

10. Confidentiality

Adv Central will ensure that persons authorised to process Customer Personal Data:

• access Personal Data only where necessary to perform their role;
• are subject to appropriate confidentiality obligations; and
• receive appropriate instructions regarding the handling of Personal Data.

11. Security Measures

Adv Central will implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the nature of the processing, such measures may include:

• access controls and authentication;
• role-based access restrictions;
• encryption in transit;
• appropriate encryption or protection of stored data;
• pseudonymisation where appropriate;
• logging and monitoring;
• network and infrastructure security;
• vulnerability management;
• backup and recovery procedures;
• incident response procedures;
• secure development practices;
• access limitation based on business need;
• employee confidentiality obligations; and
• regular review of security measures.

Adv Central may update its security measures from time to time provided that such changes do not materially reduce the overall level of protection provided to Customer Personal Data.

12. Sub-Processors

The Customer provides Adv Central with general authorisation to engage Sub-Processors for the purpose of providing the Services.

Adv Central will:

• maintain a list of relevant Sub-Processors;
• ensure that Sub-Processors are contractually bound to obligations providing an appropriate level of protection for Personal Data;
• remain responsible for the performance of its Sub-Processors to the extent required by Applicable Data Protection Law; and
• inform the Customer of intended changes to the Sub-Processor list where required by Applicable Data Protection Law.

The Customer may object to the appointment of a new Sub-Processor on reasonable data protection grounds.

Where the Customer objects to a Sub-Processor and the Parties cannot reasonably resolve the objection, Adv Central may, where commercially and technically feasible, provide an alternative solution or allow the Customer to terminate the affected Services in accordance with the applicable contractual terms.

13. Data Subject Rights

Taking into account the nature of the processing, Adv Central will provide reasonable assistance to the Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

Such rights may include:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability; and
• other rights applicable under the relevant legislation.

Where Adv Central receives a Data Subject request relating to Customer Personal Data, Adv Central will, where legally permitted, refer the request to the Customer rather than responding independently.

Adv Central will not disclose Customer Personal Data to a Data Subject unless instructed by the Customer or required by law.

14. Personal Data Breaches

Adv Central will maintain appropriate procedures for detecting, investigating and responding to Personal Data breaches.

If Adv Central becomes aware of a Personal Data breach affecting Customer Personal Data, it will notify the Customer without undue delay after becoming aware of the breach.

Where reasonably available, the notification will include:

• the nature of the breach;
• categories of data and Data Subjects affected;
• likely consequences;
• measures taken or proposed to address the breach; and
• relevant contact information.

Adv Central will provide reasonable cooperation and assistance to enable the Customer to meet its obligations concerning notification of Personal Data breaches.

15. Data Protection Impact Assessments

Taking into account the nature of the processing and information available to Adv Central, Adv Central will provide reasonable assistance to the Customer with Data Protection Impact Assessments and consultations with supervisory authorities where required by Applicable Data Protection Law.

The Customer remains responsible for determining whether a DPIA is required and for carrying out the DPIA.

16. International Data Transfers

Adv Central will not transfer Customer Personal Data to a country outside the United Kingdom where such transfer constitutes a restricted transfer under Applicable Data Protection Law unless an appropriate legal transfer mechanism is in place.

Depending on the circumstances, such safeguards may include:

• an adequacy decision or adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• another legally recognised transfer mechanism; or
• another lawful basis permitted by Applicable Data Protection Law.

Where required, the Parties will cooperate in implementing appropriate transfer safeguards.

17. Return and Deletion of Personal Data

At the end of the Customer's use of the Services, the Customer may request:

• return of Customer Personal Data; or
• deletion of Customer Personal Data.

Adv Central will comply with the Customer's choice unless applicable law requires retention.

Following deletion, Adv Central will not continue to process the relevant Personal Data except where required by law.

Backup copies may remain temporarily in secure backup systems where immediate deletion is technically impracticable. Such data will be protected from active use and deleted in accordance with Adv Central's applicable backup retention cycle.

18. Audits and Compliance Information

Adv Central will provide the Customer with information reasonably necessary to demonstrate compliance with its obligations under this DPA.

Where required by Applicable Data Protection Law, Adv Central will permit reasonable audits or inspections by the Customer or an independent auditor appointed by the Customer.

Audits must:

• be conducted on reasonable prior notice;
• take place during normal business hours;
• minimise disruption to Adv Central's operations and other customers;
• be subject to appropriate confidentiality obligations; and
• not expose information relating to other customers or Adv Central's confidential security arrangements.

The Customer will bear its own audit costs unless the audit identifies a material breach of this DPA by Adv Central.

19. Customer Data Ownership

The Customer retains all rights, title and interest in Customer Personal Data.

Nothing in this DPA transfers ownership of Customer Personal Data to Adv Central.

Adv Central receives only the rights necessary to process Personal Data in accordance with this DPA and the Customer's documented instructions.

20. Aggregated and Anonymised Data

Adv Central may create aggregated or anonymised information from Customer Data for purposes such as:

• service improvement;
• security;
• fraud prevention;
• product development;
• performance analysis;
• benchmarking; and
• statistical reporting.

Adv Central will only use information under this section where it has been processed so that it no longer constitutes Personal Data under Applicable Data Protection Law.

Adv Central will not use Customer Personal Data to create identifiable profiles of individuals for its own unrelated commercial purposes.

21. Assistance and Cooperation

Each Party will reasonably cooperate with the other to facilitate compliance with Applicable Data Protection Law.

The Customer acknowledges that certain assistance may require additional reasonable fees where it involves substantial custom work outside the standard functionality of the Services.

22. Liability

The liability of the Parties in relation to this DPA is subject to the liability provisions contained in the General Terms & Conditions, except where Applicable Data Protection Law imposes mandatory liability that cannot be contractually excluded or limited.

Nothing in this DPA excludes or limits liability that cannot legally be excluded or limited.

23. Conflict of Terms

In the event of a conflict between this DPA and the General Terms & Conditions:

• this DPA will prevail with respect to the processing and protection of Customer Personal Data; and
• the General Terms & Conditions will continue to govern all other aspects of the commercial relationship.

24. Duration and Termination

This DPA will remain in force for as long as Adv Central processes Customer Personal Data on behalf of the Customer.

Termination of the Subscription or General Terms & Conditions will not remove either Party's obligations regarding Personal Data that continue after termination.

25. Governing Law

This DPA shall be governed by the laws of England and Wales, unless Applicable Data Protection Law requires otherwise.

The courts of England and Wales shall have jurisdiction over disputes arising under this DPA, subject to any mandatory jurisdictional rights under Applicable Data Protection Law.

26. Contact

For data protection matters:

Adv Central Ltd 24a Aldermans Hill London N13 4PN United Kingdom

Email: [email protected]

Finance and billing matters: [email protected]

Schedule 1 – Details of Processing

Subject Matter

Processing of Personal Data necessary to provide the Adv Manager Platform and associated tracking, analytics, traffic-quality, fraud-detection and reporting functionality.

Duration

For the duration of the Customer's Subscription and any additional period required for legal compliance, security or deletion/backup procedures.

Nature of Processing

Collection, recording, organisation, storage, retrieval, consultation, analysis, transmission, reporting, modification, restriction and deletion, as configured or instructed by the Customer.

Purpose

To provide tracking, attribution, analytics, reporting, traffic-quality analysis, fraud detection, campaign management and related Services.

Categories of Personal Data

Potentially including:

• IP addresses;
• approximate geographic location;
• browser and device information;
• operating system;
• timestamps;
• click identifiers;
• campaign identifiers;
• affiliate/source identifiers;
• conversion identifiers;
• pseudonymous identifiers;
• traffic-quality signals; and
• other technical data configured by the Customer.

Categories of Data Subjects

Potentially including:

• website visitors;
• advertising recipients;
• leads;
• customers and prospective customers;
• affiliate traffic users;
• campaign participants; and
• other individuals whose Personal Data is submitted to or collected through the Services.

Special Categories of Data

The Services are not intended for the processing of Special Category Data unless expressly agreed in writing between the Parties and subject to appropriate safeguards.

Processing Operations

Processing may include collection, storage, analysis, transmission, reporting and deletion of Personal Data through the Platform and its supporting infrastructure.