CONFIDENTIAL — EXECUTED VERSION

CONFIDENTIAL — EXECUTED VERSION
DATA PROCESSING AGREEMENT
Between
Aurelius Global Media Group PLC
and
VoltGraph Analytics GmbH
Dated 8 April 2024
Entered into pursuant to Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation)
Calderwood & Harkness LLP Matter No. 1017-00008
Right-click to update Table of Contents
PREAMBLE AND PARTIES
THIS DATA PROCESSING AGREEMENT (this "DPA") is made on 8 April 2024
BETWEEN:
(1) Aurelius Global Media Group PLC, a public limited company incorporated under the laws of England and Wales (registered number 08741562), whose registered office is at 140 Threadneedle Row, London EC2R 8AH, United Kingdom (the "Controller" or "AGMG"); and
(2) VoltGraph Analytics Gesellschaft mit beschränkter Haftung, a limited liability company organised under the laws of the Federal Republic of Germany (registered at the Handelsregister of the Amtsgericht Hamburg under HRB 159742), whose registered office is at Große Elbstraße 44, 22767 Hamburg, Germany (the "Processor" or "VoltGraph"),
each a "Party" and together the "Parties".
WHEREAS:
(A) AGMG is a digital media, entertainment streaming, and e-commerce conglomerate listed on the London Stock Exchange (LSE: AGMG). AGMG operates fourteen (14) European-facing websites and three (3) mobile applications serving audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, with approximately eighty-seven million (87,000,000) monthly active users in the EU/EEA.
(B) VoltGraph provides cross-device tracking and audience segmentation analytics services to AGMG. In connection with those services, VoltGraph deploys server-side tracking pixels on nine (9) of AGMG's fourteen (14) European websites and processes an estimated three hundred and twenty million (320,000,000) unique user profiles per year from AGMG's digital properties.
(C) The Parties have entered into a services agreement with an annual contract value of one million one hundred and fifty thousand euros (€1,150,000) (the "Underlying Agreement"), pursuant to which VoltGraph processes Personal Data on behalf of AGMG as a Processor within the meaning of Article 4(8) of the GDPR.
(D) Following a complaint filed with the Commission nationale de l'informatique et des libertés ("CNIL") by Digitale Rechte Europa e.V. (CNIL Reference: PLT-2023-FR-04821) on 8 November 2023, and a subsequent CNIL formal notice dated 14 December 2023 (CNIL Reference: MED-2023-097), as well as an informal inquiry from the United Kingdom Information Commissioner's Office ("ICO") dated 22 December 2023 (Reference: ICO/ENF/2023/LTR-11084), AGMG undertook a comprehensive remediation of its cookie-consent mechanisms, advertising-technology data flows, and vendor data processing arrangements across all European digital properties.
(E) As part of that remediation programme, AGMG requires that VoltGraph's processing activities comply fully with the GDPR and all other Applicable Data Protection Law, including, without limitation, the implementation of consent-gated pixel firing ensuring that no server-side tracking pixels transmit Personal Data prior to the receipt of valid Data Subject consent, and the permanent and irrecoverable deletion of historical data collected without valid consent during the period of non-compliant pixel deployment.
(F) This DPA is entered into to ensure compliance with Article 28 of the GDPR and to document the Parties' respective rights and obligations in relation to the Processing of Personal Data by VoltGraph on behalf of AGMG. This DPA replaces and supersedes any prior data processing terms, addenda, or arrangements between the Parties relating to the processing of Personal Data.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
SECTION 1: DEFINITIONS AND INTERPRETATION
1.1 Definitions.  In this DPA, unless the context otherwise requires, the following terms shall have the meanings set out below:
"Applicable Data Protection Law" means, collectively: (a) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"); (b) the United Kingdom General Data Protection Regulation, as defined in section 3(10) of the Data Protection Act 2018 (the "UK GDPR"), together with the Data Protection Act 2018; (c) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the "ePrivacy Directive"), as transposed into the national law of each relevant Member State; (d) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) of the United Kingdom (the "PECR"); (e) the French Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as amended (the "Loi Informatique et Libertés"); and (f) any other implementing, supplementary, or successor legislation in force in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy that relates to the processing of personal data or the protection of privacy in the electronic communications sector, in each case as amended, supplemented, or replaced from time to time.
"Brightleaf ConsentShield" means the consent management platform provided by Brightleaf Consent Technologies EU B.V., a private limited liability company incorporated under the laws of the Netherlands (Kamer van Koophandel number 81294503), with its registered office in Amsterdam, the Netherlands. As of the date of this DPA, Brightleaf ConsentShield is deployed across all AGMG European properties and is certified to the Interactive Advertising Bureau Europe Transparency and Consent Framework version 2.2 ("IAB TCF 2.2").
"Consent Signal" means a valid, recorded consent decision transmitted by Brightleaf ConsentShield in accordance with IAB TCF 2.2 specifications, indicating that the relevant Data Subject has provided specific, informed, unambiguous, and affirmative consent for the applicable processing purpose(s) in accordance with Article 6(1)(a) and Article 7 of the GDPR.
"Controller" has the meaning given to it in Article 4(7) of the GDPR.
"Data Protection Impact Assessment" or "DPIA" means an assessment of the impact of processing operations on the protection of Personal Data, as required by Article 35 of the GDPR.
"Data Protection Officer" or "DPO" means, in respect of AGMG, Margaux Fontaine-Li, Group Data Protection Officer; and in respect of VoltGraph, Jana Siebert, Data Protection Officer. Each Party shall promptly notify the other Party in writing of any change to the identity or contact details of its DPO.
"Data Subject" has the meaning given to it in Article 4(1) of the GDPR (being the identified or identifiable natural person to whom Personal Data relates).
"Historical Pixel Data" means all Personal Data collected by VoltGraph through server-side tracking pixels deployed on AGMG's European web properties prior to 2 April 2024 (being the date on which consent-gated pixel firing was implemented across all in-scope AGMG properties), including, without limitation, IP addresses (IPv4 and IPv6), device fingerprints, browsing history, page-view data, audience segmentation profiles, cookie identifiers, and pseudonymised user identifiers, to the extent that such data was transmitted to VoltGraph's systems without a valid Consent Signal having been received from Brightleaf ConsentShield.
"Personal Data" has the meaning given to it in Article 4(1) of the GDPR.
"Personal Data Breach" has the meaning given to it in Article 4(12) of the GDPR.
"Processing" (and "Process", "Processed", and cognate expressions) has the meaning given to it in Article 4(2) of the GDPR.
"Processor" has the meaning given to it in Article 4(8) of the GDPR.
"SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, supplemented, or replaced from time to time.
"Server-Side Tracking Pixel" means a pixel, tag, beacon, or similar tracking technology deployed on AGMG's web properties that transmits Personal Data from the server side (rather than from the user's browser client) to VoltGraph's data collection endpoints and systems.
"Sub-processor" means any third party (including any affiliate or group company of VoltGraph, but excluding employees of VoltGraph) engaged by VoltGraph to carry out specific Processing activities on behalf of the Controller in connection with the services provided under the Underlying Agreement.
"Supervisory Authority" has the meaning given to it in Article 4(21) of the GDPR, and, for the purposes of this DPA, includes the ICO in respect of processing subject to the UK GDPR.
"Transfer Impact Assessment" or "TIA" means a documented assessment of the laws and practices of a third country to which Personal Data is or may be transferred, evaluating whether such laws and practices impinge on the effectiveness of the transfer mechanism in ensuring an essentially equivalent level of protection to that guaranteed within the EEA.
"Underlying Agreement" has the meaning given to it in Recital (C).
1.2 Interpretation.  In this DPA, unless the context otherwise requires:
(a) references to "Articles" are to Articles of the GDPR, unless expressly stated otherwise;
(b) references to "Sections" are to Sections of this DPA, and references to "Annexes" are to the Annexes appended to this DPA, each of which forms an integral part of this DPA;
(c) headings and sub-headings are inserted for convenience of reference only and shall not affect the construction or interpretation of this DPA;
(d) words importing the singular include the plural and vice versa, and words importing one gender include all genders;
(e) references to "writing" or "written" include communication by email, provided that the sender receives confirmation of receipt;
(f) this DPA shall be read and construed in conjunction with the Underlying Agreement; in the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the Underlying Agreement with respect to the Processing of Personal Data, the provisions of this DPA shall prevail to the extent of such conflict or inconsistency;
(g) references to any statute, statutory provision, regulation, or directive shall be construed as a reference to the same as it may have been, or may from time to time be, amended, modified, extended, re-enacted, or replaced; and
(h) a reference to a "person" includes any individual, firm, body corporate, association, partnership, government, state, or agency of a state, or any joint venture, trust, or unincorporated organisation.
SECTION 2: SCOPE AND PURPOSE OF PROCESSING
2.1 Subject Matter and Duration
This DPA governs VoltGraph's Processing of Personal Data in connection with the provision of cross-device tracking and audience segmentation analytics services under the Underlying Agreement. The subject matter of the Processing is the collection, analysis, and segmentation of user behavioural data from AGMG's European digital properties by means of server-side tracking pixel technology, as more fully described in Annex I. The duration of Processing under this DPA is co-terminous with the Underlying Agreement, unless this DPA is terminated earlier in accordance with Section 12 or unless the Parties otherwise agree in writing.
2.2 Nature and Purpose of Processing
The nature and purpose of the Processing carried out by VoltGraph on behalf of AGMG under this DPA is as follows:
(a) cross-device tracking of users across AGMG's European digital properties, enabling the linkage of a single user's activity across multiple devices and browsing sessions;
(b) audience segmentation, involving the classification of users into defined audience segments based on browsing behaviour, content consumption patterns, and inferred interests;
(c) analytics reporting, including the generation of aggregated and, where instructed, pseudonymised audience insights and performance reports for AGMG's internal business use;
(d) support of AGMG's programmatic advertising operations across EU/EEA digital properties, including the provision of audience segmentation data to AGMG for use in demand-side platform integrations and programmatic advertising optimisation; and
(e) the deployment and operation of Server-Side Tracking Pixels on nine (9) of AGMG's fourteen (14) European websites, as identified in the schedule to Annex I.
The Parties acknowledge that all Processing under this DPA is undertaken to support AGMG's programmatic advertising activities, which generate associated revenue. The Parties further acknowledge that the VoltGraph-driven audience segmentation uplift contributes approximately four million euros (€4,000,000) per year to AGMG's advertising revenues, forming part of an estimated twenty-six million three hundred thousand euros (€26,300,000) in annual revenue at risk from non-compliant vendor arrangements. Accordingly, compliance with Applicable Data Protection Law is of critical importance to both Parties.
2.3 Categories of Data Subjects
The categories of Data Subjects whose Personal Data is Processed under this DPA include:
(a) visitors and users of AGMG's European websites on which VoltGraph Server-Side Tracking Pixels are deployed (approximately eighty-seven million (87,000,000) monthly active users across the EU/EEA);
(b) registered users of AGMG's streaming, digital news, and e-commerce platforms who access AGMG's European digital properties; and
(c) users of AGMG's three (3) mobile applications, to the extent that data from such applications is transmitted to or processed by VoltGraph under the Underlying Agreement.
2.4 Types of Personal Data
The types of Personal Data Processed under this DPA include the following:
(a) IP addresses, including both IPv4 and IPv6 addresses;
(b) device fingerprints and device identifiers, including browser type and version, operating system and version, screen resolution, language settings, time zone, and installed browser plugins;
(c) browsing history and page-view data, including URLs visited, pages viewed, time spent on pages, and referral URLs;
(d) audience segmentation profiles and interest categories generated by VoltGraph's analytics algorithms;
(e) cookie identifiers, including first-party and third-party cookie values, and associated consent records;
(f) pseudonymised user identifiers linked to AGMG account data, enabling cross-device user recognition without direct identification; and
(g) consent records, including the consent status, consent timestamp, consent version, and purposes consented to as recorded by Brightleaf ConsentShield.
2.5 Estimated Volume
The estimated volume of Personal Data Processed under this DPA is approximately three hundred and twenty million (320,000,000) unique user profiles per year from AGMG's digital properties. This estimate is based on data volumes observed during the twelve (12) months preceding the date of this DPA and may be subject to variation. The Parties shall review volume estimates on an annual basis and update this Section and Annex I as appropriate.
SECTION 3: CONTROLLER OBLIGATIONS
3.1 Lawfulness of Processing
AGMG, as Controller, shall ensure that it has a valid legal basis under Applicable Data Protection Law for the Processing of Personal Data by VoltGraph under this DPA. The primary legal basis for the Processing of Personal Data through Server-Side Tracking Pixels is consent, obtained from each Data Subject in accordance with Article 6(1)(a) and Article 7 of the GDPR, as transmitted to VoltGraph via a valid Consent Signal from Brightleaf ConsentShield. AGMG warrants and represents that it shall not instruct VoltGraph to Process Personal Data in a manner that would be in breach of Applicable Data Protection Law.
3.2 Instructions.  AGMG shall provide documented instructions to VoltGraph for the Processing of Personal Data. The initial instructions of the Controller are set out in Annex I to this DPA. AGMG may supplement, amend, or replace its documented instructions from time to time by notice in writing to VoltGraph, provided that any such supplemental instructions are consistent with the terms of this DPA and Applicable Data Protection Law. VoltGraph shall not be required to comply with any instruction that, in its reasonable opinion, would cause it to infringe Applicable Data Protection Law, and shall promptly notify AGMG of any such concern.
3.3 Consent Mechanism
AGMG shall maintain and operate compliant consent mechanisms across all European digital properties, utilising Brightleaf ConsentShield (certified to IAB TCF 2.2), ensuring that:
(a) no non-essential cookies are set and no Server-Side Tracking Pixels fire before a Data Subject has provided affirmative consent for the applicable processing purpose(s);
(b) consent banners and interfaces present clear, granular, and easily accessible information to Data Subjects regarding the purposes of processing and the identity of recipients, including VoltGraph;
(c) consent records are maintained and are available for inspection by VoltGraph, Supervisory Authorities, and auditors as required; and
(d) mechanisms for the withdrawal of consent are provided that are as easy to use as the mechanism for giving consent, and that upon withdrawal of consent, a signal is transmitted to VoltGraph to cease Processing in respect of the relevant Data Subject.
SECTION 4: PROCESSOR OBLIGATIONS
4.1 Processing on Instructions
VoltGraph shall Process Personal Data only on and in accordance with the documented instructions of the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless VoltGraph is required to Process by Union or Member State law to which it is subject, in which case VoltGraph shall inform AGMG of that legal requirement before carrying out the Processing, unless that law prohibits such notification on important grounds of public interest, in accordance with Article 28(3)(a) of the GDPR. VoltGraph shall immediately inform AGMG if, in its opinion, an instruction from AGMG infringes the GDPR or other Applicable Data Protection Law.
4.2 Consent-Gated Pixel Firing
With effect from 2 April 2024, VoltGraph shall not fire any Server-Side Tracking Pixel, initiate any collection of Personal Data, or otherwise commence any Processing of Personal Data from AGMG's European digital properties unless and until a valid Consent Signal is received from Brightleaf ConsentShield confirming that the relevant Data Subject has affirmatively consented to the applicable processing purpose(s). Specifically:
(a) VoltGraph shall integrate its pixel deployment systems with the Brightleaf ConsentShield tag manager API to enable real-time, automated verification of Consent signals prior to any data collection event;
(b) VoltGraph's systems shall query the Brightleaf ConsentShield API at the point of pixel activation for each Data Subject session and shall only proceed with pixel firing and data transmission upon receipt of a valid Consent Signal that encompasses the relevant processing purposes assigned to VoltGraph under the IAB TCF 2.2 framework;
(c) in the absence of a valid Consent Signal (including where consent has been refused, withdrawn, or where no consent decision has been recorded), VoltGraph shall suppress all data collection and shall not transmit, receive, or store any Personal Data from the Data Subject's session;
(d) VoltGraph shall maintain comprehensive logs of all consent verification checks performed, including timestamps, Data Subject identifiers (pseudonymised), Consent Signal status, and pixel firing decisions, and shall make such logs available to AGMG for audit purposes upon request; and
(e) VoltGraph shall promptly inform AGMG of any technical failure, degradation, or interruption in the consent verification mechanism, and shall default to suppression of all pixel firing in the event of any such failure, degradation, or interruption until the mechanism is restored and verified.
4.3 Confidentiality.  VoltGraph shall ensure that all persons authorised to Process Personal Data under this DPA, including employees, contractors, and agents, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in accordance with Article 28(3)(b) of the GDPR. VoltGraph shall ensure that access to Personal Data is limited to those persons who require such access for the performance of VoltGraph's obligations under this DPA and the Underlying Agreement.
4.4 Security Measures
VoltGraph shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of Processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, as required by Article 32 of the GDPR. The specific technical and organisational measures that VoltGraph shall implement and maintain are set out in Annex II to this DPA. VoltGraph shall regularly test, assess, and evaluate the effectiveness of such measures and shall update them as necessary to reflect changes in the risk environment, the state of the art, or the requirements of Applicable Data Protection Law.
4.5 Assistance with Data Subject Rights
VoltGraph shall assist AGMG, by appropriate technical and organisational measures and taking into account the nature of the Processing, in fulfilling AGMG's obligations to respond to requests from Data Subjects for the exercise of their rights under Chapter III of the GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right not to be subject to a decision based solely on automated processing, in accordance with Article 28(3)(e) of the GDPR. Without limiting the generality of the foregoing:
(a) VoltGraph shall promptly redirect to AGMG any request received directly from a Data Subject relating to the Processing of Personal Data under this DPA, without responding to the Data Subject directly, unless otherwise instructed by AGMG;
(b) VoltGraph shall notify AGMG without undue delay, and in any event within forty-eight (48) hours, of the receipt of any request from a Data Subject, providing sufficient details of the request to enable AGMG to respond;
(c) VoltGraph shall implement and maintain technical capabilities to enable the retrieval, export, rectification, restriction, and deletion of Personal Data relating to individual Data Subjects in response to AGMG's instructions; and
(d) VoltGraph shall provide such assistance at no additional charge to AGMG, except to the extent that a request is manifestly excessive or requires disproportionate effort, in which case VoltGraph shall notify AGMG of the estimated additional costs before proceeding.
4.6 Assistance with AGMG's Compliance Obligations
VoltGraph shall assist AGMG in ensuring compliance with AGMG's obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the Processing and the information available to VoltGraph, in accordance with Article 28(3)(f) of the GDPR. Such assistance shall include, without limitation, cooperation in relation to the security of processing, the notification of Personal Data Breaches to Supervisory Authorities and Data Subjects, the conduct of Data Protection Impact Assessments, and prior consultation with Supervisory Authorities.
4.7 Cooperation with Supervisory Authorities
VoltGraph shall cooperate, on request from AGMG or directly from a Supervisory Authority, with the CNIL, the ICO, the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), and any other competent Supervisory Authority in the performance of its tasks, in accordance with Article 31 of the GDPR. VoltGraph shall promptly inform AGMG of any contact, inquiry, or investigation initiated by a Supervisory Authority that relates to the Processing of Personal Data under this DPA, unless prohibited from doing so by applicable law.
SECTION 5: HISTORICAL PIXEL DATA — DELETION OBLIGATIONS
5.1 Identification of Historical Pixel Data
The Parties acknowledge and agree that, prior to 2 April 2024, VoltGraph deployed Server-Side Tracking Pixels on nine (9) of AGMG's fourteen (14) European websites. The Parties further acknowledge that certain of these pixels — specifically, twelve (12) of nineteen (19) unique Server-Side Tracking Pixels identified during the comprehensive cookie audit conducted between 22 January 2024 and 16 February 2024 by Thistlewood Consulting Ltd (acting under the direction of Calderwood & Harkness LLP) — transmitted Personal Data, including IP addresses, device fingerprints, browsing history, and audience segmentation profiles, to VoltGraph's data collection endpoints and systems without a valid Data Subject consent having been obtained or recorded in accordance with Applicable Data Protection Law.
The Historical Pixel Data encompasses Personal Data relating to approximately three hundred and twenty million (320,000,000) unique user profiles per year collected during the period of non-compliant pixel deployment. The precise scope and volume of Historical Pixel Data shall be determined by VoltGraph, in consultation with AGMG, as part of the data mapping exercise to be completed by VoltGraph within thirty (30) days of the date of this DPA.
5.2 Deletion Requirements
VoltGraph shall permanently and irrecoverably delete all Historical Pixel Data from its systems within ninety (90) days of the date of this DPA (that is, by no later than 7 July 2024). For the avoidance of doubt, the deletion obligation extends to all copies of Historical Pixel Data, wherever stored, including, without limitation:
(a) all active production databases and data stores;
(b) all backup systems, including incremental and full backups;
(c) all disaster recovery systems and replicated environments;
(d) all data archives, data warehouses, and data lakes;
(e) all log files and analytics outputs that contain or are derived from Historical Pixel Data; and
(f) all systems, environments, and storage media maintained by VoltGraph's Sub-processors that hold or have processed Historical Pixel Data.
VoltGraph shall employ deletion methods that render the data permanently irrecoverable, including, where appropriate, cryptographic erasure, secure overwrite, or physical destruction of storage media. VoltGraph shall ensure that any Sub-processors who received or processed Historical Pixel Data also permanently and irrecoverably delete such data within the same ninety (90) day period, in accordance with Section 6.5 of this DPA.
5.3 Certification of Deletion
Upon completion of the deletion of all Historical Pixel Data from VoltGraph's systems and those of its Sub-processors, and in any event no later than 7 July 2024, VoltGraph shall provide AGMG with a written certificate of deletion, signed by both Dr. Kai-Henrik Möller, Managing Director of VoltGraph, and Jana Siebert, DPO of VoltGraph. The certificate shall include, at a minimum:
(a) a description of the categories of Personal Data deleted;
(b) an identification of the systems, databases, backups, archives, and storage media from which data was deleted;
(c) the method of deletion employed for each system or medium;
(d) the date on which deletion was completed for each system or medium;
(e) confirmation that all Sub-processors holding Historical Pixel Data have also completed deletion, together with copies of or references to the Sub-processors' own deletion certificates; and
(f) a declaration that, to the best of the signatories' knowledge, information, and belief, all Historical Pixel Data has been permanently and irrecoverably deleted and that no copies of such data remain in VoltGraph's or its Sub-processors' custody or control.
5.4 Exceptions.  VoltGraph may retain Historical Pixel Data only to the extent that retention is strictly required by applicable European Union or Member State law (including, for the avoidance of doubt, German federal or state law). Where VoltGraph is required by applicable law to retain any Historical Pixel Data, VoltGraph shall:
(a) promptly inform AGMG of the legal requirement, specifying the relevant provision of law, the categories and volume of data affected, and the required retention period;
(b) ensure that the retained data is stored securely, with access restricted to the minimum number of personnel strictly necessary for compliance with the legal obligation;
(c) not Process the retained data for any purpose other than compliance with the legal obligation; and
(d) delete the retained data promptly upon expiry of the legal retention period and provide AGMG with a supplemental deletion certificate at that time.
SECTION 6: SUB-PROCESSORS
6.1 General Authorisation
AGMG hereby provides VoltGraph with general written authorisation to engage Sub-processors for the purpose of carrying out specific Processing activities on behalf of the Controller in connection with the services provided under the Underlying Agreement, subject to and in accordance with the conditions set out in this Section 6, pursuant to Article 28(2) of the GDPR.
6.2 Current Sub-Processors
The list of Sub-processors approved by AGMG as of the date of this DPA is set out in Annex III. VoltGraph warrants that it has not engaged any Sub-processor to Process Personal Data under the Underlying Agreement other than those listed in Annex III as at the date of this DPA.
6.3 Notification of Changes
VoltGraph shall notify AGMG in writing at least thirty (30) days in advance of any intended addition of a new Sub-processor or replacement of an existing Sub-processor. Such notification shall include the following details in respect of the proposed Sub-processor:
(a) the full legal name and registered address of the proposed Sub-processor;
(b) the jurisdiction of incorporation and the location(s) of Processing;
(c) a description of the Processing activities to be performed by the proposed Sub-processor;
(d) the categories of Personal Data to be processed;
(e) the data transfer mechanism to be used, if the proposed Sub-processor is located outside the EEA or the UK; and
(f) a summary of the data protection and security measures implemented by the proposed Sub-processor.
AGMG shall have the right to object to the appointment of a new or replacement Sub-processor on reasonable data protection grounds by providing written notice to VoltGraph within fourteen (14) days of receipt of the notification referred to above. If AGMG raises such an objection, the Parties shall negotiate in good faith to resolve the objection within a period of thirty (30) days. If the Parties are unable to resolve the objection within such thirty (30) day period, AGMG may terminate this DPA and the Underlying Agreement by written notice to VoltGraph, without penalty and without prejudice to any accrued rights or obligations.
6.4 Flow-Down Obligations
VoltGraph shall impose on each Sub-processor, by way of a written contract, data protection obligations that are no less protective of Personal Data than those set out in this DPA, in accordance with Article 28(4) of the GDPR. In particular, VoltGraph shall ensure that each Sub-processor contract includes obligations relating to the Processing of Personal Data on documented instructions only, confidentiality, security measures, Sub-processor engagement, international data transfers, Personal Data Breach notification, audit rights, and the return or deletion of Personal Data upon termination.
VoltGraph shall remain fully liable to AGMG for the performance of each Sub-processor's obligations. Where a Sub-processor fails to fulfil its data protection obligations, VoltGraph shall be liable to AGMG for the performance of the Sub-processor's obligations as though VoltGraph itself had performed (or failed to perform) them.
6.5 Sub-Processor Deletion of Historical Pixel Data
Without prejudice to the generality of Section 5.2, VoltGraph shall ensure that all Sub-processors who have received, stored, or otherwise Processed Historical Pixel Data permanently and irrecoverably delete such data within the same ninety (90) day period specified in Section 5.2 (that is, by no later than 7 July 2024). VoltGraph shall obtain written confirmation of deletion from each such Sub-processor and shall provide copies of such confirmations to AGMG as part of the certification process described in Section 5.3.
SECTION 7: INTERNATIONAL DATA TRANSFERS
7.1 General Restriction
VoltGraph shall not transfer Personal Data Processed under this DPA to any country outside the European Economic Area ("EEA") or the United Kingdom, or to any international organisation, unless:
(a) VoltGraph has ensured that appropriate safeguards are in place in accordance with Articles 44 to 49 of the GDPR (and, where applicable, the corresponding provisions of the UK GDPR);
(b) VoltGraph has obtained the prior written consent of AGMG to such transfer, including approval of the transfer mechanism and any supplementary measures; and
(c) VoltGraph has conducted and provided to AGMG a Transfer Impact Assessment in accordance with Section 7.3.
7.2 Standard Contractual Clauses
Where a transfer of Personal Data to a third country is necessary for the performance of VoltGraph's obligations under this DPA and the Underlying Agreement, the Parties shall execute the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, using Module 2 (Controller to Processor), or such successor clauses as may be adopted by the European Commission from time to time. The completed SCCs, where applicable, are appended as Annex IV to this DPA.
The Parties acknowledge that, in accordance with Clause 7 of the SCCs, the docking clause is included such that additional controllers or processors may accede to the SCCs with the prior written agreement of all existing parties. The governing law for the SCCs shall be the laws of England and Wales, and the competent supervisory authority shall be the ICO (for UK GDPR transfers) or the CNIL (for GDPR transfers from France), as applicable.
7.3 Transfer Impact Assessment
Prior to any transfer of Personal Data to a third country, VoltGraph shall conduct a Transfer Impact Assessment evaluating:
(a) the laws and practices of the recipient country, with particular reference to any laws requiring disclosure of Personal Data to public authorities or granting public authorities powers of access to Personal Data;
(b) the effectiveness of the transfer mechanism (including the SCCs) in light of the legal framework of the recipient country;
(c) any supplementary measures, whether technical, organisational, or contractual, that are necessary to ensure an essentially equivalent level of protection to that guaranteed within the EEA; and
(d) any relevant guidance or decisions of the European Data Protection Board, the European Commission, or competent Supervisory Authorities.
VoltGraph shall provide AGMG with a copy of each Transfer Impact Assessment upon completion and prior to the commencement of any transfer. VoltGraph shall promptly inform AGMG if it becomes aware of any change in the laws, regulations, or practices of the recipient country that may affect the validity or effectiveness of the transfer mechanism, and the Parties shall consult in good faith to determine whether supplementary measures are required or whether the transfer should be suspended.
7.4 UK International Data Transfer Addendum
For transfers of Personal Data that are subject to the UK GDPR, the Parties shall utilise the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0) issued by the ICO under Section 119A of the Data Protection Act 2018, as may be revised from time to time (the "UK IDTA"), where applicable. The completed UK IDTA, where applicable, is appended as part of Annex IV.
SECTION 8: PERSONAL DATA BREACH NOTIFICATION
8.1 Notification Obligation
VoltGraph shall notify AGMG without undue delay, and in any event within twenty-four (24) hours of becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA, in accordance with Article 28(3)(f) and Article 33 of the GDPR. VoltGraph shall direct such notification to AGMG's DPO (Margaux Fontaine-Li) and Group General Counsel (Sanjay Redworth) using the contact details set out in Section 16.7.
8.2 Content of Notification
The initial notification provided by VoltGraph under Section 8.1 shall include, to the extent such information is available at the time of notification:
(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
(b) the likely consequences of the Personal Data Breach;
(c) a description of the measures taken or proposed to be taken by VoltGraph to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects;
(d) the name and contact details of VoltGraph's DPO (Jana Siebert) or other contact point from whom AGMG can obtain further information; and
(e) any other information that may be required to enable AGMG to fulfil its notification obligations to Supervisory Authorities under Article 33 of the GDPR and to Data Subjects under Article 34 of the GDPR.
Where it is not possible to provide all of the information specified above at the time of the initial notification, VoltGraph shall provide such information in phases without further undue delay.
8.3 Cooperation.  VoltGraph shall cooperate fully with AGMG and provide all reasonable assistance in relation to AGMG's investigation of the Personal Data Breach, mitigation of its effects, and fulfilment of AGMG's obligations to notify Supervisory Authorities and, where required, Data Subjects. Such cooperation shall include the preservation of evidence, the provision of forensic analysis and reporting, and participation in any regulatory proceedings, inquiries, or investigations that may arise in connection with the Personal Data Breach.
SECTION 9: AUDIT AND INSPECTION RIGHTS
9.1 Audit Right
VoltGraph shall make available to AGMG all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and in this DPA. VoltGraph shall allow for and contribute to audits, including inspections, conducted by AGMG or an auditor mandated by AGMG, in accordance with Article 28(3)(h) of the GDPR.
9.2 Scope.  Audits conducted pursuant to this Section 9 may cover all aspects of VoltGraph's Processing of Personal Data under this DPA, including, without limitation:
(a) the technical and organisational security measures set out in Annex II and their effective implementation;
(b) Sub-processor compliance with the obligations imposed under Section 6 and the corresponding Sub-processor contracts;
(c) the implementation and effective operation of consent-gated pixel firing as required by Section 4.2, including inspection of consent verification logs;
(d) progress towards and completion of the deletion of Historical Pixel Data as required by Section 5;
(e) international data transfer safeguards, including the execution and effectiveness of SCCs and the completeness of Transfer Impact Assessments;
(f) VoltGraph's records of processing activities maintained pursuant to Section 13; and
(g) VoltGraph's compliance with any documented instructions issued by AGMG.
9.3 Frequency and Procedure
AGMG may conduct up to two (2) audits per calendar year, upon a minimum of thirty (30) days' prior written notice to VoltGraph. Additional audits may be conducted by AGMG with reasonable notice in the following circumstances:
(a) following a Personal Data Breach affecting Personal Data Processed under this DPA;
(b) upon instruction or request from a competent Supervisory Authority;
(c) where AGMG has reasonable grounds to believe that VoltGraph is not in compliance with its obligations under this DPA or Applicable Data Protection Law; or
(d) where required as part of AGMG's ongoing remediation programme related to the CNIL formal notice (Reference: MED-2023-097) or the ICO inquiry (Reference: ICO/ENF/2023/LTR-11084).
All audits shall be conducted during normal business hours at VoltGraph's premises or, where appropriate, by remote access to relevant systems and documentation. Audits shall be carried out in a manner that minimises disruption to VoltGraph's business operations, and AGMG and its auditors shall comply with VoltGraph's reasonable site access and security policies.
9.4 Costs.  VoltGraph shall bear its own internal costs associated with facilitating and supporting audits under this Section 9, including the costs of making personnel, documentation, systems, and facilities available. AGMG shall bear the costs of engaging its own auditors and the travel and expenses of its audit personnel.
9.5 Audit by Third-Party Auditor
AGMG may, at its discretion, appoint a suitably qualified independent third-party auditor to conduct audits on its behalf. Any such third-party auditor shall be required to enter into appropriate confidentiality undertakings with VoltGraph prior to the commencement of the audit, on terms reasonably acceptable to both Parties. VoltGraph may object to the appointment of a particular third-party auditor on reasonable grounds (including, without limitation, where the auditor is a competitor of VoltGraph), provided that VoltGraph proposes an alternative qualified auditor acceptable to AGMG.
SECTION 10: DATA PROTECTION IMPACT ASSESSMENT COOPERATION
10.1 DPIA Assistance
VoltGraph shall provide reasonable assistance to AGMG in the conduct of any Data Protection Impact Assessment required under Article 35 of the GDPR in relation to the Processing activities covered by this DPA. Such assistance shall include the provision of information about VoltGraph's processing operations, technical and organisational security measures, data flows, Sub-processor arrangements, and such other information as AGMG may reasonably require to complete the assessment. VoltGraph shall respond to requests for information in connection with a DPIA within a reasonable timeframe, and in any event within fifteen (15) business days of receipt of the request.
10.2 Prior Consultation
If, following the completion of a Data Protection Impact Assessment, AGMG determines that it is required to engage in prior consultation with a Supervisory Authority under Article 36 of the GDPR, VoltGraph shall cooperate fully with AGMG and shall provide such information, documentation, and assistance as may be required by the Supervisory Authority for the purposes of such consultation.
SECTION 11: RETURN AND DELETION OF PERSONAL DATA
11.1 Upon Termination
Upon the termination or expiry of this DPA or the Underlying Agreement, for whatever reason, VoltGraph shall, at AGMG's election (to be communicated in writing within thirty (30) days of termination or expiry):
(a) return all Personal Data Processed under this DPA to AGMG in a commonly used, structured, machine-readable format (such as CSV, JSON, or XML), together with all copies of such data, including copies held by Sub-processors; or
(b) permanently and irrecoverably delete all Personal Data Processed under this DPA, including all copies, from all systems, databases, backups, archives, and storage media within VoltGraph's custody or control, including those held by Sub-processors, and certify such deletion in writing to AGMG,
in accordance with Article 28(3)(g) of the GDPR.
11.2 Timeline.  The return or deletion of Personal Data pursuant to Section 11.1 shall be completed within thirty (30) days of the date of termination or expiry of this DPA or the Underlying Agreement, or within thirty (30) days of receipt of AGMG's written election, whichever is later. If AGMG does not communicate its election within thirty (30) days of termination or expiry, VoltGraph shall delete all Personal Data in accordance with Section 11.1(b) within sixty (60) days of termination or expiry, and shall certify such deletion in writing to AGMG. Notwithstanding the foregoing, VoltGraph may retain Personal Data to the extent required by applicable EU or Member State law, subject to the safeguards set out in Section 5.4, mutatis mutandis.
11.3 Distinction from Historical Pixel Data Deletion
The Parties acknowledge and agree that the deletion obligations set out in Section 5 (Historical Pixel Data) are independent of and in addition to the obligations set out in this Section 11. The deletion of Historical Pixel Data shall proceed in accordance with the timeline and requirements of Section 5, irrespective of the continuation, termination, or expiry of this DPA or the Underlying Agreement.
SECTION 12: TERM AND TERMINATION
12.1 Term.  This DPA shall take effect on the date of execution set out on the first page of this DPA (8 April 2024) and shall continue in full force and effect for so long as VoltGraph Processes Personal Data on behalf of AGMG under or in connection with the Underlying Agreement, unless terminated earlier in accordance with this Section 12.
12.2 Termination for Breach
Either Party may terminate this DPA immediately upon written notice to the other Party if the other Party commits a material breach of any provision of this DPA and:
(a) the breach is incapable of remedy; or
(b) the Party in breach fails to remedy such breach within thirty (30) days of receiving written notice from the non-breaching Party specifying the breach and requiring its remedy.
Without limiting the foregoing, AGMG may terminate this DPA immediately upon written notice to VoltGraph if VoltGraph Processes Personal Data in breach of Applicable Data Protection Law or in a manner inconsistent with AGMG's documented instructions and fails to cease such non-compliant Processing within five (5) business days of receiving written notice from AGMG requiring it to do so.
12.3 Termination for Sub-Processor Objection
In accordance with Section 6.3, AGMG may terminate this DPA and the Underlying Agreement without penalty if AGMG objects to the appointment of a new or replacement Sub-processor and the Parties are unable to resolve the objection within the thirty (30) day negotiation period specified in Section 6.3.
12.4 Consequences of Termination
Termination of this DPA shall not affect the accrued rights and obligations of the Parties. Upon termination, the following Sections shall survive and continue in full force and effect: Section 1 (Definitions and Interpretation), Section 5 (Historical Pixel Data — Deletion Obligations), Section 8 (Personal Data Breach Notification, to the extent relating to breaches occurring prior to or discovered after termination), Section 9 (Audit and Inspection Rights, for a period of twelve (12) months following termination), Section 11 (Return and Deletion of Personal Data), Section 14 (Liability and Indemnification), Section 15 (Confidentiality), and Section 16 (General Provisions).
SECTION 13: RECORDS OF PROCESSING ACTIVITIES
13.1 Obligation.  VoltGraph shall maintain a record of all categories of processing activities carried out on behalf of AGMG, in accordance with Article 30(2) of the GDPR. VoltGraph shall keep such records up to date and accurate at all times.
13.2 Content.  The record of processing activities maintained by VoltGraph shall include, at a minimum:
(a) the name and contact details of VoltGraph (as Processor), its DPO, and of AGMG (as Controller) and AGMG's DPO;
(b) the categories of Processing carried out on behalf of AGMG;
(c) where applicable, details of transfers of Personal Data to a third country or an international organisation, including the identification of that third country or organisation, and the documentation of suitable safeguards pursuant to Article 49(1), second subparagraph, of the GDPR;
(d) where possible, a general description of the technical and organisational security measures referred to in Article 32(1) of the GDPR and as further detailed in Annex II; and
(e) any other information required by Applicable Data Protection Law.
13.3 Availability.  VoltGraph shall make its records of processing activities available to AGMG upon written request, within a reasonable timeframe not exceeding ten (10) business days. VoltGraph shall also make such records available to any competent Supervisory Authority upon request, in accordance with Article 30(4) of the GDPR.
SECTION 14: LIABILITY AND INDEMNIFICATION
14.1 Liability.  Each Party's liability under or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Underlying Agreement, save that neither Party's liability for the following shall be limited or excluded:
(a) breaches of Applicable Data Protection Law;
(b) wilful misconduct or fraud;
(c) claims brought by Data Subjects pursuant to Article 82 of the GDPR arising from a Party's breach of this DPA or Applicable Data Protection Law;
(d) administrative fines or penalties imposed by a Supervisory Authority to the extent attributable to a Party's acts or omissions; and
(e) the indemnification obligations set out in Section 14.2.
14.2 Indemnification.  VoltGraph shall indemnify, defend, and hold harmless AGMG, its officers, directors, employees, agents, and affiliates against any and all losses, liabilities, damages, costs, and expenses (including, without limitation, reasonable legal fees and disbursements, regulatory fines and penalties, compensation paid to Data Subjects, and the costs of remediation and notification) arising from or in connection with:
(a) any breach by VoltGraph of its obligations under this DPA;
(b) any breach by VoltGraph of Applicable Data Protection Law in connection with the Processing of Personal Data under this DPA;
(c) any act or omission of a Sub-processor engaged by VoltGraph that gives rise to a breach of this DPA or Applicable Data Protection Law; and
(d) any administrative fine or penalty imposed by a Supervisory Authority to the extent that such fine or penalty is attributable to VoltGraph's acts or omissions.
This indemnification obligation is without prejudice to the allocation of liability between the Parties under Article 82 of the GDPR and shall not be construed to limit AGMG's right to seek compensation directly from VoltGraph under Article 82(2) of the GDPR.
14.3 Mutual Cooperation on Regulatory Proceedings
The Parties shall cooperate in good faith in connection with any regulatory proceedings, investigations, inquiries, or complaints relating to the Processing of Personal Data under this DPA, including, without limitation, proceedings initiated by the CNIL (including any follow-up to formal notice MED-2023-097), the ICO (including any follow-up to inquiry ICO/ENF/2023/LTR-11084), the Hamburg Commissioner for Data Protection and Freedom of Information, or any other competent Supervisory Authority. Each Party shall promptly inform the other Party of any such proceedings, investigations, or complaints of which it becomes aware, and shall provide all reasonable assistance and information to enable the other Party to respond effectively.
SECTION 15: CONFIDENTIALITY
15.1 Obligations.  The terms and conditions of this DPA, together with all Annexes, schedules, and ancillary documents, and all Personal Data Processed hereunder, are strictly confidential. Each Party shall maintain appropriate confidentiality safeguards and shall not disclose the terms of this DPA or any Personal Data Processed hereunder to any third party without the prior written consent of the other Party, except as expressly permitted under this DPA or as required by applicable law.
15.2 Exceptions.  Notwithstanding Section 15.1, a Party may disclose the terms of this DPA and/or Personal Data Processed hereunder:
(a) to the extent required by applicable law, regulation, or the order of a court of competent jurisdiction;
(b) to a competent Supervisory Authority, in the exercise of its powers under Applicable Data Protection Law;
(c) to the Party's professional advisers (including legal counsel, auditors, and accountants) who are bound by professional obligations of confidentiality;
(d) in connection with legal proceedings between the Parties;
(e) to its affiliates and group companies, subject to appropriate confidentiality undertakings; and
(f) as otherwise permitted under the Underlying Agreement.
SECTION 16: GENERAL PROVISIONS
16.1 Governing Law
This DPA shall be governed by and construed in accordance with the laws of England and Wales, without regard to its conflict of laws principles.
16.2 Jurisdiction.  The courts of England and Wales shall have exclusive jurisdiction to settle any dispute, claim, or matter arising out of or in connection with this DPA, including any dispute regarding its existence, validity, or termination. Nothing in this Section 16.2 shall limit the rights of Data Subjects or Supervisory Authorities under Applicable Data Protection Law to bring proceedings before the courts of any EU Member State or the United Kingdom.
16.3 Relationship with Underlying Agreement
This DPA is supplementary to, and forms an integral part of, the Underlying Agreement. In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the Underlying Agreement with respect to the Processing of Personal Data, the provisions of this DPA shall prevail to the extent of such conflict or inconsistency. All other provisions of the Underlying Agreement shall remain in full force and effect.
16.4 Amendments.  No amendment, modification, or supplement to this DPA shall be effective unless it is in writing and signed by duly authorised representatives of both Parties. For the avoidance of doubt, email correspondence shall not constitute a written instrument for the purposes of this Section 16.4.
16.5 Severability.  If any provision of this DPA (or any part of any provision) is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable, or illegal, the other provisions of this DPA shall remain in full force and effect. If any invalid, unenforceable, or illegal provision would be valid, enforceable, and legal if some part of it were deleted or modified, the provision shall apply with whatever modification is necessary to give effect to the Parties' intention as closely as possible.
16.6 Entire Agreement
This DPA, together with the Underlying Agreement and the Annexes attached hereto, constitutes the entire agreement between the Parties with respect to the Processing of Personal Data and supersedes all prior data processing terms, agreements, arrangements, understandings, representations, and warranties (whether written or oral) between the Parties relating to such subject matter. Each Party acknowledges that, in entering into this DPA, it has not relied on any representation, warranty, or undertaking which is not expressly set out in this DPA.
16.7 Notices.  All notices, requests, demands, and other communications under this DPA shall be in writing and shall be sent to the following addresses (or such other addresses as a Party may designate by written notice to the other Party):
For AGMG:
Margaux Fontaine-Li Group Data Protection Officer Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom
Email: m.fontaine-li@agmg.co.uk
With a copy to:
Sanjay Redworth Group General Counsel & Company Secretary Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom
Email: s.redworth@agmg.co.uk
For VoltGraph:
Jana Siebert Data Protection Officer VoltGraph Analytics GmbH Große Elbstraße 44 22767 Hamburg Germany
Email: j.siebert@voltgraph.de
With a copy to:
Dr. Kai-Henrik Möller Managing Director (Geschäftsführer) VoltGraph Analytics GmbH Große Elbstraße 44 22767 Hamburg Germany
Email: k.moeller@voltgraph.de
Notices shall be deemed to have been received: (a) if delivered by hand, upon delivery; (b) if sent by registered post or courier, on the second business day after posting; and (c) if sent by email, upon confirmed receipt by the recipient (excluding automated delivery receipts).
16.8 Counterparts.  This DPA may be executed in any number of counterparts, each of which when executed shall constitute an original, but all of which taken together shall constitute one and the same instrument. Delivery of an executed counterpart of a signature page to this DPA by email (in PDF format) or other electronic means shall be as effective as delivery of a manually executed counterpart.
EXECUTION
IN WITNESS WHEREOF, the Parties have executed this Data Processing Agreement as of the date first written above.
For and on behalf of Aurelius Global Media Group PLC:
AURELIUS GLOBAL MEDIA GROUP PLC
By: ________
Name: Margaux Fontaine-Li
Title: Group Data Protection Officer
Date: 8 April 2024
For and on behalf of VoltGraph Analytics GmbH:
VOLTGRAPH ANALYTICS GmbH
By: ________
Name: Dr. Kai-Henrik Möller
Title: Managing Director (Geschäftsführer)
Date: 8 April 2024
Attestation: This Data Processing Agreement was negotiated and finalised with the assistance of Dr. Luisa Feldstein, Partner, Feldstein Weber LLP (Bockenheimer Landstraße 24, 60323 Frankfurt am Main, Germany), acting as outside counsel to VoltGraph Analytics GmbH, and Calderwood & Harkness LLP (One Finsbury Square, London EC2A 1AE, United Kingdom, Matter No. 1017-00008), acting as counsel to Aurelius Global Media Group PLC.
ANNEX I — DESCRIPTION OF PROCESSING
Part A: List of Parties
Part B: Description of Processing
Subject Matter of Processing:
Cross-device tracking and audience segmentation analytics for AGMG's European digital properties, as provided by VoltGraph under the Underlying Agreement.
Duration of Processing:
Co-terminous with the Underlying Agreement (annual contract value: €1,150,000). Processing commenced prior to the date of this DPA and shall continue for so long as the Underlying Agreement remains in effect, unless this DPA is terminated earlier pursuant to Section 12.
Nature of Processing:
The Processing carried out by VoltGraph includes the following operations or sets of operations performed on Personal Data: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use (for segmentation and analytics), alignment and combination (cross-device linkage of user profiles), restriction, erasure, and destruction.
Purpose of Processing:
The purpose of the Processing is audience analytics, cross-device user identification, audience segmentation, and the generation of aggregated insights to support AGMG's programmatic advertising operations across EU/EEA digital properties. Specifically, VoltGraph processes Personal Data to enable AGMG to identify and segment its online audiences, optimise the delivery of programmatic advertising campaigns, and generate performance and audience analytics reports.
Categories of Data Subjects:
•  Website visitors and mobile application users of AGMG's European digital properties (approximately 87 million monthly active users across the EU/EEA);
•  Registered users of AGMG's streaming, digital news, and e-commerce platforms who access AGMG's European digital properties; and
•  Users of AGMG's three mobile applications