Data Processing Agreement

1. Definitions

“Controller” — the User determining the purposes and means of personal data processing.

“Processor” — RTBLink, processing personal data on behalf of the Controller.

“Sub-processor” — any third party engaged by RTBLink to process personal data in connection with the services.

Terms not defined here have the meanings given in the RTBLink Terms and Conditions and Privacy Policy.

2. Scope and Purpose

This DPA applies where RTBLink processes personal data on behalf of the User (Controller) in the course of providing advertising technology services under the RTBLink Terms and Conditions.

RTBLink processes personal data solely to the extent necessary to deliver the agreed services, including campaign delivery and management, traffic analysis and fraud prevention, reporting and analytics, and technical platform operations.

3. Personal Data Processed

Categories of personal data may include:

• Technical identifiers (IP addresses, cookie IDs, advertising IDs, device identifiers)
• Behavioral and interaction data (impressions, clicks, conversions)
• Contextual data (URL, content category, timestamp, approximate geographic location derived from IP)

Categories of data subjects: end users of Publisher websites and applications.

4. Duration

This DPA remains in force for the duration of the RTBLink Terms and Conditions and terminates automatically upon termination of the service relationship, subject to applicable retention obligations.

5. RTBLink Obligations as Processor

RTBLink shall:

• Process personal data only on documented instructions from the Controller, unless required otherwise by applicable law
• Ensure authorized personnel are bound by appropriate confidentiality obligations
• Implement appropriate technical and organizational security measures in accordance with Article 32 GDPR
• Assist the Controller in responding to data subject rights requests to the extent reasonably possible given the nature of the processing
• Notify the Controller without undue delay upon becoming aware of a personal data breach affecting Controller data
• Upon termination of services, delete or return personal data as instructed by the Controller, unless retention is required by applicable law
• Make available information reasonably necessary to demonstrate compliance with this DPA

6. Sub-processors

RTBLink may engage sub-processors to assist in delivering services. A list of current sub-processors is available at rtblink.com/subprocessors.

RTBLink will notify the Controller of any intended changes to sub-processors. The Controller may object within 14 days of notification. If RTBLink cannot accommodate the objection, either party may terminate the affected services without penalty.

RTBLink imposes data protection obligations on sub-processors equivalent to those in this DPA.

7. International Transfers

Where personal data is transferred outside the European Economic Area, RTBLink ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or other mechanisms recognized under applicable data protection law.

8. Audit Rights

The Controller may request confirmation of RTBLink’s compliance with this DPA no more than once per year. RTBLink may fulfill this obligation by providing relevant documentation, certifications or third-party audit reports. On-site audits require reasonable prior written notice and are subject to confidentiality obligations.

9. Governing Law

This DPA is governed by the laws of the Czech Republic and shall be interpreted in accordance with applicable EU data protection legislation.

10. Contact

For questions regarding this DPA, contact: privacy@rtblink.com

---

RTBLink Data Processing Agreement | Version 1.0 | August 2026