TABOOLA’S CCPA SERVICE PROVIDER ADDENDUM FOR DATA PARTNERS

Effective: January 1, 2020

To ensure that Taboola has adequate contractual terms in place with our Data Partners (“Service Provider”) under the California Consumer Privacy Act of 2018 (the “CCPA”), Taboola has made public these CCPA Service Provider Terms (the “CCPA Terms”).

These CCPA Terms supplement and form part of the existing contractual business arrangement between Service Provider and Taboola (“Underlying Agreement”).  All capitalized terms used in these CCPA Terms, but not defined herein, shall have the meaning ascribed thereto in the Underlying Agreement.

Definitions

  1. “CCPA” means the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 – 1798.199).
  2. “Personal Information” shall have the meaning set forth in the CCPA and its implementing regulations, as it applies to such Personal Information (or “Personal Data” if so defined in the Underlying Agreement) provided by Taboola to Service Provider in connection with the Agreement.
  3. “Sell” shall have the meaning set forth in the CCPA and its implementing regulations.

Service Provider Obligations

  1. Limitation on Processing of Personal Information. Service Provider may collect, retain, use, disclose, and otherwise process Personal Information solely to perform its obligations to Taboola under the Underlying Agreement and on Taboola’s behalf and as otherwise instructed by Taboola in writing from time to time. For the avoidance of doubt, Service Provider may not Sell Personal Information or otherwise retain, use, or disclose Personal Information for its own purpose or any purpose outside of the direct business relationship between Taboola and Service Provider.
  2. Deletion of Personal Information. Service Provider shall delete all Personal Information collected and processed by Service Provider on behalf of Taboola no later than thirty (30) days after the latest delivery of such particular Personal Information, including any Taboola cookie identifiers.
  3. Subcontracting. Service Provider may disclose Personal Information to its own service providers (“Subcontractors”), as necessary, in order to perform its obligations under the Agreement; provided that, (i) such Subcontractor is bound by terms relating to the collection, retention, use, and disclosure of Personal Information that are no less restrictive than those set forth herein; (ii) such Subcontractor is required to delete all Personal Information collected and processed by such Subcontractor on behalf of Taboola no later than 30 days after the latest delivery of such particular Personal Information and (iii) Service Provider remains liable for the acts and omissions of its Subcontractor.
  4. Notice Obligations. If Service Provider receives a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authority relating to the Personal Information, Service Provider shall notify Taboola in writing within seventy-two (72) hours of receiving such inquiry, investigation, subpoena, summons, or other communication.

 

Indemnification

Service Provider shall defend Taboola and its directors, officers, employees, agents, and clients (the “Taboola Indemnitees”) from and against any and all claims, demands, suits, proceedings, and actions brought by a third party relating to an allegation that Service Provider violated these CCPA Terms or the CCPA and shall indemnify the Taboola Indemnitees for all damages, losses, costs, and expenses (including reasonable attorneys’ fees) incurred by Taboola Indemnitees arising out of or resulting from such claim.

Miscellaneous

The provisions of these CCPA Terms are effective solely to the extent the CCPA applies. Service Provider is solely liable for its compliance with the CCPA in its use of Taboola’s services. In the event of changes to the CCPA or issuance of applicable regulation, court order, or governmental guidance relating to the CCPA, Taboola may change these CCPA Terms, if such change does not have a material adverse impact on Service Provider, as reasonably determined by Taboola, with respect to exemptions from “sales” under the CCPA.

In case of any inconsistency or conflict between these CCPA Terms and those of any applicable Data Protection Agreement (“DPA”) in place between Service Provider and Taboola, the CCPA Terms shall control solely with respect to Personal Information of consumers located in California and the DPA shall control with regard to Personal Data of individuals located in the European Economic Area.

Agreement

After the Effective Date hereof, reference to the “Agreement” shall refer to the Underlying Agreement as supplemented by these CCPA Terms.