Annex

ANNEX A- Description of the Transfer

A. LIST OF PARTIES

Data exporter(s):
Name: See Order or Agreement
Address: See Order or Agreement
Contact person’s name, position and contact details: See Order or Agreement
Activities relevant to the data transferred under these Clauses: Billing and attribution purposes; for data importer to advertise to and provide reward program to end users.
Date: Deemed signed and effective as of the effective date set forth in the applicable Order or Agreement or the date on which Client started to use a Mistplay service, whichever is earlier.
Signature: See Agreement
Role (controller/processor): Controller

Data importer(s): Mistplay Inc.,
Address: 481 Ave Viger West, Suite 300, Montreal (QC) H2Z 1G6, Canada
Contact person’s name, position and contact details: Deirdre Sheridan < privacy@mistplay.com >, General Counsel and Chief Privacy Officer.
Activities relevant to the data transferred under these Clauses: Oversight of common data protection program to assure uses of the transferred data are limited to the uses described herein.
Date: Deemed signed and effective as of the effective date set forth in the applicable order or the Agreement or the date on which Mistplay provides the Services, whichever is earlier.
Signature: See Order or Agreement
Role (controller)/processor): Controller

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

End users of web and mobile applications who view ads, in-app content, and play games as well as the employees of Mistplay’s partners and vendors who participate or service our ad network.
Employees of Client.

Categories of personal data transferred

End Users data including advertising identifiers, device identifiers, and IP addresses
Game play, in-app purchase, and device data, including device identifiers
Information related to the ad content or attribution data sent by Client or Client’s agent
Clients’/Vendors’ employees: name, work address, email address, phone numbers, usernames of employees who access Mistplay’s ordering system to place advertisements, or any vendor employee who provides such information to Mistplay in performing services for Mistplay.

Sensitive data transferred (if applicable)

None.

The frequency of the transfer

Transferred continuously.

Nature of the processing

Storing and analyzing data to carry out the purposes of the data transfer

Purpose(s) of the data transfer and further processing

For game players, the data is transferred to personalize advertising and in game purchase opportunities as well as to personalize game play.
To facilitate, support and operate games and player or user experiences.
In order to enable Client to monetize its Application.
In order to enable Mistplay to advertise the Mistplay Platform or otherwise provide services as described in the Agreement between Mistplay and Client.
To provide analytics reporting.
For Mistplay’s internal purposes, including billing and payment processing, fraud prevention, and improving products and services.

The period for which the personal data will be retained
Mistplay retains personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

The length of time Mistplay has an ongoing relationship with the data subject and/or Client, including the provision of services;
Whether there is a legal obligation to which Mistplay is subject;
Whether retention is advisable in light of our legal position.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Mistplay uses processors for storage and retention on a continuous basis for the duration of the retention period.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority will be (i) for Personal Data protected by the GDPR, determined in accordance with Clause 13 of the Standard Contractual Clauses; (ii) for Personal Data protected by the Swiss DPA, the Federal Data Protection and Information Commissioner (“FDPIC”); and (iii) for Personal Data protection by UK Privacy Law, the Information Commissioners Office (the “ICO”).

List of sub-processors available inside of your account settings page, or upon request to privacy@mistplay.com

Annex B - Technical and Organizational Measures

The technical and organizational measures implemented by PubMatic (including any relevant certifications) to maintain an appropriate level of security taking into account the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons, are as follows: Available upon request to privacy@mistplay.com