Criteo Data Protection Agreement 2025 May EN.pdf

CRITEO DATA PROTECTION AGREEMENT

PREAMBLE

This Criteo Data Protection Agreement (hereafter the “DPA”) supplements the Criteo Umbrella Terms of Service (the “Terms”) and the relevant Criteo Specific Terms of Service (the “STS”) or any other applicable agreement with the Partner (collectively, the “Agreement”), and is hereby incorporated into the Agreement between Criteo and the Partner for the provision of the relevant Criteo Services.

This DPA describes the protection and security obligations of the Parties with respect to any Processing of Personal Data carried out in connection with the provision of the relevant Criteo Services, including the processing of Service Data if and then solely to the extent that such data contains Personal Data, in accordance with the requirements of Data Protection Law. This DPA is organized around the following sections:

Section I of this DPA always applies to the Parties. Application of Section II will depend on the status under which Criteo operates and that is specified in the STS or in any other applicable arrangement applying to the Service ordered by the Partner.

Section I: Common Terms

1 Definitions

Unless otherwise stated herein, definitions set out in the Agreement apply to this DPA. The additional definitions set out below shall apply to this DPA.

“Consent” means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. Under Section II of this DPA, Criteo S.A., as the parent company for Criteo Group, and the Partner act as Joint Controllers. The term “Controller” includes “Business“, as defined under the CCPA.

“Data Protection Law” means any and all applicable international, national, federal and state laws and regulations relating to data protection and privacy, including but not limited to: (a) the General Data Protection Regulation (“EU GDPR”), (b) the UK Data Protection Act (“UK GDPR”), (c) the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act of 2020, and other state laws pertaining to data protection.

“Data Subject” means an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier (e.g., a name, an identification number, location data, an online identifier) or to one or more factors specific to that natural person.

“Joint Controller” means a Controller acting jointly with one or several others. Under Section II of this DPA, Criteo and the Partner act as joint controllers.

“Personal Data” means any information identifying, relating to, describing, or is capable of being associated with, or can reasonably be linked with, an identified or identifiable natural person or household Processed in connection with the provision of the relevant Criteo Services.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

“Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means.

“Regulatory Authority” means the applicable public authority or government agency responsible for supervising compliance with Data Protection Law, including but not limited to: the French CNIL, UK Information Commissioner’s Office, or California Privacy Protection Agency.

The terms “Business,” “Business Purpose,” “Sale,” and “Share” shall have the same meaning as in the applicable Data Protection Law, and their cognate terms shall be construed accordingly.

2 Compliance with Law

2.1 Each Party shall comply and shall be able to demonstrate its compliance with its respective obligations under Data Protection Law and in accordance with this DPA. 2.2 The Partner specifically acknowledges and agrees that its use of the Joint Controller Services is compliant with Data Protection Law.

3 Authorizations

3.1 A Party shall not disclose Personal Data to the other Party, except where the disclosing Party warrants compliance with Data Protection Law. 3.2 Nothing in this DPA shall prohibit or limit Criteo’s rights to implement anonymization or de-identification of Personal Data processed in connection with the Agreement.

4 Cooperation

4.1 The Parties shall cooperate to comply with Data Protection Law and to meet their obligations pursuant to this DPA. 4.2 The Parties shall keep appropriate documentation on the Processing activities carried out by each of them.

5 Data Protection Officers

5.1 Criteo and the Partner appointed a data protection officer. Criteo’s data protection officer may be reached at: dpo@criteo.com.

Section II – Joint Controller Terms

6.1 This Section II shall apply only with respect to Processing of Personal Data carried out in the context of the provision by Criteo of the Joint Controller Services ordered by the Partner. 6.2 In accordance with article 26 of the GDPR, the Parties hereby determine their respective responsibilities for compliance with their obligations under GDPR.

7 Obligations of the Parties when acting as Joint Controllers

7.1 When Processing Personal Data as Joint Controllers under Section II of this DPA, each Party agrees to comply with all data protection principles provided for in the Data Protection Law.

8 Criteo’s Obligations

8.1 Criteo shall be solely responsible for including a link to Criteo’s Privacy Policy page in all advertisements served on the Partner Digital Properties.

9 Obligations of the Partner

9.1 Partner shall be solely responsible for: (a) providing the Data Subjects with necessary information pursuant to Data Protection Law; (b) providing appropriate notice on Partner's Digital Properties for any relevant Processing of Personal Data by Criteo; (c) collecting and documenting Consent or opt-out provisions, as applicable.

Last updated: May 2025