Advertiser Terms of Service

Purpose and Acceptance. These Advertiser Terms of Service (“Advertiser Terms”) govern the Advertiser’s use of the Scaleo B2B affiliate marketing Platform. These Advertiser Terms form part of the overall contractual relationship between the Advertiser and the Provider. By registering in the Advertiser role and accepting these Advertiser Terms, you agree to be bound by these Advertiser Terms. If you are registering on behalf of a company or other legal entity, you represent that you have the authority to bind that entity to these Advertiser Terms. In such a case, “you” will refer to that company/entity.

Applicability. These Advertiser Terms govern the Advertiser’s role and use of the Platform.

Changes to These Advertiser Terms. The Provider reserves the right to amend or update these Advertiser Terms at any time, in particular to reflect changes in law, regulatory requirements, business practices, or the functionality of the Platform. The Provider shall notify the Advertiser of any material amendment by email or through the Platform at least thirty (30) days before the amendment takes effect, unless such notice period is reduced due to legal or operational urgency. If the Advertiser does not accept the amended Advertiser Terms, it may terminate the Agreement by providing written notice at least fifteen (15) days before the amendment becomes effective. If no such notice is provided and the Advertiser continues to use the Platform after the effective date, the amended Advertiser Terms shall be deemed accepted.

Enforceability of Electronic Acceptance. The Parties acknowledge and agree that acceptance of these Advertiser Terms by online “clickwrap” (i.e., clicking an “I Agree” or similar acceptance button) shall constitute a valid and legally binding electronic agreement under applicable Czech law, including Sections 561 and 562 of Act No. 89/2012 Coll., the Civil Code, provided that the terms are presented in a clear and accessible manner and the user is afforded an opportunity to review them prior to acceptance.

Privacy Policy. The collection, use, and protection of personal data by the Provider are governed by the Scaleo Marketplace Privacy Policy, available at https://scaleo.ai/privacy-policy (or any successor URL) (“Privacy Policy”). The Privacy Policy is hereby incorporated by reference into these Advertiser Terms and forms an integral part of the agreement between the Advertiser and the Provider. By creating an Account or otherwise using the Platform, the Advertiser confirms that it has read, understood, and accepted the Privacy Policy. If the Advertiser does not agree to the Privacy Policy, it must not use the Platform. The Provider may update the Privacy Policy from time to time in accordance with the change-procedure described in the Privacy Policy itself. Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the changes.

Data-Processing Agreement. The Advertiser’s use of the Platform involves the processing of Personal Data for which the Advertiser is the data controller and the Provider is a processor. The Scaleo Data-Processing Agreement (“DPA”) set out immediately after these Terms forms an integral part of this agreement. By accepting these Terms, the Advertiser simultaneously accepts and enters into the DPA.

Contact us. General support inquiries can be sent to support@scaleo.ai and legal notices or questions can be sent to info@scaleo.ai. The Provider’s official address and identification are provided above for formal communications.

Key features and scope. Upon entering into these Advertiser Terms, and acceptance by the Provider of your application to use the Platform, the Provider shall grant you access to the Scaleo Platform and related services to enable the Advertiser to run its Affiliate Marketing programs. The Platform is a B2B tool that facilitates the connection between Advertisers and Affiliates and the tracking of Specified Actions. The Provider is not a broker, financial institution, or payment guarantor for any transactions between Advertiser and Affiliates. Key features and services available to Advertisers include:

• Functionality to define and track Specified Actions (e.g., clicks, conversions, revenue), assign commission structures, and generate tracking links or promo codes for Affiliates;
• Real-time and historical analytics dashboards to monitor traffic, leads, sales, and other KPIs per Affiliate, campaign, or other parameters;
• Integration capabilities for Advertiser websites and systems (e.g., via APIs, SDKs, or tracking pixels) to ensure reliable recording of Affiliate-referred actions.

The Advertiser remains solely responsible for its relationships with Affiliates and must ensure that each campaign and related Service Agreement complies with applicable laws, regulations, and Platform policies.

Payments. The Platform may offer functionality for Advertisers to record and track payments to Affiliates, including third-party payment integrations or payment status tracking (e.g., marking commissions as sent). However, the Provider bears no responsibility or liability for ensuring that payments are made, received, or settled. All commissions and monetary obligations between the Advertiser and Affiliates are governed solely by the applicable Service Agreement between those parties. Any disputes regarding payments, including but not limited to non-payment, incorrect amounts, chargebacks, or late transfers, must be resolved directly between the Advertiser and Affiliate. The Provider is not obligated to mediate or enforce any such claims.

Service Levels and Platform Availability. The Provider shall use commercially reasonable efforts to maintain availability of the Platform and ensure it operates reliably. However, no digital service can guarantee uninterrupted operation. The Platform may experience temporary outages due to:

• Scheduled maintenance. Typically conducted during off-peak hours and communicated in advance;
• Emergency maintenance. Required to address critical bugs or security vulnerabilities, which may occur without prior notice;
• Downtime due to circumstances beyond the Provider’s control, such as force majeure or third-party infrastructure issues.

Scheduled maintenance periods will not count as downtime for the purposes of any service obligations.

Updates and Functional Changes. The Provider continually improves the Platform and may deploy updates, bug fixes, enhancements, new features, or remove outdated features from time to time. The Provider reserves the right to change or discontinue any part of the Platform or Services (either temporarily or permanently) at any time, provided that such do not impair the tracking of Specified Actions.

Third-Party Services and Links. The Platform may contain links or integrations to third-party websites or services. These third-party services are not under the Provider’s control, and the Provider is not responsible for the content or performance of any third-party services. Use of third-party services may be subject to separate terms and privacy policies between you and the third party.

Account Suspension. If the Provider suspends or terminates an Advertiser account, the Provider will display an “Inactive” status for all of the Advertiser’s Campaigns. As from that status change (i) no new tracking links may be generated, (ii) clicks will not be redirected, and (iii) no further Conversions will be recorded. The Advertiser must immediately notify its Affiliates and settle any undisputed amounts already earned.

Registration Process. In order to access the Platform as Advertiser, you must complete the registration or sign-up process. Misrepresentation of identity, qualifications, or any other required details is a serious breach of these Advertiser Terms, and may lead to immediate Account suspension. Submission of the registration information does not guarantee that you will be granted an Account or access to the Platform. All new accounts are subject to review and approval by the Provider. The Provider reserves the right to approve or reject any registration in its sole discretion. Criteria for approval may include verification of identity and business, compliance with Know-Your-Customer (KYC) and anti-fraud screenings, the nature of business or website, and any past violations or risk factors.

Know Your Customer (KYC) and Verification. The Provider may at any time request information to verify your identity, business registration, license, ownership, location, tax identification, or to screen for sanctions compliance. By registering, you represent and warrant that: (a) all information submitted is true and that any official documents provided (i.e. extracts, PoA, certificates, licenses, etc.) are genuine and unaltered; (b) neither you nor any of your owners, directors, or affiliates is subject to any trade sanction, embargo, or listed on any denied-party list maintained by the EU, US, or other relevant government; and (c) your use of the Platform will not violate any country’s export control or sanctions laws. The Provider may suspend or terminate the Account of anyone that fails to provide requested verification information or that is found to be in violation of KYC/AML laws or sanctions requirements.

Account Security. Upon successful registration, you will set or receive login credentials (such as a username and password) for your Account. You are responsible for maintaining the confidentiality and security of your Account credentials. The Provider is not liable for any loss or damage arising from your failure to keep your Account secure. You are liable for all activities conducted through your Account (except those after you have notified the Provider of a compromise and the Provider has had a reasonable time to act on the notice). The Provider may require you to use multi-factor authentication or other security measures for account access, and you agree to follow the Provider’s recommended security procedures.

Account Use and Restrictions. Each Account is meant to be used only by the registered Advertiser. You may not sell, rent, or transfer your Account to any other person without the Provider’s prior written consent. You may allow your internal team members to access the Account (for example, creating sub-accounts or user roles under your main account) as permitted by the Platform’s functionality; however, you are responsible for all actions of your team members on the Platform.

Accuracy and Updates. You agree to maintain accurate account information. This includes keeping your contact information, business name, address, VAT ID (if applicable), payment details, billing info, and any other profile information up-to-date at all times. The Provider will rely on the information you provide, for example, to send notices, invoices, or payments. The Provider is not responsible if communications fail to reach you because of outdated contact information. If you provide any information that is untrue, inaccurate, not current, or incomplete, the Provider has the right to suspend or terminate your Account and refuse any current or future use of the Services.

Account Suspension or Termination. The Provider reserves the right to suspend or terminate your Account at any time if, in the Provider’s reasonable opinion:

• You have violated these Advertiser Terms of Service, or any other applicable policy or instruction (especially in cases of severe violations such as fraud, illegal content, or non-payment).
• Any information you provided is false or misleading.
• You are engaging in activities that cause or risk causing harm to the Platform’s functionality or security, to other users, or to the Provider’s business (for example, distributing malware, attempting unauthorized access, etc.).
• Required payments are overdue or payment information is no longer valid.
• It is required for legal compliance (e.g., if mandated by law enforcement or due to sanctions).
• You are or become a direct competitor of the Provider or are using the Platform to build a competing product.

Successor Entities. If you (or your business) have had an Account terminated by the Provider in the past, you may not register again without the Provider’s explicit approval. Likewise, the Provider may refuse registration to any successor or affiliated entity of a previously terminated party if it believes it is essentially the same party seeking to rejoin under a different name.

Acceptance of Service Agreement. Each Advertiser is required to have a Service Agreement in place with its Affiliates, governing their specific cooperation (e.g. traffic requirements, commission rates, payment terms). The standard Service Agreement provided via the Platform shall apply by default and shall be deemed accepted by both parties. The Provider is not a party to, and disclaims any responsibility for, the negotiation, content, validity, or enforcement of any such Service Agreement.

Subscription and Pricing. The Advertiser’s use of the Platform is subject to payment of a revenue-based Subscription Fee in accordance with the Provider’s current price list and the selected Subscription Plan. The Subscription Fee is calculated monthly, as the aggregate of all Monthly Fees incurred under the Advertiser’s active Service Agreements with individual Affiliates. Each Monthly Fee is either a percentage of the Affiliate GGR tracked via the Platform for that Service Agreement, or the minimum Monthly Fee, if applicable. The Subscription Fee is invoiced monthly, in arrears, based on performance during the preceding Billing Period.

Change of parameters. The Monthly Fee depends on variable parameters (such as monthly Affiliate GGR and number of the Brands connected to a particular Affiliate). If these parameters change in a way that the Monthly Fee changes, the change to the Monthly Fee will be handled as follows:

• If the Monthly Fee increases, the Provider will invoice the difference between the original Monthly Fee and the new Monthly Fee for the period until the end of the Billing Period. From the next Billing Period, the Advertiser is obliged to pay the increased Monthly Fee.
• If the Monthly Fee is reduced, the difference between the original Monthly Fee and the lower Monthly Fee will be offset against the Monthly Fee payment for the next Billing Period. The Monthly Fee will only be reduced when the Affiliate GGR is in the lower range for 3 consecutive months.

Payment Methods and Authorization. The Subscription Fee is payable in the manner and within the deadlines set out in the applicable invoice or billing instructions on the Platform. Payments may be made using available payment methods, including credit/debit card, bank transfer, or other options offered by the Provider. Where recurring payment is enabled, the Advertiser authorizes the Provider to charge the relevant fees automatically for each Billing Period until termination of the Subscription Term. Revocation of such authorization must be accompanied by an update of the payment method or termination of the subscription. Simply removing a payment method does not discharge the obligation to pay.

VAT and Taxes. All fees are stated exclusive of VAT and other applicable taxes, unless expressly stated otherwise. VAT will be charged in accordance with applicable law depending on the Advertiser’s tax status and place of establishment. The Advertiser is responsible for providing accurate VAT information and bears any tax liability resulting from misstatements. Invoices will be issued in EUR or USD, depending on billing settings or the Advertiser’s registered address, and shall be delivered electronically in accordance with Czech legal requirements.

Payment Charges. Payments by bank transfer must be made under the SHA (shared charges) regime, with each party bearing their respective bank fees. The Advertiser shall ensure the net invoiced amount is received by the Provider. Any shortfalls due to bank fees or currency exchange losses may be invoiced by the Provider.

Late Payment and Suspension. If the Advertiser fails to pay any amount when due, that amount will start to accrue default interest at the commercial rate published by the Czech National Bank plus eight (8) percentage points per annum. The Provider is also entitled to a one-off collection charge of CZK 1 200 (or the equivalent in the invoicing currency) for each overdue invoice. As soon as an invoice is overdue the Provider may suspend the Advertiser’s access to the Platform without prior notice; suspension does not relieve the Advertiser of its duty to pay all outstanding sums, interest and charges, and the Provider’s service commitments are paused for the duration of the suspension. If any payment remains unpaid for more than 14 days, the Provider may terminate the Agreement and may restrict or delete the Advertiser’s data. Any grace period is granted solely at the Provider’s discretion and must be confirmed in writing.

Changes to Fees. The Provider may modify the price list and its fees with effect from the next Billing Period. At least 30 days’ prior notice will be provided via email or notification in the Advertiser’s account. If the Advertiser does not agree with the new pricing, they may terminate the subscription effective at the end of the current Billing Period, by providing written notice at least 15 days before the effective date of the new fees. Continued use of the Platform beyond the effective date shall be deemed acceptance of the revised pricing.

Recovery Costs. The Advertiser agrees to reimburse the Provider for any reasonable costs incurred in the enforcement or collection of overdue payments, including legal fees, debt recovery agency charges, and statutory flat-rate compensation as permitted under applicable law.

Identity Verification and KYC Obligations. The Advertiser shall provide true, accurate, complete and up-to-date identification and contact information and shall, without undue delay, supply all documents or data reasonably requested by the Provider for the purposes of Know-Your-Customer (KYC) procedures. The Advertiser agrees to comply with all applicable anti-money laundering (AML) and counter-terrorist financing (CFT) laws and regulations.

Obligations for iGaming and Regulated Services. If the Advertiser offers or promotes services that are subject to licensing or regulatory oversight, such as online gaming, betting, financial services, or other regulated industries, the Advertiser must hold all necessary authorizations or licenses in each relevant EU Member State or third country in which the services are offered. In particular:

• any gaming-related campaign must be operated in accordance with its local law on gaming, and relevant EU laws and national laws of the target jurisdiction(s);
• the Advertiser must not promote gaming services in jurisdictions where such services are prohibited or unlicensed;
• where applicable, the Advertiser must implement age verification and player protection mechanisms, as well as consumer and gaming regulations; and
• if the Advertiser promotes services involving virtual currencies, high-risk financial products, or other sensitive sectors, it must ensure full compliance with sector-specific EU and Czech rules, including registration with the competent financial intelligence unit (FIU), if required.

Compliance Cooperation and Enforcement. The Advertiser shall fully and promptly cooperate with the Provider’s compliance checks, KYC/AML audits, or regulatory requests. This includes providing all requested information, documentation, and reasonable access to internal records relevant to KYC/AML obligations or regulatory investigations. If the Provider has reasonable grounds to believe that the Advertiser or any of its associated Campaigns are involved in unlawful activity (including but not limited to money laundering, fraud, sanctions violations, or operation of unlicensed services), the Provider may, without prior notice:

• suspend or restrict the Advertiser’s access to the Platform;
• withhold or delay disbursement of payments;
• request enhanced due diligence information; or
• report the matter to the relevant authorities, including competent EU or national regulatory bodies.

Campaign. Campaign performance shall be measured based on Specified Actions attributable to Affiliate activity. The Advertiser shall ensure that each Affiliate has accepted the applicable Service Agreement via the Platform.

Setup and Management. The Advertiser is solely responsible for configuring and managing each Campaign, including providing accurate, complete, and legally compliant details such as the offer description, payout terms, and tracking requirements. The Advertiser shall promptly review and approve or reject Affiliate conversion claims in accordance with the Service Agreement. The Advertiser shall ensure that Specified Actions are correctly tracked and attributed by the Platform and that all Campaigns comply with applicable laws, advertising standards, and Platform policies.

Responsibilities After Termination. In the event of termination of the Service Agreement between the Advertiser and the Provider, the Advertiser shall remain solely responsible for communicating with its Affiliates and fulfilling any outstanding obligations, including unpaid commissions, final reporting, and notice of termination. The Provider shall have no obligation to facilitate, enforce, or mediate any payments or disputes between the Advertiser and its Affiliates. Following such termination, Affiliates shall lose access to Campaign-related data and tools associated with the Advertiser’s account. Where technically feasible, the Provider may generate a final summary report; however, the Provider does not guarantee continued access to historical Campaign data.

Use for Intended Purpose Only. You may only use the Platform for its intended purpose of facilitating and managing B2B Affiliate Marketing. Any other use is prohibited.

Prohibited Industries and Content. The Services must not be used in connection with any activity, product, or content that is unlawful, misleading, or subject to specific regulatory approval without such approval having been duly obtained. In particular, use of the Platform in connection with the distribution or promotion of illegal goods or services, counterfeit items, unlicensed pharmaceuticals, malware, prohibited adult content, hate speech, or other materially harmful or deceptive practices is strictly prohibited. Furthermore, Advertisers acting in regulated or high-risk sectors such as online gaming, financial services, adult entertainment, or health-related services shall be solely responsible for ensuring that all required licenses, registrations, or disclosures are duly in place in all relevant jurisdictions prior to engaging in any related activity via the Platform, subject to possible verification by the Provider.

Intellectual Property Respect. Advertisers are strictly prohibited from using the Platform in a manner that infringes the intellectual property rights of third parties. Each Advertiser remains solely responsible for any content or materials made available through the Platform or used in connection with campaigns, including (without limitation) text, images, software, logos, trademarks, and brand elements. No Advertiser may upload, distribute, promote, or otherwise exploit content for which it lacks the necessary usage rights or licenses. Advertisers must not instruct Affiliates to promote materials that violate copyright, trademark, or other proprietary rights. Affiliates must not use third-party brand assets, impersonate Advertisers or other businesses, or suggest false affiliation or endorsement. Any use of the Advertiser’s own brand assets within the Platform (including via white-label features or custom interfaces) may only occur where the Advertiser holds full rights to such materials. The Provider does not verify such rights and bears no responsibility for infringing use by users of the Platform.

Technical Misuse. You shall not misuse the Platform’s technical infrastructure. Prohibited behaviors include:

• Any conduct that hinders or disrupts the operation of the Services or the experience of other users. This includes attempting to overload the system (e.g., by making repetitive intensive requests), introducing malware, or launching denial of service attacks.
• Any attempt to gain unauthorized access to the Platform, its servers, or other accounts. You must not try to bypass security measures, probe vulnerabilities, or decrypt any data transmitted to or from the Platform.
• Any attempt to decompile, disassemble, or reverse engineer the Platform or any software provided as part of the Services. Also, you must not attempt to extract source code or create derivative works based on the Platform.
• Any attempt to use automated scripts, bots, or scrapers to collect information from the Platform or otherwise interact with the Services, except as explicitly allowed (for instance, the Provider may offer APIs for certain functions; those can be used according to their terms). Unauthorized scraping or harvesting of data (e.g., other users’ information) is forbidden.
• Except as expressly permitted by these Advertiser Terms, you may not share, sell, or rent your access to the Platform to any third party. Also, you must not use your access in a “service bureau” manner to process data for third parties not party to the agreement (i.e., you can’t use one Advertiser account to run an affiliate program for multiple companies without permission).
• You must not use the information or interface of the Platform to build a competing platform or service. For example, you cannot copy features, user interface elements, or content for competitive purposes. You also must not white-label or resell the Platform to third parties without authorization (aside from using white-label features to present it as your program interface to your Affiliates, as intended – that is allowed).

Forbidden Activities List. Without limiting the foregoing, the following activities are explicitly forbidden on or in relation to the Services:

• Using the Services to engage in any fraudulent, deceptive, or illegal act;
• Knowingly exploiting any bugs or errors in the Platform to gain unfair advantage or access unauthorized data;
• Disseminating viruses or harmful code through the Platform;
• Collecting or harvesting personal data about other Advertisers and Affiliates without consent;
• Aiding or abetting any third party in any of the above.

Right to Monitor and Investigate. The Provider generally does not monitor the specific dealings between Advertisers and Affiliates or the content of campaigns. However, the Provider reserves the right to investigate any activity on the Platform that it becomes aware of which may violate these Advertiser Terms or applicable law. This may include collecting information from Advertisers and Affiliates, examining data or content in our systems (in accordance with our Privacy Policy and applicable law), and cooperating with law enforcement or regulatory authorities in any investigation. If the Provider suspects any prohibited conduct, it may take action immediately, including suspension of accounts, even while an investigation is ongoing. You consent to such monitoring and agree to cooperate with the Provider’s investigations (for example, providing information or ceasing certain activities on request).

Consequences of Violation. If you violate any part of Section 8:

• The Provider may immediately suspend or terminate your Account without prior notice (especially in cases of severe or obvious violations, e.g., fraud or illegal activity);
• You may forfeit any fees or payments (and may not be refunded if terminated for breach);
• The Provider may delete or disable any offending content (for example, remove a tracking link or marketing material that is found to be illegal or infringing);
• The Provider may ban you from future use of the Platform and place you on an internal watchlist to prevent re-registration;
• You will be liable for any damages incurred by the Provider as a result of your breach. This includes liability for any claims made by third parties against the Provider due to your conduct;
• Law enforcement or regulatory bodies may be notified if your conduct violates criminal laws or regulations.

Provider’s Right to Refuse Service. The Provider retains the right to refuse service to anyone for any lawful reason. This means the Provider can decide not to onboard a potential Advertiser, or to discontinue service to an Advertiser, particularly if the Advertiser’s presence or behavior on the Platform is deemed by the Provider to pose risk or is objectionable. The Provider may do so even if the specific conduct might not be explicitly listed above, as long as the Provider has a good faith reason (for example, if the Provider learns that an Advertiser’s business is under investigation for fraud by authorities, even if that user hasn’t yet violated these Advertiser Terms on the Platform, the Provider might choose to terminate to avoid any association).

Reporting Violations. If you become aware of any user engaging in any prohibited conduct or violating these Advertiser Terms (for example an Advertiser running a scam), you are encouraged to report it to the Provider at legal@scaleo.io.

Non-Use and Non-Disclosure. Each party agrees to treat the other party’s Confidential Information, as defined in Section 2.9, as confidential and to protect it from unauthorised use or disclosure using at least a reasonable standard of care, consistent with customary practice in the digital services sector. For clarity, all data and materials stored or accessed by an Advertiser on or through the Platform, including but not limited to campaign settings, performance data, partner lists, and tracking configurations, are considered that Advertiser’s Confidential Information, subject to any rights of the Provider set out in these Advertiser Terms. Each party agrees not to disclose the other party’s Confidential Information to third parties or use it for any purpose outside the normal operation of the Platform, except as required by law or with the disclosing party’s consent. Reasonable technical and organisational safeguards should be used to prevent unauthorised disclosure. Confidentiality obligations do not apply to information that is publicly available, independently developed without use of the disclosing party’s information, or lawfully obtained from a third party without restriction.

Permitted Disclosures. Despite the above, the Provider is permitted to:

• access, store, and process the Advertiser’s data for the purpose of operating, maintaining, securing, and improving the Platform;
• use anonymised or aggregated data derived from Advertiser activity for statistical, benchmarking, or service improvement purposes, provided no individual or personal data is identifiable.

Ownership of the Platform. The Platform, including all software, code, technology, algorithms, user interface designs, know-how, databases, and documentation, as well as the “Scaleo” name and logo and any related trademarks, are the exclusive intellectual property of the Provider. By using the Services, you do not acquire any ownership or title to the Platform or any of the Provider’s intellectual property. All rights not expressly granted to Advertisers in these Advertiser Terms are reserved by the Provider. The Provider’s intellectual property is protected by copyright, trade secret, trademark, patent (where applicable), and other laws. You shall not remove, alter, or obscure any copyright, trademark, or other proprietary rights notices on the Platform or output of the Services.

License to Use. The Platform is provided as a service on a subscription or access basis – it is not “sold”. Subject to your compliance with these Advertiser Terms, the Provider grants you a limited, non-exclusive, non-transferable, non-sublicensable revocable license to access and use the Platform during the term of the agreement under these Advertiser Terms solely for your internal business purposes in connection with Affiliate Marketing. This license allows you to use the Platform’s features to run your affiliate program (e.g., discovering new affiliates, creating links, viewing reports).

Restrictions on Use of Platform IP. Except as expressly permitted by these Advertiser Terms or by law, you shall not:

• Copy, reproduce, distribute, or create derivative works of any part of the Platform or its software;
• Modify, adapt, or hack the Platform, or attempt to gain unauthorized access to the Platform or its related systems;
• Reverse engineer, decompile, or otherwise attempt to extract the source code of the Platform, except to the limited extent such actions are expressly permitted by applicable law despite a contractual prohibition (in which case, you shall first request the Provider to provide necessary information and wait at least 30 days for a response);
• Use any automated system (like a “robot” or “spider”) to access the Platform for scraping or data mining (except as permitted by an API);
• Remove or alter any branding, logos, or legal notices on the Platform;
• Use the Provider’s name, trademarks, logos, or other intellectual property in any way.

Your Content and Data. As an Advertiser, you may input or upload data, content, or materials into the Platform in the course of using the Services (for example: campaign descriptions, creative assets, affiliate contact info, performance data, etc.). You retain all rights and ownership to your own content and data that you upload to the Platform, subject to the Provider’s rights to use that data to provide the Services. By using the Platform, you grant the Provider a non-exclusive, worldwide, royalty-free license during the existence of your Account to use, process, transmit, and display your content and data only as necessary to provide the Services to you and to fulfill the Provider’s obligations (including for backup, troubleshooting, or as otherwise required by law or permitted by our Privacy Policy). The Provider will not use your content for marketing or other purposes without your consent, except that:

• The Provider may use aggregate and anonymized data derived from your usage (combined with other users’ data) to improve the Platform or for industry analytics. Such aggregated data will not identify you or any individual and is not considered Confidential Information;
• Any personal data in your content will be processed per Section 12 (Data Protection) and the Data Processing Agreement if applicable.

Feedback and Suggestions. We appreciate feedback on our Services. If you, as an Advertiser, provide the Provider with any Suggestions, you acknowledge that such Suggestions are non-confidential and you grant the Provider an unrestricted, perpetual, irrevocable, sublicensable, transferable, worldwide, royalty-free license to use and incorporate those Suggestions in any manner, without any obligation of attribution or compensation to you. To the extent possible under applicable law, you also waive any moral rights you may have in the Suggestions.

Business References. Unless you expressly refuse, the Provider may identify you (if you are an Advertiser) as a customer for promotional purposes. Specifically, you grant the Provider permission to use your company name and logo as a reference on the Website and marketing materials, solely to indicate that you are an Advertiser on the Platform. This includes listing your name/logo alongside other customers and a factual statement of the general nature of services provided (e.g., “XYZ uses Scaleo to manage its affiliate program”). This permission is royalty-free, worldwide, and for the duration of the agreement under these Advertiser Terms (and a reasonable time thereafter, e.g., to use in a printed brochure until exhausted). If you do not wish to be included as a reference, you can notify the Provider in writing (email to support or legal) at any time, and the Provider will remove your name/logo in future materials (with a reasonable grace period).

Term. These Advertiser Terms shall remain in effect for the duration of the Advertiser’s active Subscription Term to the Service. These Advertiser Terms shall expire and the Advertiser’s role will terminate upon expiration of the Subscription Term. The Parties acknowledge and agree that electronic acceptance of these Advertiser Terms shall have the same legal effect as a signed written contract under Czech law.

Termination for Changes to Advertiser Terms. If the Provider amends these Advertiser Terms in a way that materially affects the rights or obligations of the Advertisers (and not simply to comply with law or minor edits), Advertisers have the right to reject the changes. In such a case, the Advertiser must notify the Provider in writing (including by email) of the rejection within 30 days of being informed of the new Advertiser Terms.

Termination for Breach. Either party may terminate these Advertiser Terms immediately if the other commits a material breach. The Provider may suspend immediately and without notice if the Advertiser engages in fraud, breaches Section 8 of these Advertiser Terms, threatens the Platform’s integrity, or fails to pay amounts due.

Termination for Insolvency or Legal Status. Either party may terminate these Advertiser Terms immediately by written notice if the other party: (i) becomes insolvent or is generally unable to pay its debts as they become due; (ii) files or has filed against it a petition for voluntary or involuntary bankruptcy or pursuant to any other insolvency law, which in the case of an involuntary petition is not dismissed within 60 days; (iii) makes or seeks to make a general assignment for the benefit of its creditors; or (iv) applies for or consents to the appointment of a receiver, trustee, or similar agent for a substantial part of its assets or business. Additionally, the Provider may terminate the Advertiser Terms if the Advertiser’s legal entity is dissolved or undergoes liquidation (except for corporate restructuring or merger where the successor assumes the Advertiser Terms).

Effects of Termination. Upon expiration or termination of the Advertiser Terms:

• Cease of Access. The Advertiser’s rights to access or use the Platform will cease. The Provider will disable the Advertiser’s login credentials. Advertisers must immediately stop using the Platform and ensure that any of their Affiliates can no longer access it (if the Advertiser was providing a white-labeled portal).
• Continuing Clauses. Notwithstanding the termination for any reason, those provisions which by their nature are intended to survive such termination shall remain valid and effective. In particular (but not limited to), the provisions concerning: confidentiality and the handling of confidential information; personal data protection and processing; intellectual property rights; indemnification; limitations of liability; representations and warranties; and payment obligations incurred prior to termination shall remain in force. These provisions shall continue to bind the parties even after the termination of the Advertiser Terms, in accordance with their terms.

No Refund on Breach Termination. If this agreement is terminated by the Provider due to your breach or violation of these Advertiser Terms, you are not entitled to any refund or compensation for any remaining Billing Period or unused services.

Termination Not Exclusive Remedy. Termination of the agreement as provided above is not an exclusive remedy and the exercise by either party of any remedy (including termination) shall be without prejudice to any other remedies it may have under this agreement, by law, or otherwise.

Service Agreement termination. Termination of any agreement between Affiliate and Advertiser will not affect these Advertiser Terms’ validity and effectiveness.

Visibility of Advertiser Data to Affiliates. The Advertiser acknowledges and agrees that certain data concerning the Advertiser (such as name, product details, and performance-related information) shall be made accessible to the Affiliate(s) utilized by the Advertiser via the Platform. This data is required by Affiliates for the purpose of managing their relationships, including tracking conversions, administering commissions, and ensuring compliance with campaign-specific terms. Each Affiliate shall act as an independent data controller in respect of any personal data it receives through the Platform or otherwise processes for its own purposes. The Provider shall not be held responsible for any further processing of personal data carried out by Affiliates outside the scope of the Platform. The Advertiser is advised to review any applicable privacy notices issued by Affiliates. In the event the Advertiser has concerns regarding the handling of personal data by a specific Affiliate, the Advertiser should address such concerns directly with that Affiliate, or alternatively contact the Provider for clarification regarding data flows and roles on the Platform.

Advertiser’s Obligations. The Advertiser shall ensure that any personal data processed through the Platform — whether related to end users, consumers, Affiliates, or other data subjects — is collected and processed in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data, as amended. The Advertiser represents and warrants that it has a valid legal basis for all such processing (e.g., consent, performance of a contract, or legitimate interest), and that it has provided all legally required information to the relevant data subjects. The Advertiser is solely responsible for determining the purposes and means of processing any personal data it uploads, collects, or manages through the Platform and is considered a data controller (or joint controller, where applicable) under applicable law.

Technical and Organisational Measures. The Advertiser shall implement appropriate technical and organisational security measures to protect personal data processed via the Platform, including safeguards against unauthorised access, accidental loss, destruction, or alteration. The Advertiser is responsible for ensuring that its personnel, subcontractors, and Affiliates comply with these obligations.

Provider’s Role and Processing. The Provider acts as an independent data controller in respect of personal data it collects and processes for its own purposes (account administration, billing, compliance, etc.). The Provider shall process any personal data received from or on behalf of the Advertiser only for the purpose of providing and operating the Platform and related services. Such processing shall be carried out in accordance with the Provider’s Privacy Policy, as amended from time to time, and in accordance with applicable data protection laws. Where the Provider acts as a processor on behalf of the Advertiser (e.g., in handling user, consumer, or Affiliate data), the Provider shall make available a standard Data Processing Agreement that reflects the requirements of Article 28 GDPR.

Controller responsibilities. The parties acknowledge that, save as expressly set out in the DPA, each acts as an independent controller for its own purposes. Section 12 applies only to Personal Data for which the Provider is a controller. Processing carried out by the Provider on behalf of the Advertiser is governed exclusively by the DPA, which prevails over any conflicting wording in this Section.

No Warranty. The Provider disclaims all warranties and representations not expressly stated in these Advertiser Terms, to the maximum extent permitted by law. The Platform and Services are provided on an “as is” and “as available” basis. Use is at your own risk. The Provider does not guarantee that the Services will be uninterrupted, error-free, or completely secure. The Provider does not make any guarantee regarding results you may achieve (e.g., number of sales, that an Advertiser will order, or that Affiliates will perform well), or that the Platform will meet all of your requirements. To the fullest extent permitted by applicable law, the Provider expressly disclaims any implied warranties, terms or conditions of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, title, and any warranties arising from trade usage, course of dealing, or course of performance. The Provider also disclaims any warranty that the Services will be free of viruses or other harmful components, or that any data will be secure or not otherwise lost or altered.

Responsibilities Acknowledgment. You understand and agree that the Provider is not an insurer or guarantor of your success. Advertisers are responsible for vetting their Affiliates and ensuring their offers comply with the law. Affiliates are responsible for vetting the programs they join and ensuring their marketing practices comply with the law.

Third-Party Content and Interactions. The Provider makes no warranties regarding any third-party content, information, or services obtained through the Platform, including any content provided by or about other users. For example, the Provider does not warrant that an Advertiser’s posted description of its affiliate program is accurate or complete, or that an Affiliate’s promotional content will not infringe. Those are matters outside the Provider’s control.

Non-involvement. Any disputes you have with another Advertiser or Affiliate are solely between you and that party, and you release the Provider from any claims, liability and damages arising out of any such disputes.

Limitation of Liability. Except for indemnification obligations or a breach of confidentiality or data protection (which are addressed separately):

• Neither party will be liable to the other for any indirect, incidental, consequential, special, punitive, or exemplary damages, or for any loss of profits, revenue, goodwill, business opportunity, or anticipated savings, or loss or corruption of data, even if advised of the possibility of such damages and even if a remedy fails of its essential purpose. This exclusion applies to all causes of action, whether in contract, tort (including negligence), strict liability or any other theory;
• The Provider’s total cumulative liability to you (and your affiliates) for all claims arising out of or relating to this agreement or the use of the Services shall not exceed the total amount of fees actually paid (or payable) by you to the Provider under this agreement in the twelve (12) months immediately preceding the event giving rise to liability, or EUR 100 whichever is higher. This limitation is aggregate for all claims; multiple claims will not enlarge the cap;
• Nothing in these Advertiser Terms shall limit or exclude either party’s liability for: (i) death or personal injury caused by its negligence or willful misconduct; (ii) gross negligence or willful misconduct; (iii) fraud or fraudulent misrepresentation; or (iv) any other liability which cannot be limited or excluded by applicable law.

Indemnification. The Advertiser agrees to indemnify and hold harmless the Provider, its affiliates, and their respective officers, directors, employees, and agents, from and against any third-party claims, demands, suits, or proceedings (“Claims”) and related liabilities, damages, penalties, and reasonable costs (including legal fees), solely to the extent such Claims arise from:

• the Advertiser’s breach of its obligations under these Advertiser Terms;
• the Advertiser’s affiliate program or promotional content infringing third-party rights, provided the content was not supplied or approved by the Provider;
• failure to comply with applicable laws or regulations in jurisdictions where the Advertiser operates.

Exceptions. This indemnity does not apply to the extent the Claim arises from the Provider’s own breach or negligence. The indemnified party must promptly notify the indemnifying party of any Claim. Delay in notification only relieves the indemnifying party of its obligations if materially prejudiced. The indemnifying party has the right to control the defense and settlement of the Claim, subject to obtaining consent from the indemnified party for any settlement imposing material non-monetary obligations. The indemnified party will reasonably cooperate at the indemnifying party’s cost.

Governing Law. These Advertiser Terms, and any disputes arising out of or related to them, shall be governed in all respects by the laws of the Czech Republic, without regard to its conflict of law principles that would result in the application of the laws of another jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Advertiser Terms.

Jurisdiction and Venue. The parties agree that any disputes or claims arising out of the Advertiser Terms shall be subject to the exclusive jurisdiction of the courts with jurisdiction over the Provider’s registered office (Prague, Czech Republic), which shall be the proper forum. Each party irrevocably consents to the personal jurisdiction of these courts and waives any objection (including any objection based on inconvenient forum) to the bringing of any such action in such jurisdiction. For the avoidance of doubt, disputes solely between Advertiser and Affiliate will follow the governing-law clause of the Service Agreement.

Notices. Written notices required or permitted under these Advertiser Terms shall be given in writing and delivered to the respective addresses or contact emails of the parties. The Provider’s official notice address is its registered office (see Introduction) and/or info@scaleo.ai for electronic notices. Your notice address is the email or mailing address you provided upon registration, or any updated address you provide via your account. Notices shall be deemed given:

• If sent by email, on the date the email is transmitted to the proper address and no bounce or error message is received (with a copy saved showing date/time of sending);
• If delivered by hand or by courier, upon delivery;
• If sent by registered or certified mail (return receipt requested), on the date of receipt as confirmed by postal records.

For routine operational communications (like support or system updates), the Provider may send communications via the Platform interface or to any email on record for your Account. Those operational communications are not formal legal notices but are binding for day-to-day matters.

Assignment. You may not assign or transfer this agreement (in whole or in part), nor delegate any obligations, to any third party without the prior written consent of the Provider. Any attempted assignment in violation of the foregoing shall be null and void. The Provider may assign or transfer this agreement freely to (i) an affiliate, (ii) an acquirer of its business or assets, or (iii) a successor by merger. This agreement shall be binding upon and inure to the benefit of the parties and their respective permitted successors and assigns. There are no third-party beneficiaries to this agreement, except as explicitly provided (for example, indemnified parties). In the event of a permitted assignment by you (with consent), you must ensure the assignee agrees in writing to be bound by all terms of these Advertiser Terms.

Force Majeure. Neither party shall be liable for any delay or failure in performance (excluding payment obligations) due to causes beyond its reasonable control, such as natural disasters, pandemics, war, terrorism, civil disturbances, governmental actions, labor disputes, internet or utility failures, or other force majeure events. However, the affected party must promptly notify the other of the event, and make reasonable efforts to mitigate its effects and resume performance. If a force majeure event continues for more than thirty (30) days, either party may terminate these Advertiser Terms upon written notice to the other without further liability (other than refund of any prepaid fees for periods after termination, in the case of an Advertiser termination).

Entire Agreement. This agreement constitutes the entire agreement between the parties with respect to the subject matter hereof, and supersedes all prior or contemporaneous agreements, understandings, or communications, whether written or oral, relating to the subject matter.

Severability. If any provision of these Advertiser Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision will be severed to the minimum extent necessary so that the agreement can otherwise remain in effect. The remaining provisions of these Advertiser Terms will remain valid and enforceable. If a severed provision is essential to the Advertiser Terms and its removal would fundamentally alter the obligations of the parties, the parties shall negotiate in good faith to amend the agreement to give effect to the original intent as nearly as possible.

Relationship of the Parties. The parties are independent contractors. Nothing in this agreement is intended to or shall create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the parties. Neither party has authority to contract or bind the other in any way. Advertisers and Affiliates also each act in their own capacity and not as subcontractors or agents of the Provider. The Provider provides a platform; users collaborate or transact directly with each other at their own risk and responsibility.

Export Compliance. The Services and Platform may be subject to export control and sanctions laws. You agree to comply with all export and re-export restrictions and regulations (including U.S. Export Administration Regulations, EU export controls, and similar laws) that may apply. You represent that you are not named on any government denied-party list, and you shall not permit users from any U.S.-embargoed or EU/UN-sanctioned countries (currently e.g., Cuba, North Korea, Syria, Iran, and the region of Crimea) to access or use the Services without appropriate authorization.

Language. This agreement is drafted in the English language, which the parties agree is the official language and controlling in all respects. Any translations (if provided) are for convenience only. All communications and notices shall be in English unless otherwise required by law. If there is a version of these Advertiser Terms in another language and a dispute arises over interpretation, the English version shall govern.

Hierarchy. In case of conflict (i) the DPA prevails over Section 12 of these Terms for processor-related matters; (ii) these Advertiser Terms prevail over the DPA for all other matters.

About Scaleo. We are Scaleo Solutions s.r.o., ID No.: 276 34 051, VAT No.: CZ27634051, with its registered office at V přístavu 1585/10, 170 00 Prague, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 120368. We provide a marketplace system that is used to connect Affiliates and Advertisers, create Campaigns and structure, monitor, analyze and manage data for Affiliate Marketing purposes.

Relationship to Advertiser Terms of Service. This DPA forms part of, and is subject to, the Advertiser Terms of Service between the same parties (the “Main Agreement”). Capitalised terms not defined here have the meaning given in the Main Agreement. For the activities listed in Annex 1 the Provider acts strictly as Processor; for its own billing/KYC data it acts as independent Controller as described in Section 12 of the Advertiser Terms. Acceptance. This DPA takes effect on the date the Advertiser first accepts the Advertiser Terms and remains in force for as long as the Processor processes Personal Data on behalf of the Controller.

Definitions. To make the text easier to read, we have prepared definitions of the terms we use in this DPA. If you encounter other terms in this DPA which are not specified below, such terms then have a meaning defined in the Advertiser Terms, or elsewhere in this DPA.

• The “Controller” is your company that uses Scaleo, based on the applicable Terms.
• The “GDPR” refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• The “DPA” refers to this Data Processing Agreement.
• The “Processor” is Scaleo Solutions s.r.o., which processes Personal Data on behalf of the Controller and only on the Controller’s documented instructions.
• The “Terms” are the terms on which we provide Scaleo to you. Different Terms may apply depending on which version of Scaleo you use.

Main Agreement. The Processor and the Controller cooperate on the basis of a contractual relationship which is based on the Main Agreement. The Processor provides the Controller with Scaleo and possibly other Services. Within the framework of this cooperation, personal data are or may be transferred by the Controller to the Processor. A purpose of processing and the funds for such processing are determined and provided by the Controller, and the Processor further processes the personal data for the Controller within the limits of this DPA and applicable legal regulations (mainly the GDPR).

Processing. This DPA defines the rights and obligations of the Parties with regards to the processing of personal data.

Terms. Unless otherwise provided for in this DPA, the terms used therein shall have the same meaning as in the Main Agreement, especially as in the applicable Terms.

Categories of data subjects. The Processor is authorised to process Personal Data relating to the following groups only:

• Affiliates (natural persons acting as referral partners of the Controller);
• End-users who are directed to the Controller’s websites or apps by Affiliates;
• Employees or agents of the Controller who access the Platform on the Controller’s behalf.

Personal Data. On behalf of the Controller, the Processor may process the personal data listed below, each as further described below (collectively the “Personal Data”):

The Processor shall not intentionally collect or create any other category of Personal Data without the Controller’s prior written instruction.

Special categories. The Processor does not process any special categories of personal data as these are described in the GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union memberships; processing of genetic data, biometric data or data concerning health or sex life or sexual orientation of a data subject). Should the Controller nevertheless require such processing, the parties will first execute a written addendum specifying safeguards and lawful basis.

By the Controller. The processing will be carried out by the Controller providing the Processor with access to the Personal Data.

Purpose of processing. The Processor will process any Personal Data solely for the purpose of providing Scaleo and its Services as per the Main Agreement. The Processor will never use or transfer the Personal Data for its own benefit or for the benefit of a third party. The Processor processes Personal Data solely for:

• hosting and operating the Platform and Services;
• tracking, attributing and analysing Specified Actions;
• detecting fraud; and
• providing related support to the Controller.

Instructions for processing. The Controller may provide the Processor with instructions regarding the processing of Personal Data. The main instruction for the processing is this DPA. The Controller’s documented instructions to the Processor are given in three ways:

• This DPA — the baseline instruction set.
• Configuration actions carried out by the Controller inside the Platform interface or by API call. For example creating or editing a Campaign and Specified Actions, selecting retention settings, activating fraud-filters, or exporting data. Every such digital action is automatically time-stamped and logged by the Platform and constitutes a valid written instruction for the corresponding processing activity.
• Any additional instructions issued in text form (e-mail, ticketing portal or digitally-signed PDF) by an authorised representative of the Controller.

The Controller is authorized to extend the purpose of processing in accordance with the law or give additional instructions, whereby instructions for further processing can only be communicated to the Processor in writing. For this DPA, e-mail communications between the Parties addressed to the authorized persons shall also be deemed to be in writing.

Methods of processing. Processing of the Personal Data by the Processor will consist of collection, recording, sorting, transmission, and storage, as well as other activities necessary for the performance of the Main Agreement. The Processor may process the Personal Data by automated and, where applicable, manual means, so that this activity corresponds to the purpose of the processing of the Personal Data as per this DPA.

Illegality notice. If the Processor believes an instruction infringes Union or Member-State data-protection law, it shall promptly notify the Controller and suspend the relevant processing until the instruction is confirmed, amended or withdrawn.

Measures. The Processor undertakes to take technical, organizational, and other measures that shall prevent unauthorized or accidental access to the Personal Data, their change, destruction, loss, or other unauthorized treatment of the Personal Data. The Processor undertakes in particular:

• To use secured access to computers and other devices where Personal Data could be processed, where access information is known only to the Processor and its employees;
• To use secured access to Scaleo or another database of the Personal Data, so that the Personal Data are not made available to a third party;
• To use only software and services that comply with standard requirements for data security for the purpose of Personal Data processing;
• Not to make copies of the database of the Personal Data without the prior consent of the Controller;
• To use suitable methods of security, e.g., encryption or other convenient and necessary means always depending on the particular act and Personal Data being processed;
• Not to allow access to the Personal Data to any third parties, unless such access is approved in writing by the Controller or unless it arises from the DPA;
• To maintain confidentiality regarding the Personal Data.

Other obligations. The Processor also undertakes:

• To process the Personal Data only in such a form in which they were transferred to it by the Controller;
• To process the Personal Data only for the purpose defined by the DPA and solely to the extent necessary for the fulfillment of such purpose;
• Not to merge Personal Data obtained for different purposes or from different controllers;
• To keep the Personal Data only for the period specified in the information obligation or end-user consent. Unless otherwise agreed between the Processor and the Controller, the Controller is obliged to inform the Processor of the expiry of this period. On the basis of such notification, the Processor shall cease to process the Personal Data.

Restricted processing. The Processor is obliged to ensure that employees and other persons authorized by the Processor to process the Personal Data only do so to the extent and for the purposes of this DPA and the GDPR.

Compliance. Both the Processor and the Controller undertake to comply with the obligations set out in the GDPR and other generally binding legal regulations relating to this activity when processing the Personal Data based on this DPA.

Correctness. The Processor undertakes to correct, update, delete or transfer the Personal Data as instructed by the Controller without undue delay after such request.

Requests of data subjects. When a data subject exercises a right as per the GDPR or any applicable legal regulation, the Controller agrees to deal with such a request as per the applicable regulation. When required, the Controller shall delete the affected Personal Data from Scaleo itself (e.g., request for a deletion, objection to processing based on a legitimate interest of the Controller etc.). If such an action cannot be made by the Controller itself, the Processor undertakes to make such an action without undue delay after the written notice of the Controller. E-mail communication of the Parties shall also be considered as written form. When the Processor receives a request from a data subject, it agrees to provide such a request to the Controller without undue delay.

Professional care. When fulfilling the obligations under the DPA, the Processor shall be obliged to proceed with professional care, observe the Controller’s instructions and act in the interests of the Controller.

Sub-processors. The Processor shall be entitled to involve other processors (the “Sub-processor”) in the processing of the Personal Data, in particular storage and cloud solution providers, operators of other software necessary and currently available on the market for the purpose of services that meet the standards set by the European Union, and other service providers necessary to fulfill the purpose of this DPA and the Main Agreement, without any additional explicit specific permission from the Controller. The Processor must enter into a written DPA with each Sub-processor imposing data protection terms of the standard required by this DPA. The Processor remains liable to the Controller if a Sub-processor fails to fulfill its data protection obligations. The current list of Sub-processors is available from the Processor on request. The Processor shall ensure that any international transfer of Personal Data by a Sub-processor is carried out under a valid transfer mechanism in accordance with Chapter V GDPR (e.g., EU Standard Contractual Clauses, adequacy decision, or Binding Corporate Rules).

Notice of new Sub-processors. The Processor maintains an up-to-date list of its Sub-processors in the Appendix 1 of this DPA. The Controller is obliged to review the list itself. The Controller is entitled to raise objections against the involvement of any new Sub-processor and may do so within 30 days of the date when the information about the new Sub-processor was made available by the Processor. The Controller only agrees to raise an objection for a valid reason which it agrees to disclose to the Processor, as an unfounded objection could influence the provision of the Services by the Processor.

Audit. The Processor undertakes to provide the Controller with any information necessary for proving that the duties stipulated by this DPA or by the GDPR relating to the Personal Data were fulfilled and to allow the Controller or a third party to carry out an audit to a reasonable extent. The intention to carry out the audit shall be notified by the Controller to the Processor by e-mail. After this notification, the Parties shall agree on the date of the audit, which shall occur no later than 30 days after the receipt of this notification. If the Parties do not agree on the audit date, it shall be determined by the Processor. The audit shall not unduly interfere with the activities of the Processor. The costs of the audit are covered by the Controller. The Controller shall maintain the confidentiality of any information discovered during the audit concerning the Processor, in particular its security policies and standards. The Controller shall oblige third parties authorized by it to carry out the audit to the same extent. Any audit time exceeding four (4) hours per calendar year shall be chargeable to the Controller at the Processor’s then-current professional rate.

Cooperation. Upon the Controller’s reasonable request, and considering the nature of the processing, the Processor will provide reasonable assistance to the Controller in fulfilling the Controller’s obligations under applicable data protection laws (including data protection impact assessments and consultations with regulatory authorities), provided that the Controller cannot reasonably fulfill such obligations independently. The Processor is entitled to request additional compensation for such cooperation.

Data-breach notification. The Processor shall notify the Controller without undue delay and, where feasible, within 24 hours after becoming aware of a Personal-Data Breach affecting the Personal Data. The notice shall contain at least the information required by Article 33(3) GDPR, to the extent available.

Effectiveness. This DPA shall be effective for the duration of the Main Agreement (see Paragraph 1.1 of the DPA).

Termination. In the event of any termination of the DPA or termination of the Personal Data processing, the Processor shall be obliged to destroy immediately the Personal Data provided to it or any copies thereof, unless otherwise provided by this DPA and/or the Main Agreement, in particular if there is another legal reason for their processing or if the Parties agree that the Personal Data will be returned to the Controller. The Processor shall, within 30 days of termination, delete all Personal Data from active systems and, within 90 days, from backups, unless Union or Member-State law requires storage.

Confidentiality. The Processor undertakes to maintain the confidentiality of the Personal Data processed; in particular, the Processor shall not publish them, spread them, or transfer them to other persons except for the persons in an employment relationship with the Processor or other authorized persons entrusted with the processing of the Personal Data. The Processor shall be obliged to ensure that also its employees and other authorized persons comply with the duty of confidentiality. This obligation of the Processor continues even after the termination of this contractual relationship.

Safety measures. The Processor undertakes to maintain confidentiality concerning the safety measures taken to secure the Personal Data protection, even after the termination of this contractual relationship. The Parties expressly agree that the Processor is entitled to disclose its general security standards, which it undertakes to follow, and such disclosure shall not breach this obligation of confidentiality.

Liability. If the Processor breaches its obligations under this DPA or the GDPR, it shall be liable for damages resulting from such violation. However, the Processor is not liable for any unauthorized processing of the Personal Data by the Controller.

Limitations. Any liability of the Processor under this DPA is subject to the limitations and exclusions set out in Section 13 of the Advertiser Terms.

Appendix. This DPA is a binding and inseparable appendix to the Main Agreement.

Changes. Any change or amendment hereto shall be in writing and signed by both Parties.

Assistance. The Parties undertake to provide each other with all the necessary assistance and data to secure effective implementation hereof, in particular in the case of dealing with the Office for Personal Data Protection or other public authorities.

Czech Law. In the case that the contractual relationship established hereby contains an international element, the Parties agree that this DPA shall be governed by Czech law.

Czech Courts. In the event of disputes arising from this DPA, the Parties agree that any disputes will be resolved by the Czech courts. The Parties agree to the exclusive local jurisdiction of the court of the Processor’s registered seat.