Conditions générales de vente

General Terms and Conditions of Sale

Updated on June 5, 2025

The present General Terms and Conditions of Sale (hereinafter referred to as the "GTC") are entered into between the Client and the entity Valiuz (hereinafter referred to as "Valiuz") mentioned in the Purchase Order (hereinafter collectively referred to as the "Parties").

1. Definitions

"Activable Client" refers to a person whose Personal Data can be activated within the framework of the Services.

"Advertisement" refers to any advertising or promotional insertion (commercial advertisements, announcements, photos, inserts, etc.) from Advertisers, disseminated on Advertising Spaces.

"Advertiser" refers to an organization (and/or its Agent) soliciting Valiuz for the purpose of benefiting from the Services offered by Valiuz and designated within the Purchase Order.

"Advertising Space" refers to the space reserved for an Advertisement on a Media.

"Agent" refers to a natural or legal person designated by an Advertiser, acting in their name, on their behalf, and under their responsibility. This designation is made through a written agency contract for the purchase of Advertising Space, in compliance with applicable law.

"Applicable Personal Data Regulation" refers to (i) The General Data Protection Regulation (GDPR), specifically Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons regarding the processing and free movement of personal data, which supersedes Directive 95/46/EC (ii) All national laws or regulations that implement, ratify, transpose, or supplement the GDPR (iii) Any other mandatory local laws or regulations governing data protection and/or cybersecurity (iv) Any guidelines, recommendations, codes of conduct issued by the competent regulatory authority, or decisions rendered by competent courts or administrative bodies.

"Audience" refers to a set of Activable Clients presenting certain characteristics (e.g., family type, purchasing habits, location, etc.) and that can be used to target an Advertiser's Campaign.

"Campaign" refers to all advertising actions aimed at disseminating a message to promote the Advertiser's activity, Retailer, products, or services to an Audience.

"Client" refers to the Advertiser or its Agent.

"Client Data" refers to all information or data provided by the Client in connection with the use of the Services. Client Data may include pseudonymized Personal Data.

"Contract" refers to the contractual whole composed of a Purchase Order and these T&C, as well as their eventual Annexes.

"Documentation" refers to any document relating to the operation and use of Software that Valiuz regularly makes available to the Client.

"Insertion Order" refers to the Purchase Order used to reserve an Advertising Space. It specifies crucial details such as the Advertising Space's technical characteristics, targeted Media, Advertisement delivery timelines, dissemination methods, and pricing.

"Media" refers to the media on which Advertising Spaces appear, such as, for example: television, radio, press, display, internet, cinema, digital out-of-home advertising (DOOH), email, SMS, coupon, POS advertising, parcels, existing and authorized on the date of signature of this Contract, as well as all media that may be created or disseminated during the term of the Contract, and to which Valiuz has access in compliance with its editorial policy. Media may be published by a Retailer or by a third party.

"Personal Data" has the meaning given to it in the GDPR.

"Purchase Order" refers to a binding document between the Client and Valiuz, incorporating these T&C by reference. It details the subscribed Services, their description, and price. This document may also be referred to as an "Insertion Order" depending on the specific Services ordered.

"Retailer" refers to a Valiuz partner company that has authorized Valiuz to commercialize its Audiences and/or the Media it owns or publishes.

"Segment" refers to a set of information presented in aggregated form relating to Activable Clients and presenting certain characteristics, constructed according to the rules set out in the "Editorial and Responsible Advertising Charter" Annex and which can be used to execute the Services.

"Services" refers to all services provided by Valiuz to the Client within the framework of this Contract, as ordered in a Purchase Order.

"Software" refers to proprietary software or third-party software (including SAAS services) made available by Valiuz to the Client as part of certain Services.

"Study" or "Insight" refers to any analysis carried out by Valiuz on behalf of the Client and resulting from an interpretation of aggregated data.

"Technical Specifications" refers to the specifications required for the dissemination of an Advertisement and detailed in the document entitled "Technical Specifications", available upon simple request from Valiuz.

"User" refers to individuals (including non-human devices, such as applications or services) who are authorized by the Client to use the Software, under the Client's responsibility.

"Valiuz" refers to the Valiuz Group entity appearing on the Purchase Order providing the Services to the Client and responsible for compliance with these T&C.

"Valiuz Data" refers to all information or data provided by Valiuz for the execution of the Services, including data constituting the Audiences made available by Valiuz, and the results of the Services (Insights, reports, etc.). Valiuz Data may include pseudonymized Personal Data (e.g., cookie ID).

"Valiuz Group" refers to any entity, directly or indirectly controlled within the meaning of Article L233-3 of the French Commercial Code by Valiuz SAS.

2. Purpose, Application, and Enforceability of the T&C

These Terms and Conditions (T&C) define the terms for Clients to order Services from Valiuz and for Valiuz to provide them.

The Contract between the Parties, superseding all prior or current agreements (oral or written), including the Client's general terms and conditions of purchase, comprises the following documents, in decreasing order of priority:

The T&C and its Annexes;
The Specific Service Conditions (if applicable);
The Purchase Order(s) or Insertion Order(s) (where applicable);
The Documentation (if applicable).

The T&C version in effect on the Purchase Order's signature date applies. Clients are informed of the T&C before signing, and their signature signifies full, unreserved acceptance and adherence to these T&C (and any Specific Service Conditions agreed between the Parties).

Valiuz may modify the T&C at any time. New versions will be communicated to the Client by any means and will apply to unexecuted or in-progress Purchase Orders upon the Client's express acceptance.

3. Description of services

The Services that can be provided by Valiuz include:

"Advertising Space Commercialization": This Service allows the Advertiser to broadcast a Campaign on an Advertising Space. This Service includes making available the Advertising Space of a Retailer or reserving a third-party Media's Advertising Space on behalf and for the account of the Advertiser, as well as activating the Campaign on the Advertising Space.
"Audience Activation": This Service allows the Advertiser to broadcast a Campaign to a targeted Audience that Valiuz is authorized to commercialize, on a Retailer's Advertising Spaces and/or on any Media through which the Advertiser wishes to broadcast its Campaign.
"Insight Sharing": This Service allows for the use of an Audience for the purpose of conducting ad hoc statistical studies. This notably aims to enable the Client to understand the profile, purchasing behaviors, and needs of their own customers and prospects, without however enriching the profile of the individuals concerned.
"Performance Measurement": This Service allows the Advertiser to measure, through indicators, the impact of an advertising Campaign, particularly on sales made within a Retailer.
"Data Collaboration": This Service allows for the provision of Valiuz Data to an Advertiser or its Representative, in order to meet previously validated use cases for statistical analyses and/or marketing activation purposes.

Valiuz offers a catalog detailing its available services. The specific services selected by the Client are outlined in the corresponding Purchase Order. The Client understands that their order for Services is not contingent on the future delivery of functionalities or features, nor on any public verbal or written statements made by Valiuz concerning such future offerings.

4. Parties’s obligations

Upon accepting a service proposal, Valiuz issues a Purchase Order to the Client. The Client's signature on this Purchase Order signifies their unequivocal acceptance of its terms and these Terms and Conditions. Once accepted, the Purchase Order is considered final and cannot be modified by the Client.
4.2.1 Compliance with Technical Specifications

The Client is responsible for submitting all elements of the Advertisement to Valiuz within the Purchase Order's specified timeframe. These elements must comply with the technical specifications of the selected Advertising Space, as defined in the Purchase Order or communicated by Valiuz and/or the Media.

Valiuz is not obligated to verify the Advertisement's technical compliance. However, if Valiuz discovers non-compliant elements, it reserves the right to make necessary technical corrections to the Advertisement and invoice the Client for the cost of this operation.

The Client acknowledges and accepts that non-compliance with the technical requirements and prerequisites outlined herein and/or in the Purchase Order may lead to errors or omissions in the Advertisement's broadcasting, or a complete or partial inability to execute the Purchase Order (including broadcasting the Advertisement on the Advertising Space). Valiuz and/or the Media will not be held liable for such failures.

The Client guarantees that the Advertisement is free of any viruses or malicious code that could damage, threaten, compromise the integrity or confidentiality, disrupt operations, or divert the intended use of all or part of Valiuz and/or the Media's information system.

Valiuz reserves the right to suspend the execution of any Purchase Order without notice in the event of a technical failure that hinders or is likely to hinder the proper functioning of the Media. Failure to remedy the failure within the timeframe set by Valiuz will automatically result in the cancellation of programming, as stipulated in article 4.5 of these T&C.

4.2.2 Compliance of Advertisement Content

The Client guarantees that the Advertisement:

complies with applicable laws and regulations, including (but not limited to) provisions relating to consumer law, personal data protection, intellectual property rights protection, provisions applicable to unfair, misleading, aggressive commercial practices, or comparative advertising, rules specific to certain regulated sectors or products (e.g., tobacco, alcohol, games and lotteries, pharmaceutical products, legal services, etc.), as well as applicable regulations concerning environment (notably environmental claims) and climate, and mandatory provisions whose observance is necessary for the safeguarding of the social, political, and economic organization in the countries where they will be disseminated ("Police Laws");

complies with Valiuz's responsible advertising charter attached hereto;

rcomplies with applicable ethical or sectoral rules;

is not likely to offend public order or good morals or to shock the sensibility of the end-users of the Media, and notably their moral, religious, political or cultural convictions, and/or is not likely to harm the Media, damage its Retailer image, or challenge its neutrality;

does not infringe on the rights of third parties;

is not likely to create confusion in the minds of the end-users of the Media between the products promoted by the Advertiser and those offered by the Retailer and/or the Media, and/or does not mention or is not made for the benefit of a direct or indirect competitor of Valiuz, the Retailer, and/or the Media;

The Client undertakes to provide Valiuz, upon first request, with any document necessary to assess the compliance of the Advertisements with laws, regulations, and practices. It is specified that no stipulation shall limit Valiuz's indemnification by the Client concerning the guarantees granted under this article.

4.2.3 Hypertext Links (Redirections)

When authorized by Valiuz to provide access to content via its Advertisement, the Client undertakes that the content of any webpage accessed by redirection from the Advertisement (notably via a hyperlink) shall be directly related to the content of the Advertisement and/or comply with the redirection rules established by a Retailer (which will be communicated by Valiuz during the brief if applicable). To this end, the Client is hereby informed that, unless otherwise agreed in writing:

For Campaigns broadcast on a Retailer's Media: no outgoing redirection link is allowed.

For Campaigns broadcast as audience extension (on third-party Media) to an Audience provided by Valiuz: the link must redirect to the website of the Retailer from which the Audience originates when the Advertisement concerns a product sold by that Retailer.

In other cases, any redirection must be subject to prior written agreement from Valiuz.

The Client undertakes to provide Valiuz with the same guarantees on this webpage, particularly regarding legality, as those defined in article 4.2.2. above.

Valiuz cannot be held responsible for the services and/or content accessible via the hypertext links provided by the Client.

The Client shall be solely responsible for processing any requests (exchange, refund, discount, etc.), claims, or potential disputes, particularly those related to its contractual commitments, addressed to it by internet users following audience redirection to the webpage accessible from the Advertisement.
Valiuz has no obligation to control the legality or validity of Advertisements. However, Valiuz may, at its sole discretion, conduct or have conducted, including by a regulatory authority, any control to ensure the compliance of an Advertisement. Valiuz reserves the discretionary right to refuse to issue, suspend, cease execution, or cancel, with immediate effect and without prior notice, any Purchase Order when, in Valiuz's discretionary opinion, the Advertisement (i) is likely to engage its liability and/or its ethics and/or those of the Retailer and/or the Media; (ii) does not comply with the editorial line of the Media targeted by the Client; and/or (iii) does not comply with the terms of the Agreement and, in particular but not limited to, the rules relating to Advertisement compliance set out in article 4.2. hereof.

The Client shall then have a period of 24 hours from the suspension of the Purchase Order or from Valiuz's notification to the Client of the non-compliance of the Advertisement, to provide Valiuz with an Advertisement compliant with the Agreement. Failure by the Client to comply within the aforementioned period shall automatically result in the cancellation of the Purchase Order under the conditions provided for in article 4.5.

Any refusal, suspension, withdrawal, or cancellation under this article shall not engage Valiuz's liability, nor entitle the Client to any compensation, and is without prejudice to Valiuz's and/or the Media's right to seek compensation for any damages suffered.
If the Client fails to provide Valiuz with all the elements required for the execution of the Purchase Order, completely, compliantly, and within the timeframe specified in the Purchase Order, Valiuz shall be entitled to block the execution of the concerned Purchase Order, and the Client shall owe a fixed indemnity equal to 100% of the amount of the Purchase Order that Valiuz was unable to execute.
The Client shall not be entitled to any refund in case of cancellation of a Campaign after signing a Purchase Order and shall remain liable for the amount of all Purchase Orders signed and accepted as of the date of the request for modification, cancellation, suspension, or postponement.

In case of a request for cancellation, suspension, or postponement made by the Client, Valiuz may freely dispose of the Advertising Space stipulated in the Purchase Order, including for another campaign or another advertiser.

In case of a rescheduling request, if the initially targeted Advertising Space becomes unavailable on the new desired date, Valiuz shall have no other responsibility than to propose an alternative Advertising Space and/or Media of similar quality to the Client. In this case, Valiuz will send the Client a modified Purchase Order to be returned signed by the Client within the allotted time.
The Client acknowledges and agrees that Valiuz reserves the exclusive right to refuse or cancel any Purchase Order or Advertisement without explanation if it violates (i) the regulations set by the Retailers and/or Media involved, which Valiuz is bound to uphold ("Third-Party Requirements"), or (ii) the terms of this Agreement.

Should Third-Party Requirements evolve during a Campaign, leading to a conflict between the Advertisement and/or Purchase Order and these updated requirements while the Campaign is active, the Client understands and accepts that Valiuz will be obligated to halt the ongoing Campaign. In such an event, the Client's sole recourse will be a pro-rata reimbursement of the affected Purchase Order, based on the remaining broadcast period. No reimbursement or compensation will be provided if the Client (i) experiences a health scandal necessitating product withdrawal or immediate recall, or (ii) faces any other crisis significantly impacting the Retailer's and/or Media's image, particularly if the Campaign contradicts the Retailer's material, ethical, or moral interests (e.g., as outlined in the Retailer's Code of Conduct).
When specified in the Purchase Order, Valiuz may deliver Services in partnership with a third-party Sub-Broker. Valiuz will serve as the Client's primary contact, overseeing overall Campaign coordination and, if applicable, invoicing for the Sub-Broker's services. The Client acknowledges that no subcontracting relationship exists between Valiuz and the Sub-Broker, who bears sole responsibility for their actions and omissions. The Client agrees to be bound by the Sub-Broker's Terms and Conditions for all services and any Campaign-related issues. Valiuz is not liable for the Sub-Broker's non-performance or poor performance of the Service.
Valiuz may provide the Client with access to certain Software necessary for the execution of the Services, as specified in the applicable Purchase Order (e.g., access to a synchronization platform allowing the Client to define an Audience, activate a Campaign themselves, perform analyses on Valiuz Data, etc.).

Subject to compliance with the terms of the Agreement, and within the limits of the Service subscribed by the Client, Valiuz grants the Client, solely for the purposes of using the Services, a non-sublicensable, non-exclusive, and non-transferable right to allow the Client and its Users to access and use the Software mentioned in the Purchase Order, for the duration necessary for the execution of the relevant Service and within the limits provided in the Agreement and/or in the applicable Purchase Order.

The Client is responsible for any activity originating from User accounts and undertakes to respect, and to ensure that Users respect, in the context of using the Software, all applicable national and international legislation, including that relating to the protection of personal data.

Furthermore, the Client undertakes to protect the integrity, confidentiality, and availability of login credentials to the Software (the "Identifiers"). The Client undertakes to notify Valiuz as soon as possible (i) of any unauthorized use of the Identifiers or a User account, or any other security breach, whether proven or suspected, and (ii) of any unauthorized use, copying, or distribution of the Software of which the Client or its Users become aware or suspect, and to make all reasonable efforts to put an end to it as soon as possible. The Client also undertakes to (i) not impersonate another Valiuz client or provide false information about their identity to access or use the Software and to (iv) restrict each User account to a single authorized User at a time unless expressly stated otherwise in the applicable Purchase Order.

The Client further undertakes to:

use the Software in compliance with the Agreement, applicable Purchase Orders, Documentation, the terms of the Software publisher's license agreement that will be communicated to it, and all applicable laws;

not license or sublicense the Software, sell, lease, distribute or commercially exploit it, pledge, assign or otherwise transfer it, or make it available to any person other than its Users in any other way, regardless of the terms and means;

not decompile the Software, disassemble it, reverse engineer it, or attempt to discover the source code or underlying ideas or algorithms of the Software (except within the strict limits permitted by law);

not use the Software to send or store personal health data, credit card data, personal financial data, or other categories of sensitive data that may be subject to specific laws or regulations;

not use the Software to send or store infringing, obscene, threatening, abusive, or otherwise unlawful material, including material that violates the privacy rights of third parties;

not use the Software to create, use, send, store, or manage material containing viruses, worms, Trojan horses, or other malicious computer codes, files, scripts, agents, or programs, or otherwise disrupt or interfere with the security, integrity, performance, or operation of the software (including the data it contains);

not modify, copy, or create derivative works from the Software, or any part thereof;

not attempt to obtain, or tolerate unauthorized access to the Software;

not access the Software for the purpose of building a competing product or service or copying its features or user interface, or for any purpose other than its internal use;

not remove, obscure, alter, add or fail to reproduce in and on the Software any copyright or proprietary notice, or any other notice that may be required by Valiuz at any time; or

not permit or assist any third party (including any User) to do any of the operations mentioned above.

Any use of Software by the Client or its Users that violates the Agreement, the Documentation, and/or the terms of the publisher's license agreement and/or that threatens the security, integrity, or availability of the Software, may result in the immediate suspension and/or termination by Valiuz of the Client's access to the Software, in whole or in part. Where possible, Valiuz will send the Client a notification and give them the opportunity to remedy the violation or threat before such suspension. In any event, the Client will be billed for the subscribed Service for the entire duration of the suspension.

Valiuz undertakes to use its best efforts to ensure that the Software complies with the Documentation as periodically updated, if applicable.

The Client acknowledges that the provision of a dedicated environment to the Client on certain Software may take some time and will therefore not necessarily be immediate from the subscription of the corresponding Service. Valiuz cannot be held responsible in case of unavailability of the Software.

The Client may access the Software and use the Services at any time subject to the limitations provided herein. Valiuz and/or its subcontractors may, however, interrupt the Service in whole or in part for technical maintenance reasons necessary for the proper functioning of the Software (correction, modification, evolution). The Client will be informed in advance, as far as possible at least 24 hours before the operation and subject to the urgent nature of the operation. Valiuz cannot be held responsible in case of unavailability of the Software due to a maintenance operation mentioned above.
When processing Client Data, Valiuz acts as a processor of the Client, data controller, within the meaning of the GDPR. The obligations of each Party regarding the processing of Personal Data implemented in this context are detailed in Appendix 1.

It is the Client's responsibility to set up the necessary flows and resources to communicate to Valiuz the Client Data required for the execution of this Agreement and the subscribed Services.

The Client undertakes to use the Services in compliance with applicable laws and regulations, and notably with the applicable Personal Data Protection Regulation.

In this regard, the Client declares and guarantees:

that it has the rights and licenses to use the Client Data for the purposes envisaged by this Agreement, including sharing this data with third parties;

that it will only transmit to Valiuz for the execution of the Services the Client Data that it has collected fairly and lawfully, in accordance with the applicable Personal Data Protection Regulation, in compliance with the rights of the data subjects (including, but not limited to, their prior consent to the deposit of cookies and other trackers when necessary, their right to object to the deposit of cookies and other trackers, and their right of access to data), for the purposes referred to in this Agreement and on a valid legal basis. As such, the Client guarantees to have previously obtained the consent of the data subjects to the use of their Personal Data for online targeted advertising purposes, if applicable, and to have informed the data subjects, in accordance with the applicable Personal Data Protection Regulation, notably of the possibility for the Client (1) to process their data for analysis purposes, to improve its customer knowledge and personalize its communication, (2) and to communicate their data to third parties. Valiuz cannot be held responsible in case of transmission by the Client of Client Data not complying with these requirements;

that it will not transmit to Valiuz or the Software, nor instruct Valiuz or the Software to process Client Data that the Client knows violates the applicable Personal Data Protection Regulation or the rights of a third party.
When the Client subscribes to certain Services, Valiuz may make available to it certain Valiuz Data necessary for the execution of the subscribed Services.

Valiuz grants the Client, solely for the purposes of the Services, a non-sublicensable, non-exclusive, and non-transferable right to allow the Client and its Users to use the Valiuz Data, for the duration necessary for the execution of the concerned Service and within the limits provided in the Agreement.

The Client undertakes, and ensures that any recipient to whom it transmits this Valiuz Data undertakes to:

use the Valiuz Data only for the purpose of benefiting from the Services, and in particular not to reuse the Data on its own behalf or on behalf of a third party for purposes distinct from those detailed herein,

not use the Valiuz Data for the benefit of an entity directly competing with a Retailer from which the Audiences originate,

comply with the Editorial and Responsible Advertising Charter referred to in the Appendix,

comply with the rules relating to Advertisement content compliance described in the article "Advertisement Content Compliance", as well as the redirection rules described in the article "Hypertext Links",

not misuse the Valiuz Data, nor reuse the Valiuz Data on its own behalf or on behalf of a third party, including Valiuz Data that would not be used as part of a Campaign (e.g.: Valiuz Data not matched / not identified / not recognized by the broadcasting medium, notably the Client and, if applicable, its Representative, undertake not to collect information on internet users constituting all or part of the Audience, not to associate technologies that allow the reconstruction of the granularity of the inventory and URLs constituting the Services, not to use any form of geolocated purchase, and particularly associated with a DCO (Dynamic Creative Optimization) type technology without Valiuz's agreement);

not enrich its own data or that of its clients or service providers, using Valiuz Data;

not place pixels or trackers allowing the collection or recognition of Audiences made available by Valiuz for use outside of these presents;

delete the Valiuz Data once the Service has been executed and in any event upon expiration and/or termination of the Agreement for any reason whatsoever;

maintain a publicly accessible privacy policy on its mobile applications and websites available via a visible link that meets transparency requirements, and clearly inform each person before any collection and processing of their Personal Data of the purposes for which they are processed.

Finally, when required, the Client undertakes to ensure the collection of informed and prior consent from the individuals comprising the Audience to whom it broadcasts a Campaign on Media not commercialized by Valiuz within the scope of these presents.

It is recalled that in the event that the Client is authorized to use the Valiuz Data in self-service, then it is responsible for the processing of Personal Data that it implements using the Valiuz Data. As such, it undertakes to ensure the security and confidentiality of the processing. This includes, in particular, the security of all information systems (including all terminals, servers, software, networks, and communication means) belonging to the Client and/or its subcontractors and used to process Personal Data. The Client thus undertakes to implement and update if necessary, within its own sphere of responsibility, all appropriate technical, logical, and organizational measures with regard to Article 32 of the GDPR, the state of the art to date, the recommendations of the competent supervisory authority, and the level of risk of the processing concerned.
As part of the execution of certain Services, Valiuz may integrate cookies, and/or pixels, and/or other trackers into Ads, particularly for the purpose of measuring their performance and conversion rate and/or identifying internet users visiting an Advertiser's website (for matching purposes). In such cases, Valiuz informs the Client.

Valiuz may also integrate cookies, pixels, and/or trackers into Ads at the Client's request. In this case, the Client agrees to provide Valiuz with specific implementation instructions and clearly indicate its expectations regarding measurements and identification. The Client is fully responsible for the cookies, pixels, and/or trackers it requests Valiuz to integrate into the Ads, and Valiuz shall not be held liable for any misimplementation or other inconveniences. Under the GDPR, the Client is solely responsible for the processing of data carried out using the cookies, pixels, and/or trackers it requests Valiuz to integrate into its Ads.

In any case, in both scenarios mentioned above, the Client agrees, in accordance with applicable Personal Data Protection Regulations, to:
i) Provide visitors to its website and/or web page linked to by the Ad with clear and precise information about the existence of these cookies, and/or pixels, and/or other trackers, and how they are used (including, without limitation, for advertising, targeting, and measurement purposes), and ii) Obtain valid consent from the Data Subjects for the use of these cookies, pixels, and/or trackers by Valiuz and the subsequent processing.

5. Intellectual Property

Valiuz and the Client remain owners of all intellectual property rights they hold for the entire duration of these rights, and worldwide, the Contract not operating any transfer of ownership of these rights from one party to the other.

In any case, the parties remain holders of their methods, tools, and know-how that may become known to the other party within the framework of the Services.

The Client acknowledges that the Valiuz Database constitutes, by the choice, structure, organization of information, and the results derived from its exploitation, a protected intellectual creation of which Valiuz is the owner and producer.

Unless otherwise expressly stated herein, no intellectual property right is transferred to the Client regarding Valiuz Data, Software, and Documentation, which remain the exclusive property of Valiuz and/or third parties who have granted it the relevant rights. The rights granted to the Client for the use of Valiuz Data, Software, and/or Documentation are limited to those expressly conferred under the T&C and automatically terminate upon the termination of the applicable Purchase Order and/or the Contract, regardless of the cause.
The Client is the exclusive owner of all rights relating to Client Data. The Client is solely responsible for the accuracy, quality, integrity, legality, reliability, appropriateness, and ownership of the intellectual property rights of all Client Data, and hereby warrants that it has all necessary rights and consents to allow Valiuz to use all Client Data in connection with the performance of this Contract.

The Client grants Valiuz a royalty-free, non-exclusive, non-transferable (unless stipulated in Article 18 "General Provisions"), sub-licensable, worldwide right to use and process Client Data solely for the purpose of providing the Client with the Services and any other activity expressly agreed upon by the Client.

In particular, the Client expressly authorizes Valiuz to collect, use, communicate, and report on Client Data, and other data and metrics relating to the Client's use of the Services, in aggregated and anonymous form that does not identify the Client, its Users, or its end customers, for the purpose of performing comparative analyses of the Services, providing or improving the Services, or for statistical or other commercial purposes. The Client accepts and acknowledges that Valiuz will own all results derived from this use of Client Data.
The Client or its Agent declares and warrants that it holds all rights necessary for the conclusion of the Contract and the exploitation of the Advertisements on the chosen Medium(s), including intellectual property rights over all creations (drawings, photos, videos, music, graphic creations, visuals, etc.) and distinctive signs (logos, trademarks, etc.) contained in the Advertisement, and that it holds the image rights relating to the persons appearing in the Advertisement and/or on the web page accessible from the Advertisement, and that it has paid, if applicable, all remunerations and/or royalties due for the exploitation of the Advertisements so that no remuneration and/or royalty can be claimed from Valiuz or the Medium.

The Client grants Valiuz, on a non-exclusive basis, worldwide and for the entire legal protection period, the right to use, reproduce, represent, and adapt the Advertisement (including original works protected by copyright, trademarks, and other distinctive signs appearing therein), for the purpose of fulfilling its obligations under this Contract for the needs of its business.

6. Indemnification

The Client declares and warrants that the Advertisements (including each of their component elements) as well as the products and/or services promoted under the Contract do not infringe upon the rights of third parties, including intellectual property rights, and do not constitute an act of counterfeiting, unfair competition, or parasitism.

The Client shall defend, hold harmless, and indemnify Valiuz and/or the concerned Mediums against any loss, claim, damage, liability, or judgment (including reasonable attorney's fees and court costs) or any agreed settlement amount accepted by Valiuz in connection with a claim brought against Valiuz and/or the concerned Mediums by a third party alleging that (i) the Advertisement or the Campaign and/or the products or services it aims to promote infringe upon its intellectual property rights and/or personality rights, and/or constitute an act of unfair competition, parasitism, or disparagement, a misleading or unfair commercial practice, or more generally violates applicable laws and regulations, and/or (ii) that its Personal Data has been collected and/or processed unfairly or unlawfully, or disclosed or made available to unauthorized third parties (hereinafter, a “Claim”).

Each Party undertakes to inform the other Party, as soon as it becomes aware of it by email confirmed by registered letter with acknowledgment of receipt, of any Claim and shall provide information and any other reasonable cooperation relating to said Claim.
Valiuz guarantees the Client against any action or complaint from a third party based on the fact that the Software infringes its intellectual property rights.

If the Client receives such a claim from a third party, the Client undertakes to promptly notify Valiuz, use best efforts to provide Valiuz with the necessary information, assistance, and cooperation in handling said claim, and grant Valiuz full control and authority over the defense and settlement of said claim. To the extent that the Client complies with the preceding provisions, Valiuz undertakes to assume control of the defense and settlement of such a claim and to reimburse the Client for the amount of damages ordered against it by a final court decision or by a settlement expressly accepted by Valiuz.

Valiuz may, at its expense and at its option, either:

obtain for the Client the right to continue using the Software in accordance with the Contract, or;

replace or modify the Software so that it is no longer infringing; or

if Valiuz considers that neither option (a) nor (b) is feasible, terminate the applicable Purchase Order by right and reimburse the Client for prepaid amounts for unperformed services under the Contract that are the subject of the infringement action.

Under this article, Valiuz shall not be held liable for any claim arising from (a) the use of the Software contrary to the terms herein or the Documentation and/or (b) Client Data processed by the Client via the Software.

7. Financial Conditions

The Client undertakes to pay the price of the Services, as stated in the corresponding Purchase Order. Prices are exclusive of taxes and in euros.

Valiuz may modify its pricing conditions at any time, it being understood that such modification will only apply to Purchase Orders signed after the effective date of the modification.
Invoices are due within thirty (30) days of their issue date and must be paid via bank transfer.

Late payment penalties, equal to three times the current legal interest rate, will be applied from the day following the invoice's due date until the date of effective payment. These penalties are automatic, requiring no prior reminder letter. Additionally, a fixed indemnity of forty (40) euros for collection costs will be charged, or a higher amount if justified by Valiuz.

Should an invoice remain unpaid by its due date, and fifteen (15) days have passed since the client received a formal notice via registered letter with acknowledgment of receipt without payment, Valiuz reserves the right to: (i) terminate current and unexecuted Purchase Orders, solely at the client's fault and expense, without compensation to the client (ii) repossess reserved Advertising Spaces (iii) refuse any new Purchase Orders.

The client will remain fully liable for the cost of advertisements already broadcast.
All invoices must be paid no later than thirty (30) days from the date of issuance, by bank transfer.

Any late payment will incur, starting from the first day following the invoice's due date until the actual payment date, and without the need for a reminder letter, late payment penalties equal to three times the current legal interest rate, in addition to a fixed compensation of forty (40) euros for recovery costs, or a higher amount upon justification by Valiuz.

In case of non-payment by the due date, and after a period of fifteen (15) days following the receipt of a formal notice sent to the Client via registered mail with acknowledgment of receipt and remaining unaddressed, Valiuz reserves the right to (i) terminate ongoing and unexecuted Order Forms, entirely at the Client's fault and liability, without compensation for the Client, (ii) reclaim reserved Advertising Spaces, and/or (iii) refuse any new Order Form. The Client shall remain liable for the full price of Advertisements that have already been broadcasted.

8. Liability

Valiuz undertakes to provide the Services under an obligation of means, and grants no guarantee as to the result obtained within the framework of the Services and as to the success of the Campaigns.

The Services are offered to the Client without any guarantee, notably as to the operation of the Media, the commercial and financial impact and the level of performance that the Services might have. In particular, the Client is warned of the technical hazards inherent in the Client's information system and telecommunication networks and the Internet, and the access interruptions and slowdowns that may result therefrom for which Valiuz cannot be held responsible or called upon for guarantee.

Each Party undertakes to indemnify the other party for any direct damage that the latter may suffer due to the non-compliance by the other Party with any of its contractual obligations, provided that the non-compliance with its obligations by one of the Parties is not due to the actions and/or deeds of the other Party. In no event shall the Parties be liable under this Contract for indirect damages as well as loss of turnover or profits, customers, data or damage to image, whatever the cause, originating from or relating to the Contract or the Services.

Valiuz's total liability, in application of the Contract or in any way related thereto, shall not exceed the amount of sums received by Valiuz under the Purchase Order subscribed by the Client or its Agent.

The provisions of this Article shall not apply in case of (a) fraud or gross negligence, (b) fraudulent misrepresentation, or (c) death or personal injury.

The Parties expressly acknowledge that this limitation of liability constitutes a balanced distribution of the risks arising from the Contract between them.

9. Force majeure

Neither Party shall be held liable, nor considered to have failed in their contractual duties, for any delay, interruption, or non-performance resulting from an event of force majeure or circumstances beyond their control. A force majeure event is defined as an unforeseeable, irresistible external event that prevents the performance of the Contract. Examples of such circumstances include, but are not limited to, administrative decisions or exceptional store closures due to sanitary restrictions (such as a pandemic), and other similar events.

By express agreement, force majeure events specifically include war, riot, and strikes, epidemics and pandemics that lead to the paralysis of production and/or communication means, imperative prescriptions from national or international public authorities, destruction of materials that could not have been prevented by those responsible, cessation of communication means, requisitions or public order provisions that restrict the purpose of the Contract or free movement, failures caused by malfunction, blockage, or congestion of the internet, mobile network, and/or the Ad server(s) utilized by Valiuz.

Notwithstanding the above, Valiuz will invoice the Advertiser for any campaigns that have already been carried out.

10. Insurance

Both Parties affirm that they possess a professional civil liability insurance policy from a reputable and solvent company. This policy covers the financial implications of their liability, with a guarantee amount deemed sufficient for the commitments outlined in this Contract.

Each Party agrees to provide the other with the relevant insurance certificate upon request.

11. Term and Termination

The Contract takes effect on the date of signature of the Purchase Order or, where applicable, on the start date of the Service indicated on the Purchase Order, and continues until the term indicated in the Purchase Order, or until terminated in accordance with the Contract.

In the event of a serious breach by one of the Parties of the obligations provided for in the Articles "Obligations of the Parties", "Intellectual Property", "Indemnification", "Financial Conditions", "Protection of Personal Data", not remedied within fifteen (15) days from the receipt of a registered letter with acknowledgment of receipt notifying the breach, the other Party may suspend or terminate the Contract, without prior formality and without prejudice to any damages it may claim.

In the event of termination, Valiuz will interrupt all Client access to the Software. The Client undertakes to cease all use of the Software and Valiuz Data. Client Data will be returned to the Client free of charge in a standard market format (.xls, .csv...). No service other than the full return of Client Data will be provided by Valiuz under reversibility, Valiuz not being obliged to ensure any continuity of the Service provided. In any event, the Client Data necessary for the provision of the Services will be destroyed by Valiuz within three (3) months from the end of the Contract. Valiuz will provide the Client, upon first request, with a certificate of destruction of Client Data.

Early termination attributable to the Client does not relieve the Client from the payment of sums due by it until the end of the Contract: these sums become due upon confirmation of termination.

The termination or expiration of the Contract does not in any way release the Parties from obligations that may have arisen before said termination and does not terminate the stipulations of the Contract which, by their nature, must survive it (including the obligations referred to in the articles "Intellectual Property", "Indemnification", "Liability", "Term and Termination", "Confidentiality", "Publicity and Reference", "General Provisions" and "Applicable Law and Competent Jurisdiction").

12. Confidentiality

Both Parties agree to maintain the confidentiality of all shared information related to this Contract, including but not limited to, techniques, computer codes, programming tools, software within their IT systems, Valiuz documentation and reports, Valiuz Data, and Client Data, regardless of whether it is explicitly marked as confidential.

Each Party is responsible for ensuring its personnel and/or subcontractors also uphold this confidentiality.

This information is exchanged exclusively for the execution of this Contract and shall not be used for any other purpose.

For the duration of the Contract and for five (5) years following its termination, neither Party shall disclose this information to third parties without prior written consent from the other Party. This obligation does not apply if a Party can prove the information entered the public domain without its fault or negligence. Furthermore, neither Party shall take any action that could directly or indirectly compromise this confidentiality.

13. Personal Data Protection

For the purposes of this article relating to the protection of personal data, the definitions of "personal data", "processing", "controller", "joint controllers" and "processor" are those defined in Article 4 of the GDPR.

Within the framework of the execution hereof, the Parties acknowledge that each may be required to collect and process the Personal Data of the other Party's employees, and/or any other relevant contact of the other Party.

Each Party acknowledges acting as a data controller regarding the collection and processing of such personal data within the framework of this Contract as far as it is concerned. Each Party undertakes to comply with all obligations imposed on a data controller resulting from the provisions of the applicable personal data regulations.

As such, Valiuz, in its capacity as data controller, collects and processes Personal Data relating to employees and relevant contacts at the Client for the following purposes and on the following legal bases:

for the purposes of executing this Contract: the management and monitoring of commercial proposals, client projects, the creation and management of Software Users, invoicing, collection, and, where applicable, dispute management;

based on Valiuz's legitimate interest in developing and maintaining its relationship with its Clients: commercial relationship monitoring, commercial prospecting, and client event organization.

Access to this collected Personal Data is restricted to authorized Valiuz personnel. This Personal Data may be communicated to third parties in cases where required by law, by a regulatory provision or a judicial decision, or if such communication is necessary to ensure the protection and defense of Valiuz's rights.

This collected Personal Data is stored for the duration of the commercial relationship with the Client, then archived in accordance with the durations provided by legal obligations, namely 5 years. Accounting data is kept for 10 years from the close of the financial year. Personal data of prospects collected for animation and prospecting purposes is kept for a period of 3 years.

Any person whose Personal Data is processed by Valiuz has a right of access, rectification, and erasure of their data, as well as the right to data portability of the data they have provided, subject to the conditions provided by the applicable Personal Data Regulation for the exercise of these rights. Any person also has the right to request the restriction of processing concerning them and to object to receiving commercial prospecting or being subject to profiling related to commercial prospecting. In certain cases, they may, for reasons related to their particular situation, object to the processing of their data, including profiling. Any person also has the right, in accordance with applicable regulations, to organize the fate of their post-mortem personal data.

Any person also has the possibility of lodging a complaint with a competent data protection authority.

These rights can be exercised by sending an email to the following address <dpo@valiuz.com> or a postal mail to the following address: Valiuz, 67, rue de Luxembourg, 59000 LILLE - FRANCE

The Parties undertake to comply with this article throughout the duration of this Contract and beyond when the obligations set out in this article will survive the end of this Contract according to the applicable Personal Data Regulation and, among others, the obligations relating to the security and confidentiality of personal data.
Where Services are subscribed by the Client, Personal Data processing may occur. Annex 1, which outlines data protection obligations for both Parties within the scope of the subscribed Services, shall govern these processing operations.

14. Personnel Working Conditions

Throughout the Contract's duration, Valiuz personnel assigned to its execution will remain under Valiuz's administrative, social, hierarchical, and disciplinary authority.

15. Audit

Valiuz reserves the right to audit the Client's adherence to contractual obligations, either through on-site visits or document reviews. Such audits will be limited to one day and designed to avoid disrupting the Client's operations. Valiuz commits to providing the Client with at least two (2) weeks' written notice prior to commencing any verification.

In the event that an audit reveals discrepancies, the audited party will be responsible for the expenses associated with implementing corrective measures. These compliance efforts must be completed within a timeframe mutually agreed upon by both parties, culminating in a signed document that attests to their completion.

It is explicitly understood that audits will not extend to financial data or personal data unrelated to the parties or the contract.

Should the Client refuse an audit, fail to undertake necessary compliance work, or neglect to allocate sufficient resources for its completion within the stipulated timeframe, Valiuz retains the right to, among other actions, suspend the processing of Personal Data and related services, or any other services outlined in this Contract.

16. Publicity and References

Each Party may disclose the existence of the business relationship established by the Contract for promotional or publication purposes. However, the specific terms of this Contract are confidential, except where required by applicable law.

The Advertiser or its Agent permits Valiuz to use the Advertiser's name and logo, and/or reproduce all or part of the Advertisements broadcast under this Contract, as a commercial reference. This includes use on Valiuz's website and in its commercial and advertising materials. All reproductions of the Client's logo must be exact copies of those used by the Client in terms of design, color, and other details.

Additionally, the Client authorizes Valiuz to use Campaign information (results, statistics, etc.) for the promotion and marketing of the Services, unless the Client makes an express and reasoned request to the contrary in the Purchase Order.

17. Ethics and Compliance

Throughout the duration of the Contract, the Parties undertake to comply with the rules of integrity and corruption prevention as enacted by applicable regulations.

For the conclusion and execution of the Contract, the Parties undertake never to offer, promise, or grant any undue pecuniary or other advantage, intentionally, directly or indirectly, with a view to obtaining an illegal, illegitimate, or unfair action for the market, for their benefit or for the benefit of a third party. They also undertake to raise awareness among their employees, representatives, and service providers about their anti-corruption system.

Furthermore, under the same conditions, the Parties certify that their activities related to the Contract do not seriously infringe upon human rights and fundamental freedoms, the health and safety of persons, or the environment, in application of applicable law.

In the event of non-compliance with this clause by one of the Parties, the other reserves the right to terminate the Contract without the other party being able to claim any termination indemnity.

Any employee has the possibility, if they notice infringements, to report them to Valiuz via the alert system at the address: <compliance@valiuz.com>.

18. General Provisions

Valiuz may subcontract its services or engage third-party experts and service providers. However, Valiuz remains solely responsible for the execution of the Contract by its subcontractors.

The Client may not transfer any rights or obligations from this Contract without Valiuz's prior written consent. Valiuz may assign all or part of its rights and obligations to any legal entity, provided the Client is informed.

The Parties are independent contractors and nothing in this Contract establishes between them a relationship of agency, partnership, or co-venture. Neither Party has the authority to bind or represent the other.

A waiver by one party of a Contract stipulation does not constitute a waiver of any future benefit from that stipulation.

If a court declares any Contract stipulation invalid or unenforceable, it will be applied to the fullest extent permitted by law to reflect the Parties' intent. The remaining provisions of the Contract will remain in full force. In such cases, the Parties agree to negotiate in good faith an alternative stipulation that mirrors the original intent and economic effect.

19. Applicable Law and Competent Jurisdiction

The Contract is governed by the law of the Valiuz entity's registered office, as specified in the Purchase Order. This location also holds exclusive jurisdiction over any disputes concerning the Contract's conclusion, interpretation, execution, or termination.

The Parties commit to seeking an amicable resolution for all disputes arising from the Contract's conclusion, interpretation, execution, or termination, ideally by escalating such matters to their respective general managements.

Should an amicable agreement not be reached within fifteen (15) days of the dispute's submission to the parties' respective general managements, any unresolved dispute will be submitted to the court of the Valiuz entity's registered office, as specified in the Purchase Order. The Parties expressly grant this court territorial jurisdiction, irrespective of multiple defendants or third-party claims. This jurisdiction clause, by mutual agreement, extends to urgent proceedings, interim measures, summary proceedings, or petitions.

Appendix 1 – Subcontracting Agreement

Between

The Advertiser, as identified in the Purchase Order, (hereinafter, " the data controller" or " the Client ") on the one hand,

AND

Valiuz,

as identified in the Purchase Order (hereinafter, " the subcontractor"), on the other hand,

Together, " the Parties ".

The terms "Supervisory Authority", "Data Controller", "Subcontractor" (whether capitalized or not) shall have, within the framework of this Agreement, the definition provided in Article 4 of the GDPR. These terms and expressions may be used in both singular and plural, as appropriate.
The purpose of this subcontracting agreement is to define the conditions under which Valiuz, as a subcontractor, undertakes to perform personal data processing operations, as defined below, on behalf of the Client, who is the data controller.

Within the framework of their contractual relationship, the Parties undertake to comply with the applicable Personal Data Regulations.
Valiuz is authorized to process personal data on behalf of its Client, as necessary to provide the Services chosen by the Client in a Purchase Order:

1. The nature of the operations performed on the data varies depending on the Service chosen by the Client, and may therefore be as follows (cf. Purchase Order):

Receipt of Client Data by Valiuz

Hosting of Client Data by Valiuz

Segmentation of Client Data by Valiuz

Analysis of Client Data by Valiuz

2. The purpose(s) of the processing are:

Advertising targeting

Statistical analyses (consumption trends, campaign performance, etc.)

3. The personal data processed are:

Client ID

Cookie ID or hashed email or phone number (used as a matching key)

4. The categories of data subjects are:

Clients and/or prospects of the Advertiser.
This contract is concluded for the duration of the Purchase Order, of which it forms an Appendix.
Valiuz undertakes to:

process the data only for the sole purpose(s) that are the subject of the subcontracting;

process the data in accordance with the documented instructions of the data controller, including with regard to transfers of personal data to a third country or to an international organization. If the subcontractor considers that an instruction constitutes a violation of the European Data Protection Regulation or any other provision of Union law or Member State law relating to data protection, it shall immediately inform the data controller. Furthermore, if the subcontractor is required to transfer data to a third country or to an international organization, pursuant to Union law or the law of the Member State to which it is subject, it must inform the data controller of this legal obligation prior to processing, unless the relevant law prohibits such information for important reasons of public interest. As such, the data controller is informed that, depending on the Service subscribed to, certain personal data processing operations may involve a transfer of data outside the European Union, which the data controller accepts. As such, Valiuz undertakes to provide the data controller, upon request, with any details identifying the processing operations and data concerned, the third countries concerned, as well as the security measures implemented to protect the data concerned in these third countries.

guarantee the confidentiality of personal data processed under this subcontracting agreement;

ensure that persons authorized to process personal data under this subcontracting agreement:

undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality,

receive the necessary training in personal data protection,

5. take into account, with regard to its tools, products, applications or services, the principles of data protection by design and data protection by default.
The Client is informed and accepts that Valiuz may use the subcontractors listed below.

Valiuz may engage another subcontractor (hereinafter, "the subsequent subcontractor") to carry out specific processing activities.

In this case, it shall inform the data controller in advance and in writing of any planned changes concerning the addition or replacement of other subcontractors. This information must clearly indicate the subcontracted processing activities, the identity and contact details of the subcontractor, and the dates of the subcontracting agreement. The data controller has a minimum period of 72 hours from the date of receipt of this information to raise objections. This subcontracting can only be carried out if the data controller has not raised an objection within the agreed period.

The subsequent subcontractor is obliged to comply with the obligations of this subcontracting agreement on behalf of and according to the Client's instructions. It is Valiuz's responsibility to ensure that the subsequent subcontractor offers the same sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the European Data Protection Regulation. If the subsequent subcontractor fails to fulfill its data protection obligations, Valiuz remains fully responsible to the data controller for the performance of its obligations by the other subcontractor.
It is the responsibility of the data controller to provide information to data subjects concerning the processing operations at the time of data collection.
To the extent possible, Valiuz must assist the data controller in fulfilling its obligation to respond to requests for exercising the rights of data subjects: right of access, rectification, erasure, and objection, right to restriction of processing, right to data portability, right not to be subject to an automated individual decision (including profiling).

When data subjects submit requests to Valiuz for the exercise of their rights specifically targeting the processing implemented on behalf of the data controller, Valiuz must forward these requests upon receipt by email to the preferred contact identified in the Purchase Order.
Valiuz shall notify the data controller of any personal data breach within a maximum of 72 hours after becoming aware of it, by email addressed to the preferred contact identified in the Purchase Order. This notification shall be accompanied by any useful documentation to enable the data controller, if necessary, to notify this breach to the competent Supervisory Authority.
Valiuz shall assist the data controller in carrying out data protection impact assessments, as well as in carrying out the prior consultation of the Supervisory Authority when it is mandatory.
Valiuz undertakes to implement organizational and technical measures to ensure the physical and logical security of the personal data it processes.

These security measures aim to ensure the integrity, availability, confidentiality of personal data, as well as the traceability of access to personal data, and include in particular:

Identification and securing of premises (e.g., locked access, restricted access requiring authorization and authentication).

Logical security (e.g., intrusion probes, firewalls, authentication and archiving of data access, incident simulations).

Encryption of personal data.

Securing personal data exchange flows so that they cannot be exploited by an unauthorized third party.

Logging of activities on the IT system: monitored elements are listed with an indication of their retention period (at least 1 year unless regulatory constraint).

Protection of IT environments by up-to-date antivirus software (programs and viral signatures).

Implementation of control procedures to ensure the security level.

Valiuz may transmit its detailed security assurance plan upon request from the data controller.
At the end of the service provision relating to the processing of this data, Valiuz undertakes to destroy all the Client's personal data in its possession.

Once destroyed, Valiuz must provide written justification for the destruction.
Valiuz's Data Protection Officer can be contacted by email at dpo@valiuz.com
Valiuz declares that it maintains a written record of all categories of processing activities carried out on behalf of the data controller, including:

the name and contact details of the data controller on whose behalf it is acting, of any subcontractors, and of its data protection officer;

the categories of processing carried out on behalf of the data controller;

where applicable, transfers of personal data to a third country or to an international organization, including the identification of that third country or international organization and, in the case of transfers referred to in Article 49(1), second subparagraph of the European Data Protection Regulation, the documentation of appropriate safeguards;

as far as possible, a general description of the technical and organizational security measures, including, among others, as needed:

the pseudonymization and encryption of personal data;

means of ensuring the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

means of restoring the availability and access to personal data in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
Valiuz shall make available to the data controller all information necessary to demonstrate compliance with all its obligations and to allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
The data controller undertakes to:

provide Valiuz with the data necessary for the execution of this subcontracting agreement,

document in writing any instruction concerning the processing of data by Valiuz,

ensure, beforehand and throughout the duration of the processing, Valiuz's compliance with the obligations set out in the European Data Protection Regulation,

supervise the processing, including carrying out audits and inspections with Valiuz.

List of Subcontractors Used by Valiuz

Name
Valiuz SAS (when the contracting entity is not Valiuz SAS)

Registered Office
67 rue de Luxembourg, 59800 Lille, France

Processing Concerned

Processing detailed in the subcontracting agreement.

Name
LIVERAMP France

Registered Office
25 rue Anatole France, Levallois Perret (92300), France

Processing Concerned

Hosting of Client Data. Synchronization between the Audience provided by the Client and the matching keys of partners involved in the advertising dissemination chain on the Media.

Name
GOOGLE

Registered Office

Gordon House, Barrow Street, Dublin 4, Ireland

Processing Concerned

Hosting of Client Data.

Appendix 2 - Joint Controller Agreement between Valiuz and the Advertiser

Between

The Advertiser, as identified in the Purchase Order, (hereinafter, "the Advertiser" or "the Client") on the one hand,

AND

Valiuz, a simplified joint-stock company with its registered office at 67, rue de Luxembourg, 59800 LILLE, registered with the RCS of Lille Métropole under number 817 460 801, (hereinafter, "Valiuz"), on the other hand,

Together, "the Parties".

Valiuz and the Advertiser are joint controllers of the personal data processing operations that are the subject of this Agreement, within the meaning of Article 26 of the GDPR.

The terms "Supervisory Authority", "Data Controller", "Processor" (whether capitalized or not) shall have, within the framework of this Agreement, the definition provided in Article 4 of the GDPR. These terms and expressions may be used in both singular and plural, as appropriate.
The purpose of this Agreement is to define the roles and responsibilities of each Party with respect to the processing operations jointly implemented and referred to in Appendix A (hereinafter referred to as the "Processing Operations").

In case of contradiction or difficulty of interpretation between this Agreement and any other agreement governing the Processing Operations, the provisions of this Agreement shall prevail.

The Parties undertake to strictly comply with the GDPR, which shall apply in all circumstances concerning the Processing Operations.

The characteristics of the Processing Operations and the operational allocation of responsibility for each joint controller of the Processing Operations are set out in Appendix A of this Agreement. The Parties undertake to keep each other mutually informed of any changes in the conditions of their respective activities or those of their Processors or partners that would substantially modify the characteristics of the Processing Operations and undertake to meet to adapt this Agreement if necessary. They also undertake to process Personal Data only for the purposes described in Appendix A.
Both Parties are joint controllers within the meaning of Article 26.1 of the GDPR in the context of the implementation of the Processing Operations. Any other processing operated by one of the Parties shall be under its exclusive responsibility.

3.1. Information of Data Subjects

Data subjects concerned by the Processing Operations shall receive the required information at the time of data collection when data is collected from the data subject, or within the required deadlines when personal data has not been collected from the data subject, in accordance with Articles 12 to 14 of the GDPR. Each Party undertakes to provide information in accordance with the requirements of the GDPR. Each Party shall state the joint responsibility and the main outlines of this Agreement when informing the Data Subjects.

The Advertiser using the pixel provided by Valiuz undertakes, in accordance with the applicable Regulations, to:

provide visitors to the website and/or web page to which the Advertisement links with clear and precise information on the existence of this pixel (and/or other trackers) and on the purposes of its use (including, without limitation, for advertising and targeting purposes).

collect the consent of individuals for Valiuz's use of this pixel,

mention Valiuz in the list of data recipients.

3.2. Data Security and Confidentiality

Each Party undertakes, each for its own part, to ensure the security and confidentiality of the Processing Operations. This notably includes securing all information systems (including all terminals, servers, software, networks, and communication means) belonging to each Party and/or its Processors and used to process the Data subject to the Processing.

Each Party thus undertakes to implement and update if necessary, within its own sphere of responsibility, all appropriate technical, logical, and organizational measures in accordance with Article 32 of the GDPR, the state of the art to date, the recommendations of the competent Supervisory Authority, and the level of risk of the shared Processing Operations.

The Parties undertake to restrict access to the Data only to persons, strictly selected and needing to know and use the Data to achieve the purposes of the Processing Operations.

3.3. Exercise of Data Subjects' Rights

Data subjects concerned by the Processing Operations may exercise their rights under the GDPR with respect to each of the controllers.

For Valiuz: the email address mesdroits@valiuz.com

For the Advertiser: the "Privacy" page on the Advertiser’s website

However, the primary point of contact for Data Subjects remains the Advertiser.

In all cases, Valiuz shall actively cooperate with the Advertiser, upon the latter's first request, to respond to and satisfy requests for the exercise of data subjects' rights. This cooperation shall include, where applicable, the communication of all necessary or useful information to respond to the data subject, and this, as soon as possible.

3.4. Processors

The Parties undertake, each for its own part and for the purposes of the Processing Operations, to only use Processors offering sufficient guarantees to ensure an adequate level of security and compliance for data protection. Each Party remains responsible for its own processors involved in the processing.

3.5. Data Transfer Outside the European Union

In the event that the implementation of the aforementioned Processing Operations would involve a Transfer of Data outside the European Union, the Parties shall provide the guarantees required by the applicable regulations, through, where applicable, the signing of standard contractual clauses adopted by the European Commission.

3.6. Personal Data Breaches

The Parties undertake to keep each other mutually informed, in writing and without delay, of any Data Breach affecting the data processed under this Agreement. In the event of such a Breach, the Parties undertake to cooperate in good faith to jointly determine the necessary actions in terms of notification to the Supervisory Authorities and communication to the Data Subjects. This information shall be provided within a timeframe allowing for compliance with the corresponding regulatory obligations. No Party may unilaterally proceed with any notification or communication of a personal data breach without having first informed the other Party of its intention to do so and given that other Party the opportunity and a reasonable time to present its observations. Each Party shall communicate all necessary information to the other Party to enable it to fulfill its notification and remediation obligation to the Supervisory Authority.

3.7. Record of Processing Activities

Each Party is solely responsible for maintaining its own records of processing activities within the meaning of Article 30 of the GDPR.

3.8. Authority Control

Each Party undertakes to inform the other Party as soon as possible, to the extent permitted by law, in the event of controls, inspections, or other measures initiated by the CNIL concerning the jointly implemented processing operations.
This agreement shall remain in force for the entire duration of the personal data processing referred to above and jointly implemented between the Parties.
5.1 Parties' Liability: The "Liability" article of the General Terms and Conditions of Sale governing the Service provided by Valiuz is applicable to this Agreement.

5.2 Indemnification towards data subjects: In application of Article 82.4 of the GDPR, when the Parties are responsible for damage caused to a data subject in violation of an obligation of this Agreement, each Party shall be held liable for the entire damage, in order to ensure effective compensation for the data subject.

The Party that has paid the full compensation for the damage suffered has the right to claim from the other Party the share of the compensation corresponding to its share of responsibility for the damage.

5.3 Sanction pronounced by data protection authorities (including CNIL): Any sanction, administrative fine, or condemnation pronounced by the CNIL or any data protection authority against a Party in execution of this Agreement may be compensated by the other Party, if it is established that the other Party is responsible for the breach that is the subject of the sanction pronounced by the CNIL.

Appendix A - Description of processing operations subject to the joint controller agreement

Purpose of Processing:

As agreed in the Purchase Order, a tracking pixel (generated by Valiuz or its partners Mediarithmics and/or Liveramp) may be used to:

Conduct post-Campaign performance studies. In this case, the pixel is integrated into the advertising creative subject of a Campaign and aims to measure the number of people exposed to the Campaign.
Conduct profiling studies (Insights) upstream of a Campaign. In this case, the pixel is placed on a website and/or web page operated by the Advertiser and aims to identify visitors to the website and/or web page who are known to the Client Audience or the Valiuz Audience. A statistical study is established by Valiuz based on the profile of recognized individuals (aggregated data for client knowledge purposes).

Description of Processing:

- Placement of a tracking pixel within advertising creatives and/or the Advertiser's website,

- When the pixel is integrated into a Campaign: collection of the number of people exposed and the number of clicks on the Campaign, then statistical reporting to the Advertiser,

- When the pixel is placed on the Advertiser's website and/or a web page operated by the Advertiser:

Placement by the Advertiser, on the website and/or web page, of a pixel provided by Valiuz, provided that the Advertiser collects the consent of visitors to its website and/or web page for the placement of the pixel.
Matching performed by Valiuz between visitors to the Advertiser's website and/or web page and the Brand Audience or the Valiuz Audience, in order to identify common clients and the profile associated with these clients.
Valiuz provides the Advertiser with a statistical analysis (aggregated data for client knowledge purposes), based on criteria defined by the Advertiser.

Duration of Processing:
Duration of the Campaign or Study as indicated in the Purchase Order.

Type of Data Subject to Processing and Transmitted by the Advertiser:

Data collected via the pixel: Cookie ID, number of impressions and clicks related to a Campaign.
Data processed by Valiuz: Client ID associated with the Cookie ID, segmentation related to the Client ID.

Categories of Data Subjects:

Clients and/or prospects of an Advertiser.

Data Retention Period for Processing by Valiuz: 12 months

Appendix 3 - Editorial and Responsible Advertising Charter

This document aims to define Valiuz's responsible advertising approach by acting on the following levers:

Nature of the audience segments that can be targeted,
Content of advertisements disseminated to these audiences and on the inventories of companies for which Valiuz acts as ad network,
Presentation of advertisements and transparency towards individuals.

The Client undertakes to comply with this charter, which constitutes an essential obligation.

Nature of Audience Segments that can be Constituted

Sensitive or discriminatory data. When the Client uses the Data made available by Valiuz, it is prohibited from processing or creating sensitive data, i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Consequently, no audience segment likely to reveal data that can be qualified as sensitive, or likely to reveal social discrimination, can be constituted by the Client.

This includes, for example, audience segments likely to reveal:

medical or health-related information (e.g., hair loss),
religious considerations (e.g., buyers of halal products),
people in vulnerable situations (e.g., over-indebtedness),
…

Furthermore, no use case of the Data may have the effect of:

Excluding a client from a right, a contract, or affecting them similarly (e.g., using data in the context of a scoring that could influence the decision to grant credit or insurance),
Unfairly personalizing prices that can be paid by end customers.

The Client undertakes not to create segments related to behaviors that may be considered deviant or risky, so as not to encourage them.

Protection of minors. The Client undertakes to protect minors by excluding them from any audience segment likely to be exposed to advertising content promoting products or services reserved for adults (e.g., online gambling).

Advertising Content

The Client undertakes not to use the Services for the dissemination of the content identified below, the list of which is not exhaustive:

Hate or violent content:

Messages inciting hatred, particularly discrimination and racial hatred, harassment,
Defamatory or insulting messages,
Messages encouraging violence,
Messages encouraging suicide.

Content targeting children and vulnerable people:

Messages targeting children for the purpose of collecting personal data about them,
Messages targeting vulnerable people and likely to significantly influence their behavior.

Adult-only content:

Containing pornographic elements, naked people or in suggestive postures,
Promoting prostitution,
Explicit sexual messages, obscene language,
People in fine lingerie.

Specific financial services and gambling:

Promotion of dubious financial schemes such as Ponzi schemes,
Promotion of financial gains presented as "risk-free",
Promotion of illegal financial activities (tax evasion, money laundering, etc.),
Messages promoting gambling, as well as any promotional operation such as lotteries if clearly unfair.

Firearms:

Content promoting the sale of firearms, ammunition, bombs and other explosives, bladed weapons and more generally any type of weapon,
Content containing information on the manufacture of weapons.

Unlawful content:

Content likely to violate current law, including:

violation of intellectual property rights (counterfeiting, illegal downloading, etc.),
violation of privacy,
and more generally any fraudulent activity.

Shocking or misleading content:

Containing clearly false, misleading or unfair statements.

Tobacco, drugs, alcohol:

Promotion of the sale of cigarettes, including electronic cigarettes, as well as any product related to tobacco consumption,
Promotion of the sale or use of drugs, including so-called "soft" drugs,
Messages suggesting excessive alcohol consumption.

Environmental impact:

Promotion of the following products and services:
- fossil fuels (oil, gas),
- air transport,
- more generally, Valiuz may refuse the dissemination of a campaign aimed at promoting any product or service that is notoriously known to have a high negative impact on the environment (climate, resources, biodiversity).
Messages likely to deceive the public about the reality of the Advertiser's actions or about the sustainable development properties of its products.

Presentation of advertisements and transparency towards individuals

Advertisements must not be misleading to consumers.

Thus, the Advertiser undertakes towards Valiuz that:

advertisements do not convey messages likely to be considered as conveying discrimination (racism, sexism, etc.) or disinformation campaigns;
any advertisement containing photographs of models whose physical appearance has been retouched or which have been generated by artificial intelligence include the mention "Retouched" or "Generated by AI";
any advertisement is clearly identified as such (by the affixing of the mention "Advertisement" or equivalent allowing to rule out any confusion about the advertising nature of the message delivered),
the regulatory obligations applicable to the advertising of certain products or services are respected (e.g., health warning for food products).