Platform Data Processing Terms

Traffic Bull · Digital Stars Ltd · Version 1.0 · Effective 6 October 2026

Version 1.0 — Effective 6 October 2026 · Digital Stars Ltd (C86214), Tagliaferro Business Centre, Level 6, Sqaq Gaiety, Sliema SLM 1551, Malta ("Traffic Bull") · Contact: privacy@trafficbull.com

These Platform Data Processing Terms (the "Platform DPA") form an integral part of the Traffic Bull Terms & Conditions (the "T&Cs") and apply to every Publisher and Advertiser holding an Account (each an "Account Holder" or "You"). Capitalised terms not defined here have the meaning given in the T&Cs. By accepting the T&Cs You accept this Platform DPA; no separate signature is required. A signed copy is available on request from privacy@trafficbull.com.

1. Structure and roles

1.1. Part A applies to Publishers. For End-User Data that a Publisher transmits to the Services, the Publisher is the controller and Traffic Bull is the processor, acting on the Publisher's documented instructions to deliver, target, measure, attribute and bill advertising.

1.2. Part B applies to Advertisers. An Advertiser that receives End-User Data through the Services (click, conversion and Tracking-Parameter data and, where the Email Pass applies, encoded e-mail addresses) is an independent controller of that data from the moment of receipt.

1.3. Traffic Bull is also an independent controller of limited End-User Data for its own purposes: fraud and invalid-traffic detection, security, billing reconciliation, compliance with legal obligations, and aggregated statistics. Those purposes are described in the Traffic Bull Privacy Policy and are not governed by Part A.

1.4. Part C and the Annexes apply to all Account Holders.

A1. Instructions

Traffic Bull shall process End-User Data only on the Publisher's documented instructions, which consist of: the T&Cs; this Platform DPA; the configuration the Publisher sets in the Administration Panel (zones, formats, geo-targeting, permitted ad types); and any written instruction from the Publisher, including a written Email Pass instruction under T&C §16.11.3. Traffic Bull shall inform the Publisher if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or amended.

A2. Confidentiality

Traffic Bull ensures that persons authorised to process End-User Data are bound by confidentiality obligations and process the data only as instructed.

A3. Security

Traffic Bull implements the technical and organisational measures in Annex II, reviews them at least annually and updates them as the state of the art and the risk require, without lowering the overall level of protection.

A4. Sub-processors

A4.1. The Publisher grants Traffic Bull a general authorisation to engage the sub-processors in Annex III, and to add or replace sub-processors within the categories listed there.

A4.2. Traffic Bull shall give at least fourteen (14) days' notice of any new sub-processor through the Administration Panel or by e-mail. The Publisher may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, either Party may terminate the affected part of the Services without penalty.

A4.3. Traffic Bull imposes on each sub-processor, by written contract, data-protection obligations no less protective than those in this Part A, and remains liable to the Publisher for the sub-processor's performance.

A4.4. Advertisers are not sub-processors. Advertisers that receive End-User Data under the Publisher's configuration or Email Pass instruction receive it as independent controllers under Part B, and the Publisher authorises such disclosure by making its inventory available on the Services and, for e-mail addresses, by its written Email Pass instruction.

A5. Data-subject requests

Traffic Bull shall forward to the Publisher, within five (5) business days, any request from a data subject relating to End-User Data controlled by the Publisher, shall not respond to it except to acknowledge receipt and refer the data subject to the Publisher, and shall assist the Publisher with appropriate technical and organisational measures to respond within the statutory deadline.

A6. Assistance

Taking into account the nature of the processing and the information available to it, Traffic Bull shall assist the Publisher in meeting its obligations regarding security (Art. 32 GDPR), personal data breaches (Art. 33–34), data protection impact assessments (Art. 35) and prior consultation (Art. 36).

A7. Personal data breaches

Traffic Bull shall notify the Publisher without undue delay and in any event within forty-eight (48) hours of becoming aware of a personal data breach affecting End-User Data processed on the Publisher's behalf, providing the information required by Art. 33(3) GDPR as it becomes available, and shall cooperate in any notification to supervisory authorities or data subjects.

A8. Deletion and return

On termination of the Account, or on the Publisher's written request, Traffic Bull shall delete End-User Data processed on the Publisher's behalf within ninety (90) days, except (i) aggregated statistics that do not identify any End User, (ii) data Traffic Bull must retain under applicable law or for billing, fraud investigation or the defence of legal claims (retained only for those purposes and for the periods in the Privacy Policy), and (iii) data already lawfully received by Advertisers under Part B. Traffic Bull shall confirm deletion in writing on request.

A9. Audit

Traffic Bull shall make available to the Publisher the information necessary to demonstrate compliance with this Part A, in the first instance by written responses and existing documentation (including Annex II and any third-party security reports). Where this is insufficient, the Publisher may conduct, or mandate an independent auditor bound by confidentiality to conduct, an audit no more than once in any twelve (12) months, on at least thirty (30) days' written notice, during business hours, without unreasonable disruption, and at the Publisher's cost, unless the audit is required by a supervisory authority or reveals a material breach. Findings are confidential.

A10. International transfers

A10.1. The Publisher acknowledges and authorises that Traffic Bull hosts the Services in the United States of America and may engage sub-processors outside the EEA and the United Kingdom as listed in Annex III.

A10.2. Where End-User Data is transferred from the EEA to a country without an adequacy decision, the Parties rely on the EU–U.S. Data Privacy Framework where the importer is certified, and otherwise on the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this Platform DPA with the options in Annex IV. For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) is incorporated as set out in Annex IV. Traffic Bull maintains transfer impact assessments and supplementary measures as required.

A11. Publisher warranties

The Publisher warrants that it: (i) has a valid lawful basis for the collection of End-User Data and its transmission to the Services; (ii) provides End Users with a privacy notice that discloses the use of third-party advertising technology, the categories of data transmitted, the categories of recipients (advertising platforms and advertisers) and any international transfers; (iii) has obtained any consent required for cookies, advertising identifiers and similar technologies; (iv) where it gives an Email Pass instruction, has obtained prior, specific, informed and freely given consent from each End User to receive commercial communications from third-party advertisers, and maintains and propagates suppression lists; (v) does not transmit special-category data or data relating to persons under eighteen (18); and (vi) does not transmit directly identifying data in Tracking Parameters except as permitted by T&C §16.11.3. The Publisher shall provide evidence of (i)–(iv) within five (5) business days of request.

A12. Liability

Each Party's liability under this Part A is subject to Section 19 of the T&Cs, save that nothing limits either Party's liability towards data subjects under Art. 82 GDPR or for fines imposed on it by a supervisory authority.

B1. Data received

Through the Services an Advertiser may receive: click and conversion identifiers, IP address (or a truncated form), approximate location, device and browser attributes, Tracking Parameters, and — only on Email Pass-enabled buying models designated by Traffic Bull (at the date of this version: oRTB and CPC campaigns targeting the Email ad type) and only where the Advertiser has executed an Insertion Order incorporating the T&Cs — encoded e-mail addresses of End Users who have consented to receive third-party offers ("Received Data").

B2. Permitted purposes

The Advertiser shall process Received Data solely to measure, attribute, optimise, bill and prevent fraud in respect of its own campaigns on the Services and, for e-mail addresses received under the Email Pass, to send commercial communications within the scope of the End User's consent as notified by Traffic Bull or the Publisher and in compliance with Section 17 of the T&Cs.

B3. Prohibitions

The Advertiser shall not: (i) attempt to re-identify any End User or combine Received Data with other data so as to identify an End User, except that an e-mail address received under the Email Pass may be decoded for the permitted purpose; (ii) enrich, append, sell, license, share or onward-transfer Received Data to any third party other than its own processors bound by written contract; (iii) build or contribute to profiles of End Users beyond the permitted purposes; (iv) use Received Data to contact End Users other than under the Email Pass and within its scope; (v) use any special-category data, or data of persons under eighteen (18), for targeting or otherwise; or (vi) transmit Received Data in any URL, log or system accessible to unauthorised persons.

B4. Email Pass duties

For e-mail addresses received under the Email Pass the Advertiser shall additionally: (a) identify itself as sender in every message and include a free and simple means of objecting; (b) honour every unsubscribe, objection or suppression instruction within forty-eight (48) hours and apply any suppression list provided by Traffic Bull or the Publisher; (c) store the addresses only in encrypted form with access limited to personnel who need it; (d) delete them within ten (10) days of a request by Traffic Bull or the Publisher, on termination of the Insertion Order, or on withdrawal of the End User's consent, whichever is earliest; and (e) provide Traffic Bull, within five (5) business days of request, with evidence of compliance, including message samples and suppression logs.

B5. Security and breaches

The Advertiser shall implement technical and organisational measures appropriate to the risk, no less protective than those in Annex II as far as applicable, and shall notify Traffic Bull without undue delay and in any event within forty-eight (48) hours of becoming aware of any personal data breach affecting Received Data.

B6. Retention

The Advertiser shall not retain Received Data in identifiable form for longer than ninety (90) days after receipt, except (i) aggregated statistics that do not identify any End User, (ii) e-mail addresses received under the Email Pass, which may be retained for as long as the End User's consent remains valid and subject to B4(d), and (iii) where a longer period is required by law.

B7. International transfers

Where the Advertiser is established outside the EEA or the United Kingdom in a country without an adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), and the UK International Data Transfer Addendum are incorporated into this Platform DPA with the options in Annex IV, Traffic Bull (on its own behalf and, where applicable, as agent for the Publisher) being the data exporter and the Advertiser the data importer.

B8. Data-subject requests and cooperation

The Advertiser shall forward to Traffic Bull within five (5) business days any request from an End User concerning Received Data where the request also concerns Traffic Bull or a Publisher, shall handle requests concerning its own processing within the statutory deadlines, and shall cooperate reasonably with Traffic Bull, Publishers and supervisory authorities.

B9. Evidence and suspension

Traffic Bull may request evidence of compliance with this Part B at any time and may suspend the Advertiser's access to Received Data, or to the Email Pass, where it reasonably suspects non-compliance. Each breach of this Part B is non-compliance for the purposes of Section 18 of the T&Cs.

C1. Precedence. In relation to the processing of personal data, this Platform DPA prevails over the T&Cs and any Insertion Order; the Standard Contractual Clauses, where they apply, prevail over this Platform DPA.

C2. Term. This Platform DPA applies for as long as Traffic Bull processes End-User Data on the Account Holder's behalf or the Account Holder holds Received Data.

C3. Changes. Traffic Bull may update this Platform DPA in accordance with Section 20 of the T&Cs; changes required by law or by a supervisory authority may take effect immediately on notice.

C4. Governing law and disputes. Section 22 of the T&Cs applies, without prejudice to the mandatory provisions of the Standard Contractual Clauses.

C5. Contact. privacy@trafficbull.com — Digital Stars Ltd, Tagliaferro Business Centre, Level 6, Sqaq Gaiety, Sliema SLM 1551, Malta.

ANNEX I — Description of processing

ANNEX II — Technical and organisational measures

• Access control: role-based access; unique accounts; multi-factor authentication for administrative and infrastructure access; quarterly access reviews; immediate revocation on leaver.
• Encryption: TLS 1.2+ for all data in transit; encryption at rest for databases, backups and credentials; hashed passwords; secrets held in a managed vault.
• Network and infrastructure: segregated production, staging and office environments; firewalls and security groups; hardened images; managed patching with critical patches within 14 days.
• Logging and monitoring: centralised logs of administrative operations and data access, retained 12 months; alerting on anomalous access; invalid-traffic and fraud detection systems.
• Data minimisation: IP addresses truncated or deleted after the retention period; Tracking Parameters validated against the PII rule in T&C §16.11; raw event data retained 90 days.
• Availability: daily encrypted backups; tested restore procedures; redundancy at hosting provider; documented incident-response plan with a 48-hour customer-notification target.
• Organisational: confidentiality clauses in all employment and contractor agreements; annual data-protection and security training; vendor due diligence and written data agreements with all sub-processors; documented data-subject-request procedure.
• Physical: data centres certified to ISO 27001 / SOC 2 or equivalent; office access control.

ANNEX III — Sub-processors and recipients

Sub-processors engaged by Traffic Bull for Part A processing (names to be confirmed and kept current at panel.trafficbull.com/legal):

Recipients that are independent controllers, not sub-processors: Advertisers and demand-side platforms buying on the Services (Part B); remnant advertising networks configured by the Publisher; payment processors.

ANNEX IV — Standard Contractual Clauses and UK Addendum

Where the Standard Contractual Clauses (Decision (EU) 2021/914) are incorporated under A10 or B7, the following options apply:

• Module: Module Two for Part A (Publisher exporter → Traffic Bull importer, where the Publisher is in the EEA and Traffic Bull's processing takes place outside it); Module One for Part B (Traffic Bull exporter → Advertiser importer). Where Traffic Bull is the exporter and the Publisher is outside the EEA, no SCCs are needed between Traffic Bull and the Publisher.
• Clause 7 (docking): applies.
• Clause 9 (sub-processors, Module Two): Option 2, general written authorisation, with the 14-day notice period in A4.2.
• Clause 11 (redress): the optional independent-dispute-resolution wording does not apply.
• Clause 13 (supervisory authority): the Information and Data Protection Commissioner, Malta, unless the exporter is established in another EEA state, in which case that state's authority.
• Clause 17 (governing law): the law of Malta.
• Clause 18 (forum): the courts of Malta.
• Annex I.A/I.B of the SCCs: the parties are identified by the Account details held in the Administration Panel and the Insertion Order; the description of transfer is Annex I of this Platform DPA. Annex I.C: as Clause 13. Annex II of the SCCs: Annex II of this Platform DPA. Annex III of the SCCs: Annex III of this Platform DPA.
• UK transfers: the UK International Data Transfer Addendum (version B1.0, 21 March 2022) is incorporated; Table 1 is completed by the Account details, Table 2 by the Module selections above, Table 3 by the Annexes above, and in Table 4 neither party may end the Addendum when the ICO changes it. The Addendum prevails for transfers from the UK.

Version 1.0 — 6 October 2026. Previous versions: none. Change history at panel.trafficbull.com/legal.