All capitalized terms used in this DPA shall have the meanings given to them below:

• Services
  “Services” means "Webridge" services and its associated and related optional services collectively. For the avoidance of doubt, “Webridge” is a global affiliate marketing network/platform operated by FORIT, through which (among other things) it connects the websites operated by Advertisers ("Advertiser Sites”) and the websites operated by Publishers ("Affiliate Sites”), allowing the users of the Publishers’ Affiliate Sites to be redirected to the Advertiser Sites. In addition, this Services include advertising performance measuring service.
• Consumer
  “Consumer” means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier, and who is a unique internet user or browser and has been redirected from the Affiliate Sites to the Advertiser Sites.
• Personal Data
  “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. FORIT collects the following types of personal data through our websites: Internet activity information, IP address, iOS terminal ad identifier, Android terminal ad identifier, Terminal information (UserAgent, OS, Device, etc.), commercial information, unique personal identifier and online identifier. We also collect personal information the Consumer chooses to provide to us when submitting an inquiry submission form, such as name, contact information, phone number, and address.
• Processing
  “Processing” ("process", "processes" and "processed" shall be interpreted accordingly) means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.

• This DPA is intended to describe the conditions and requirements under the CCPA and Regulations.
• This DPA is set forth the rights and obligations with respect to processing the Personal Data that is provided directly or indirectly by the Business to the Service Provider (including the subcontractor who is the other Service Provider of the Business and is entrusted by the original Service Provider with the performance of part of the obligations under the CCPA and Regulations) or collected by the Service Provider (including the subcontractor) on behalf of the Business, in order to comply with the CCPA, Regulations, and other data protection laws applicable to processing Personal Data.

• Unless otherwise defined in this DPA, terms used in this DPA shall have the same meanings as in the T&Cs or the Agreement. Terms not defined in the T&Cs, the Agreement, or this DPA shall have the same meanings as defined in the CCPA and Regulations.
• The provisions of the T&Cs or the Agreement shall remain in full force and effect and shall apply to this DPA, except to the extent that the T&Cs or the Agreement conflict with the provisions of this DPA, in which case the provisions of the T&Cs or the Agreement shall prevail over those of this DPA.

This DPA shall apply to the processing of any Personal Data in order to carry out the Business Purpose (as defined in Article 6). The Publisher agrees to process the Personal Data in compliance with this DPA.

• The role of this DPA is stipulated as below:
  • Advertiser: Business
  • FORIT: Service Provider
  • Publisher: Service Provider (subcontractor)
• FORIT entrusts the Publisher as a subcontractor to provide the Services in accordance with this DPA.
• The Publisher shall be entrusted with a part of the Advertising performance measurement operation (“Entrusted Business”) and shall perform the Entrusted Business in accordance with this DPA, the T&Cs and the Agreement, and the other terms and conditions as specified by the Advertiser and FORIT. The Publisher shall perform the Entrusted Business by posting the link code obtained from the Services on its Affiliate Sites or by any other method specified by the Advertiser and/or FORIT.
• The Publisher shall be responsible for compliance with the requirements of the CCPA and Regulations as a Service Provider.
• FORIT shall not make any disclosures to the Publisher that the CCPA and Regulations would treat as selling or sharing.

The Publisher shall collect, maintain, and use Personal Data and disclose it to FORIT within the scope of the business purpose (“Business Purpose”) unless permitted by the CCPA and Regulations. The Business Purpose is FORIT’s providing the Services to the Advertiser and the Publisher. The Services include the Advertising performance measurement operation, but are not limited to, measurement of the number of advertisements viewed, visited, displayed, clicked, installed, and/or actioned to and/or by unique visitors, verification of the location and quality of advertisements displayed, auditing of compliance with these specifications and other standards, provision of advertising network services or affiliate marketing services including affiliate advertisements, and provision of analysis services.

• The Publisher shall not sell or share any Personal Data.
• The purposes for which FORIT discloses the Personal Data to the Publisher are those limited and specified purposes set forth in Article 6 of this DPA.
• The Publisher understands and acknowledges that FORIT discloses the Personal Data to the Publisher only for the Business Purpose, and the Publisher shall process the Personal Data only for the Business Purposes.
• The Publisher shall not collect, retain, use, or disclose the Personal Data except for any purpose other than the Business Purposes or as otherwise permitted by the CCPA or Regulations.
• The Publisher shall not collect, retain, use, or disclose the Personal Data for any commercial purpose other than the Business Purposes unless expressly permitted by the CCPA or Regulations.
  This prohibition includes, but is not limited to, the prohibition of combining or updating the Personal Data with personal information that the Publisher received from another source or collected from its own interaction with the Consumers, unless expressly permitted by the CCPA or Regulations.
• The Publisher shall comply with all applicable sections of the CCPA and Regulations, including - with respect to the Personal Data – providing the same level of privacy protection as required of FORIT and the Advertiser by the CCPA and Regulations.
  This compliance includes, but is not limited to cooperating with FORIT and the Advertiser in responding to and complying with the Consumers’ requests made pursuant to the CCPA, and implementing reasonable security procedures and practices appropriate to the nature of the Personal Data to protect the Personal Data from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with California Civil Code section 1798.81.5.
• FORIT and the Advertiser has the right to take reasonable and appropriate steps to ensure that the Publisher uses the Personal Data in a manner consistent with the obligations of FORIT and the Advertiser under the CCPA and Regulations.
  These reasonable and appropriate steps include, but are not limited to ongoing manual reviews and automated scans of the Publisher’s system and regular internal and operational testing at least once every twelve (12) months.
• The Publisher shall notify FORIT immediately after the Publisher makes a determination that it can no longer meet its obligations under the CCPA and Regulations.
• FORIT and the Advertiser has the right to, upon notice, take reasonable and appropriate steps to stop and remediate the Publisher’s unauthorized use of the Personal Data.
  This right includes, but is not limited to the right to require the Publisher to provide documentation that verifies that it no longer retains or uses the Personal Data that have made a valid request to delete with FORIT and the Advertiser.
• The Publisher shall enable FORIT and the Advertiser to comply with the Consumer request made pursuant to the CCPA, provided, however, that, if the Consumer request is a request that the Publisher must comply with, FORIT shall inform the Publisher thereof and provide the information necessary to the Publisher to comply with the request, in which case the Publisher shall comply with the request.

In addition to the CCPA, there are other states’ privacy laws that require the contract between the Business and the Service Provider to satisfy certain conditions. In this regard, the following provisions in this Article shall apply to the Personal Information in addition to other provisions in this DPA. In the event of any conflict or inconsistency between them, the following provisions in this Article shall prevail and control. All terms defined in the applicable states’ privacy laws have the same meaning when used in this Article.

• The Publisher shall ensure that processing the Personal Data is subject to a duty of confidentiality with respect to the Personal Data.
• At the FORIT’s discretion, the Publisher shall delete or return to FORIT all the Personal Data which FORIT discloses to the Publisher or the Publisher collects directly on behalf of FORIT and the Advertiser at the end of the provision of the Services, unless retention of the Personal Data is required by law.
• Upon the request of the FORIT, the Publisher shall make available to FORIT and the Advertiser all the information necessary to demonstrate the Publisher’s compliance with its obligations under this DPA.
• The Publisher shall allow FORIT and the Advertiser or their designated assessor to conduct an assessment of the Publisher’s policies and technical and organizational measures in support of the obligations under this DPA, using an appropriate and accepted control standard or framework and assessment procedure for such assessments. Alternatively, the Publisher may arrange for a qualified and independent assessor to conduct that assessment and provide a report of the assessment to the FORIT upon request.

• The Publisher shall not subcontract, outsource and entrust all or part of the performance relating to processing Personal Data under this DPA to a third party without FORIT’s prior written consent.
• If the Publisher subcontracts, outsources and entrusts all or part of the performance relating to processing Personal Data to a third party with FORIT’s approval under the preceding paragraph, the Publisher shall impose on the third party same or substantially the same obligations as this DPA and shall assume all responsibility for the conduct of the third party.

Each party shall indemnify, defend and hold the other party harmless from all liabilities, costs and expenses (including, without limitation, reasonable attorneys’ fees) that such party may suffer, sustain or become subject to as a result any misrepresentation or breach of warranty, covenant or agreement of the indemnifying party contained herein or the indemnifying party’s gross negligence or willful misconduct in performance of its obligations under this DPA.

If any individual provision of this DPA is found to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA shall not be affected.

FORIT reserves the right to update and modify this DPA, and the applicable terms and conditions contained in the T&Cs or the Agreement shall apply.

This DPA shall be governed by and construed in accordance with the laws of the State of California, USA.