Alkimi takes its responsibilities towards confidentiality and data privacy very seriously. By agreeing to use Alkimi’s ad exchange you agree to abide by the provisions of this policy. This policy is specifically incorporated into our terms and conditions, which can be found here (our “Terms and Conditions”), and the provisions of our Terms and Conditions apply to this policy. A failure to abide by this policy will be regarded as a material breach of Alkimi’s agreement with you and may, in addition to any other remedy sought, result in the termination of your rights to use the ad exchange.

1. DEFINITIONS AND INTERPRETATION

   1. In this policy the definitions set out below shall apply unless the context requires otherwise:
   2. “Affiliate” means any corporation or other legal entity that a party now or hereafter Controls, is Controlled by or is under common Control with a party; where “Control” means the direct or indirect ownership of more than fifty percent (>50%) of the shares or similar interests entitled to vote for the election of directors or other persons performing similar functions;
   3. “Agreement” means the Alchemy Publisher Agreement comprising the Order Form between Alkimi and you and the Terms and Conditions;
   4. “Alkimi” means Alchemy Exchange Limited (registered number 13237946), a company registered in England and Wales, whose registered office is at 19 Willow Street, London EC2A 4BH;
   5. “Alkimi Group” means Alkimi and its Affiliates;
   6. “Confidential Information” means any know-how, trade secret, documentation or information (whether commercial, financial, technical, operational or otherwise) relating to a party’s business, affairs, operations, processes, intentions, customers or suppliers and which is either marked as “confidential” or which the other party was or ought reasonably to be aware was of a confidential nature;
   7. “Data Protection Legislation” means GDPR, the Data Protection Act 2018 and any other law applicable to the protection of personal data in effect from time to time;
   8. “GDPR” means the UK and EU General Data Protection Regulations;
   9. “party” means Alkimi or you; and
   10. “you” means the Publisher as defined in the Agreement.

2. CONFIDENTIALITY

   1. Each party shall keep confidential all Confidential Information and not use it except for the purpose of exercising or performing its rights and obligations under the Agreement. Each party may disclose Confidential Information to its or its Affiliates employees, officers, professional representatives or advisers, sub-contractors and agents, provided that they:
      1. need to know it for the purpose of exercising or performing that party’s rights and obligations under the Agreement;
      2. have been informed of the confidential nature of the Confidential Information divulged; and
      3. agree to act in compliance with the confidentiality requirements of the Agreement.
   2. The disclosing party shall procure that any third party to which Confidential Information is disclosed pursuant to paragraph 2.1 complies with the terms of this paragraph 2. Neither party will disclose Confidential Information to any other third party or use it except as otherwise permitted in the Agreement.
   3. Notwithstanding any other provision of the Agreement, it shall not be a breach of the Agreement for either party to disclose any Confidential Information pursuant to a court order or a binding request from a regulatory (or other similar) authority with jurisdiction or from any other third party with power to require the disclosure of such information, provided that (to the extent it is permitted to do so) the affected party gives all reasonable notice of such disclosure to the other party.
   4. Subject to the other terms of the Agreement, the terms of this paragraph 2 shall continue to apply notwithstanding termination of the Agreement.

3. DATA PRIVACY

   1. Each party agrees that, in the performance of its respective obligations under the Agreement, it will comply with the provisions GDPR and the Data Protection Legislation more broadly, in each case to the extent it applies to each of them. Where used in this paragraph 3, the expressions data subject, personal data, personal data breach and process bear their respective meanings given in Data Protection Legislation.
   2. Alkimi may be expected to process personal data on your behalf for the purposes of fulfilling its obligations under the Agreement. The types of personal data that Alkimi may likely be expected to process on your behalf is profile information relating to individuals who may end up viewing ad impressions created as a result of the Agreement.
   3. Where Alkimi processes personal data on your behalf under or in connection with the Agreement, it will do so only in accordance with the terms of the Agreement and your documented instructions (unless otherwise required by law in which case Alkimi will, where permitted, inform you of that legal requirement before processing).
   4. You warrant that:
      1. you will only provide (or ensure the provision of) personal data to Alkimi where that personal data has been lawfully obtained and where you are lawfully entitled to provide (or ensure the provision of) that personal data to Alkimi for the intended purpose and means of processing;
      2. any instructions given to Alkimi in accordance with paragraph 3.3 will be compliant with applicable Data Protection Legislation, be within the scope of your obligations under the Agreement and will not (if properly performed) put either party in breach of their respective obligations under Data Protection Legislation; and
      3. you will indemnify Alkimi against all claims, demands, penalties, fines, actions, costs, expenses, losses and damages suffered or incurred by or awarded against Alkimi arising from or in connection with any breach by you of this paragraph 3.4.
   5. Where Alkimi processes any personal data on your behalf under or in connection with the Agreement it will:
      1. other than as permitted by Chapter V of the GDPR, not transfer or allow the transfer of that personal data outside the United Kingdom or European Economic Area without your written consent;
      2. ensure that any persons authorised to process the personal data are subject to a duty of confidence in respect of that processing;
      3. implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in compliance with the obligations imposed on Alkimi by article 32 of the GDPR;
      4. notify you without undue delay on becoming aware of a personal data breach and cooperate with you to resolve that issue; and
      5. at your reasonable expense, provide the assistance that you may reasonably require to assist you to comply with your obligations to keep that personal data secure, allow you to inform a regulatory authority or data subject of a personal data breach, conduct a data protection impact assessment, consult with the appropriate supervisory authority regarding the relevant processing activities and/or respond to requests made by data subjects pursuant to Data Protection Legislation.
   6. You authorise Alkimi to engage sub-processors from time to time provided that Alkimi will notify you of any intended changes concerning the addition or replacement of sub-processors and will impose upon any sub-processor (and ensure any sub-processor’s compliance with) the terms of this paragraph 3 as if the processing being carried out by the sub-processor was being carried out by Alkimi (and Alkimi will be liable for the acts and omissions of its sub-processors as if they were Alkim’si own acts and omissions).
   7. From time to time during the term of the Agreement Alkimi will (upon written request from you):
      1. provide details in writing of its data processing activities carried out on your behalf; and
      2. on reasonable notice allow you (or your appointed auditor) to audit its compliance with these terms, subject to any reasonable requirements or restrictions that Alkimi may impose to safeguard the personal data it holds on behalf of other clients and/or avoid unreasonable disruption to Alkimi’s business.
   8. Alkimi will process personal data on your behalf only during the term of the Agreement (and following termination to the extent required to perform any post termination obligations). On the termination or expiry of any part of the Agreement, Alkimi will either delete or return all personal data processed on your behalf in connection with the Agreement, and delete any copies (except to the extent retention is required by law or for record-keeping purposes).
   9. For the avoidance of doubt, nothing in this paragraph 3 or otherwise in the Agreement relieves either party of its own direct responsibilities and liabilities under Data Protection Legislation.