Data Protection Addendum for the Ad Selection API

This Ad Selection API Data Protection Addendum ("Ad Selection DPA") forms part of the Customer Agreement between Customer ("Customer" or "you") and Microsoft Corporation ("Microsoft" or "we") covering Customer's use of the Ad Selection API ("Ad API"). It sets forth the parties' obligations with respect to Customer Personal Data processed by Microsoft.

This Ad Selection DPA incorporates by reference the terms of the Microsoft Products and Services Data Protection Addendum ("DPA") ("general DPA"). Capitalized terms not defined herein shall have the meanings given to them in the Customer Agreement or the general DPA, as applicable.

Microsoft may make non-material changes to this Ad Selection DPA at any time without advance notice, but we will provide at least fifteen (15) calendar days prior notice of any material changes. We may give you notice via the email address you gave us. Notices emailed to you are deemed given when sent. All changes will apply prospectively, and using the Ad API after the changes become effective means you accept the changes. If you do not accept the changes, you must stop using the Ad API.

This Ad Selection DPA applies solely to Customer's use of the Ad API and not to any other Online Services. Where the terms of this Ad Selection DPA conflict with the terms of the general DPA, the terms of this Ad Selection DPA will control solely with respect to the Ad API.

1. The Ad API is not a Core Online Service.

2. The following terms of the general DPA shall not apply to the Ad API:

   • "Data Subject Rights; Assistance with Requests"
   • "Data Retention and Deletion"
   • "Educational Institutions"
   • "CJIS Customer Agreement"
   • "HIPAA Business Associate"
   • "Telecommunication Data"
   • "Biometric Data"
   • "Supplemental Professional Services"
   • "Appendix A – Security Measures"
   • "Appendix C – Additional Safeguards Addendum"
   • "Attachment 1 – European Union General Data Protection Regulation Terms"

3. The following changes are made to the general DPA for the Ad API only:

   a. The following is added to the end of "Nature of Data Processing; Ownership": Customer agrees that Customer's agreement (including the DPA Terms and any applicable updates), along with the product documentation and Customer's use and configuration of features in the Ad API, are Customer's complete documented instructions to Microsoft for the processing of Personal Data.

   b. The following is added to the end of "Data Subject Rights; Assistance with Requests": Microsoft makes available settings within the Edge browser that enable data subjects to exercise their rights under the General Data Protection Regulation (GDPR) without requiring such data subjects to contact Customer to do so.

   c. The final four paragraphs of "Security Practices and Policies" (which begin "In addition, ..."; "Each Core Online..."; "Microsoft implements..."; and "Microsoft may...") do not apply to the Ad API.

   d. The terms in the section entitled "Data Transfers and Location" shall only apply to the extent that any data is stored within the cloud environment and not on the Customer's or end users' devices directly.