Joint controller agreement

1. Subject

1.1 Joint processing: collecting data from visitors of the publisher's sites through Dokira's tag, reading and writing information on their devices, and transmitting it in bid requests to advertising partners, as described in Dokira's privacy notice for advertising.

1.2 Not joint: what each advertising partner does with a bid request it receives is its own responsibility. Each party alone is responsible for its other processing, for example the publisher for its site's analytics and Dokira for its billing and statistics.

1.3 Data subjects: visitors of the publisher's sites. Data: as listed in the privacy notice for advertising.

2. The publisher's responsibilities

• Inform visitors in its privacy notice about the advertising, name Dokira, and link to Dokira's privacy notice for advertising (Art. 13 GDPR).
• Obtain consent where the law requires it (section 165(3) TKG 2021 and equivalent laws, Art. 6(1)(a) GDPR) through an IAB TCF certified consent banner, or allow Dokira to provide one on its site. In either case, make sure Dokira is disclosed in the banner.
• Not alter the tag, and not pass personal data to Dokira beyond what the tag collects.
• Forward to Dokira, within five working days, any request or complaint from a visitor that concerns the advertising.

3. Dokira's responsibilities

• Run the tag so that it reads the visitor's consent signals and acts on them: no storage on the device and no personalisation without the required consent, and the signals passed on to every advertising partner.
• Send bid requests only to partners that have committed to processing data in line with the GDPR and the consent signals.
• Keep its privacy notice for advertising correct and available, including the essence of this agreement (Art. 26(2) GDPR).
• Answer visitors' requests about the advertising (Art. 15 to 22 GDPR), coordinating with the publisher where needed.
• Secure the tag and its delivery with appropriate technical and organisational measures (Art. 32 GDPR).
• Keep the record of processing activities for the joint processing (Art. 30 GDPR).

4. Contact point

Visitors may exercise their rights against either party (Art. 26(3) GDPR). Dokira is the contact point for the advertising: publishers@dokira.com.

5. Data breaches

Each party informs the other without undue delay, and at the latest within 48 hours of becoming aware, of a personal data breach that concerns the joint processing. The party in whose sphere the breach occurred notifies the authority and the data subjects where Art. 33 and 34 GDPR require it; the other supports it.

6. Processors and transfers

Each party may use processors for its part under Art. 28 GDPR. Transfers outside the EEA take place only with the safeguards of Chapter V GDPR.

7. Liability and term

7.1 Towards data subjects, both parties are liable under Art. 82 GDPR. Between themselves, each party bears the damage arising from a breach of its own responsibilities under this agreement.

7.2 This agreement runs as long as the AGB contract. Obligations concerning processing that took place before it ended survive.