Yandex Advertising Network Data Processing Agreement

This is an old version of the document, which expired on December 25, 2022. The current version is available at: https://yandex.com/legal/yan_dpa_ch.

This DPA is valid until December 24, 2022. From December 25, 2022, a new version of the DPA is in force: https://yandex.com/legal/yan_dpa_ch_2.

By using opt-in check-box or by continuing your performance under respective Yandex Advertising Network Agreement you declare that you agree to the following regulations. By proceeding, you confirm that you have a business established in the territory of a member state of the European Economic Area or Switzerland, or that, for other reasons, you are subject to the territorial scope of the national implementations of the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, (General Data Protection Regulation; hereinafter – "GDPR"). You further agree that if the aforementioned is not the case, this DPA between you and Yandex shall be void.

This DPA enters into force on 25 May 2018 if you have agreed to the DPA prior to or on such date, or on the date on which you agreed to the DPA, if such date is after 25 May 2018.

This DPA is an addition to the Yandex Advertising Network Agreement (hereinafter – “YAN Agreement”) which could be executed by and between you and Yandex in any form. In the event of a contradiction between these clauses and the YAN Agreement, the terms and conditions under this DPA shall prevail.

If you are accepting this DPA on behalf of Yandex Advertising Network Partner (“Owner” or “Partner” depending on the wording of the YAN Agreement) (hereinafter – “Partner”), you warrant that: (a) you have full legal authority to bind Partner to this DPA; (b) you have read and understand this DPA; and (c) you agree, on behalf of the Partner, to this DPA.

1. Introduction

This DPA reflects the parties’ agreement on the processing of Controller Personal Data in connection with the Data Protection Legislation.

2. Definitions and Interpretation

2.1. In this DPA:

“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with, a party.

“Controller Data Subject” means a data subject to whom Controller Personal Data relates.

“Controller Personal Data” means any personal data that is processed by a party under the YAN Agreement in connection with provision or use (as applicable) of the Services by the Partner.

“Services” means the services provided by the Partner subject to the respective YAN Agreement.

“Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland); and/or (c) any other applicable law, statute regulation, directive or legislative act of another form, applicable to the Processing of Controller Personal Data.

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

“Yandex” means Yandex Group entity which is the party to the YAN Agreement.

2.2 The terms “controller”, “data subject”, “personal data”, “processing” and “processor” as used in this DPA have the meanings given in the GDPR.

2.3 Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.

3. Application of this DPA.

3.1 Application of Data Protection Legislation. This DPA will only apply to the extent that the Data Protection Legislation applies to the processing of Controller Personal Data.

3.2 Application to Controller Services. This DPA will only apply to the Services for which the parties agreed to in the YAN Agreement. The Partner could accept this DPA either by (a) clicking in the special check-box in the Partner Interface, or (b) if the YAN Agreement incorporates this DPA by reference.

4. Processing of Personal Data

4.1. Independent Controllers. Each party:

(a) is an independent controller of Controller Personal Data under the Data Protection Legislation;

(b) will individually determine the purposes and means of its processing of Controller Personal Data; and

(c) will comply with the obligations applicable to it under the Data Protection Legislation with respect to the processing of Controller Personal Data.

4.2. Restrictions on Processing. Section 4.1 (Independent Controllers) will not affect any restrictions on either party’s rights to use or otherwise process Controller Personal Data under the YAN Agreement (if any).

4.3. Transfers of Data Out of the European Economic Area and Switzerland. Either party may transfer Controller Personal Data outside the European Economic Area and Switzerland if it complies with the provisions on the transfer of personal data to third countries in the Data Protection Legislation.

5. Collection of Personal Data

5.1. Warranties. The Partner represents and warrants, and, at Yandex’s request, will provide supporting evidence, to demonstrate that: (i) the Partner collects, obtains and processes Personal Data lawfully, without violating any third parties’ rights, contractual obligations or Data Protection Legislation; (ii) the Partner has all rights, consents, authorization and title to grant the rights and permissions to collect Controller Personal Data by Yandex according to the YAN Agreement and the terms of this DPA; (iii) the Partner has implemented and will maintain a privacy policy compatible with the requirements of Data Protection Legislation, governing the use and Processing of the Controller Personal Data; (iv) Processing and use of the Controller Personal Data by Yandex will not violate the Controller Data Subject’s rights and rights of the other third parties, including without limitation privacy, data protection, good-will, good name, publicity, confidentiality and intellectual property rights.

5.2. Disclosure Notification. Without limiting the aforesaid, the Partner confirms, and at Yandex’s request will demonstrate that all Controller Data Subjects received appropriate disclosures and notifications, as required under Data Protection Legislation, including for the use, distribution and trans-border transfer of Controller Personal Data, which is required for the use and Processing of the Controller Personal Data under the terms of the YAN Agreement and this DPA. Where a third party provided the notices to the Controller Data Subjects and received their consent, the Partner will bear sole responsibility to verify and will be able to demonstrate that the notices and consents were sufficient for the purposes of use under the terms of the YAN Agreement and this DPA and adequate pursuant to the Data Protection Legislation. The Partner represents and warrants that the Controller Data Subjects would be provided with nearly the following information (either in the privacy policy or in respective privacy notice, depending on which method is required by the Data Protection Legislation):

“This [website/mobile app] uses Yandex Advertising Network advertising code subject to the agreement with [name of Yandex entity] (hereinafter referred to as the “Yandex”). Yandex advertising code may uses cookies, small text files placed on users’ computers to analyze user activity, or other tracking instruments (if applicable), used for the same purposes. Information collected by cookies or other tracking instruments does not reveal your identity, but it can help us to improve our [website/mobile app] performance. Information about your use of this [website/mobile app] collected by cookies or other tracking instruments will be transferred to Yandex and stored on Yandex’s server in the EU and the Russian Federation. Yandex will process this information to assess how you use the [website/mobile app], interact with advertisements, compile reports for us on such advertisements, and provide other services. Yandex processes this information as specified in the Privacy Policy available at https://yandex.com/legal/confidential. You can stop using cookies or other tracking instruments be making relevant adjustments in browser settings. However, it can affect some of our [website/mobile app] functions. By using this [website/mobile app], you understand and agree that Yandex can process your data in the above manner and for the above purposes.”

6. Cooperation

6.1. Assistance in Compliance. The Partner will cooperate with Yandex and provide all necessary assistance to Yandex in connection with –

6.1.1. Yandex’s GDPR (or other Data Protection Legislation)-related demonstration of compliance;

6.1.2. Requests to exercise Controller Data Subjects’ rights, complaints and inquiries pursuant to section 6 of this DPA;

If at Yandex’s discretion the Partner cannot provide sufficient assistance, Yandex may terminate this DPA and YAN Agreement, or those parts of the YAN Agreement which cannot be performed without the requested assistance.

6.2. The Partner Notices. Unless prohibited under applicable laws, the Partner will notify Yandex of:

6.2.1. Any violation by the Partner, or anyone on the Partner’s behalf of any provision under this DPA;

6.2.2. Any official competent supervisory proceedings regarding the Processing of the Controller Personal Data;

6.2.3. Any legal or factual circumstances preventing the Partner from performing any of its representations, warranties or obligations under the terms of this DPA; and

6.2.4. Any material changes impacting the technical and organizational security measures implemented by the Partner which cause such measures to fall short of the Partner’s data security obligations under the Data Protection Legislation.

6.3. Inquiries, requests and complaints. The Partner will provide all reasonable and timely assistance to Yandex, to enable Yandex to respond to: (i) supervising authorities or Controller Data Subjects’ requests for assistance in relation to any request from the Controller Data Subject to exercise any of the Controller Data Subject’s rights under the Data Protection Legislation; and (ii) any other correspondence, inquiry or complaint received from the Controller Data Subject (or on the Controller Data Subject’s behalf), supervising authority and other regulators, or competent authorities in connection with the Processing of the Controller Personal Data under this DPA.

6.4. Information obligation. If any such communication related to the Processing of the Controller Personal Data is made directly to the Partner, the Partner will promptly inform Yandex about such communication, provide Yandex all related details and will not respond to the communication unless specifically required by applicable Data Protection Legislation or authorized by Yandex.

7. Liability

7.1. The Partner guarantees the prompt and satisfactory performance of its obligations and responsibilities under this DPA by the Partner and the Partner agrees that it will be responsible for all costs associated with its compliance of such obligations. The Partner is responsible and liable for its acts and omissions under this DPA.

7.2. The Partner will defend, indemnify and hold Yandex, its Affiliates, their officers, directors, employees, contractors and agents harmless from and against any and all third-party claims, demands, losses, damages or expenses, including reasonable attorneys’ fees and court costs, arising out of or in connection with any failure by the Partner to comply with the requirements under this DPA.

8. Priority

8.1 Effect of this DPA. If there is any conflict or inconsistency between the terms of this DPA and the remainder of the YAN Agreement then, subject to Sections 4.2 (Restrictions on Processing) and 8.2 (Other Data Processing Agreements), the terms of this DPA will govern. Subject to the amendments in this DPA, the YAN Agreement remains in full force and effect.

8.2. Other Data Processing Agreements. This DPA will not affect any other separate Data Processing Agreement between Yandex and/or its Affiliate and the Partner in respect of any data processing arising out of the agreements other than YAN Agreement.

9. Changes to this DPA

9.1. Yandex may change the DPA at any moment in case: (a) changes are required to comply with the applicable law, applicable regulation, a court order or guidance issued by a regulator or agency; or (b) changes do not: (i) result in a degradation of the security of Controller Personal Data; (ii) expand the scope of, or remove any restrictions on, Yandex Processing of Controller Personal Data; and (iii) otherwise have a material adverse impact on your rights under this DPA, as reasonably determined by Yandex. Before changes will take effect Yandex informs you at least thirty (30) days in advance (or shorter period as may be required to comply with the applicable law, applicable regulation, a court order or guidance issued by a regulator or agency) by either: (a) email; or (b) alerting you via the Partner Interface. If you object to any such change, you must terminate the DPA and YAN Agreement (unless the YAN Agreement could be performed in the remaining part without existence of this DPA) and stop providing (or using, as applicable) the Services under the YAN Agreement. Yandex shall be entitled not to notify you about editorial changes.

10. Disclosure of the DPA.

The Partner acknowledges that Yandex may disclose this DPA and any relevant privacy provisions in the YAN Agreement to any supervisory authority, regulator or other competent authority, to the extent required under the applicable law.

Date of publication: 24.05.2018