1. Incorporation & Roles of the Parties
This DPA applies whenever DemandReady Data, a brand operated by Mixed Media Ventures, LLC, a Nevada limited liability company, (“Company”) Processes Personal Data on behalf of Customer in connection with the Services. The parties agree that, for the purposes of this DPA:
- Where DemandReady Data Processes Customer Data uploaded or submitted by Customer (for example, a suppression list, seed audience, or match file provided by Customer) in order to deliver the Services, DemandReady Data acts as a Processor / “Service Provider” (as applicable under U.S. state privacy law) on Customer's behalf as Controller / “Business.”
- Where DemandReady Data licenses its own pre-built intent-data and audience products to Customer (data DemandReady Data itself sources, builds, and maintains independent of any specific Customer instruction), DemandReady Data acts as an independent Controller / “Business” with respect to that data, and Customer's subsequent use of it is governed by the license and use restrictions in the Agreement and the Terms of Service, not by this DPA's Processor obligations.
By entering into an Agreement that references this DPA, Customer agrees to the terms below with respect to any Personal Data DemandReady Data Processes as a Processor/Service Provider under the first bullet above.
2. Definitions
Capitalized terms not defined here have the meaning given in the Agreement. As used in this DPA:
- “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the Processing of Personal Data under this DPA, including, as applicable, the CCPA/CPRA and other U.S. state privacy laws, and, to the extent applicable, the EU/UK GDPR.
- “Personal Data,” “Processing,” “Controller,” “Processor,” “Business,” “Service Provider,” and “Data Subject” have the meanings given under Applicable Data Protection Laws.
- “Customer Data” means Personal Data that Customer or its end users submit to DemandReady Data for Processing in the course of using the Services (e.g., match files, suppression lists, seed segments).
- “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data processed by DemandReady Data as a Processor.
- “Sub-processor” means any third party engaged by DemandReady Data to Process Customer Data in providing the Services.
- “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission, as may be updated or replaced from time to time.
3. Scope & Duration of Processing
DemandReady Data will Process Customer Data only (a) to provide the Services, (b) in accordance with Customer's documented instructions (the Agreement, applicable Order Forms, and this DPA constitute such instructions), and (c) as required by applicable law, in which case DemandReady Data will inform Customer of that legal requirement before Processing, unless the law prohibits such notice. The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex I. Processing will continue for the term of the Agreement, unless otherwise agreed in writing.
4. Compliance with Law
Each party will comply with its respective obligations under Applicable Data Protection Laws in connection with this DPA. DemandReady Data will notify Customer without undue delay if it determines it can no longer meet its obligations under Applicable Data Protection Laws.
5. Personnel & Confidentiality
DemandReady Data will ensure that personnel authorized to Process Customer Data are subject to a duty of confidentiality (whether contractual or statutory) and receive appropriate training on data protection obligations relevant to their role.
6. Security Measures
DemandReady Data will implement and maintain appropriate technical and organizational measures designed to protect Customer Data against Security Incidents, taking into account the nature of Processing and the risks involved, as further described in Annex II.
7. Sub-processors
Customer provides general authorization for DemandReady Data to engage Sub-processors to Process Customer Data, provided DemandReady Data: (a) maintains a written agreement with each Sub-processor imposing data protection obligations materially no less protective than this DPA; (b) remains liable for each Sub-processor's acts and omissions with respect to Customer Data to the same extent DemandReady Data would be liable if performing the services of each Sub-processor directly; and (c) provides Customer at least ten (10) business days' notice before engaging a new Sub-processor whose Processing materially changes the categories described in Annex III, during which Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection (including, if necessary, Customer terminating the affected portion of the Services without penalty).
8. Assistance with Data Subject Requests
DemandReady Data will, taking into account the nature of the Processing, provide reasonable assistance to Customer (at Customer's expense for anything beyond nominal effort) to respond to verified requests from Data Subjects to exercise their rights under Applicable Data Protection Laws with respect to Customer Data, including by promptly forwarding any such request DemandReady Data receives directly regarding Customer Data to Customer.
9. Personal Data Breach Notification
DemandReady Data will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Data, and will provide information reasonably available to it about the nature of the incident, likely consequences, and measures taken or proposed to address it, and will cooperate with Customer's reasonable requests in investigating and remediating the incident.
10. International Data Transfers
DemandReady Data primarily Processes Customer Data within the United States. If Processing under this DPA requires a transfer of Personal Data protected under the EU/UK GDPR or Swiss data protection law out of the EEA, UK, or Switzerland, the Standard Contractual Clauses (Module 2: Controller-to-Processor, or Module 3: Processor-to-Processor, as applicable), together with the UK International Data Transfer Addendum where relevant, are incorporated into and form part of this DPA for such transfers, with Annex I and Annex II of this DPA serving as the corresponding annexes to the SCCs.
11. Audit Rights
DemandReady Data will make available to Customer, upon reasonable written request and no more than once per calendar year (except following a Security Incident or as required by a regulator), information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied through a summary of DemandReady Data's then-current security certifications, independent audit reports, or completed security questionnaires, in lieu of an on-site audit, unless such materials are insufficient to demonstrate compliance, in which case the parties will agree on the scope, timing, and confidentiality terms of an on-site audit conducted by a mutually agreed independent auditor at Customer's expense.
12. Return or Deletion of Data
Upon termination or expiration of the Agreement, and upon Customer's written request, DemandReady Data will delete or return all Customer Data in its possession, except to the extent applicable law requires retention, in which case DemandReady Data will continue to protect the retained Customer Data in accordance with this DPA and limit further Processing to the purpose of that retention requirement.
13. Liability
Each party's liability arising out of or in connection with this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in the Agreement to the liability of a party means the aggregate liability of that party under both the Agreement and this DPA together, not separately.
14. Term & Precedence
This DPA is effective for as long as DemandReady Data Processes Customer Data as a Processor/Service Provider under the Agreement. In the event of a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA controls. DemandReady Data may update the general terms of this hosted DPA from time to time to reflect legal or operational changes, provided that no update will materially reduce the protections afforded to Customer Data during the term of an active Agreement without Customer's consent.
Annex I — Description of Processing
| Item | Description |
|---|---|
| Subject matter | Processing of Customer-submitted match files, suppression lists, and seed audiences to deliver search-intent data and audience activation Services. |
| Duration | For the term of the Agreement, plus any post-termination retention required by law. |
| Nature & purpose | Matching, appending, activating, and delivering audience data across Customer-selected marketing channels. |
| Categories of Data Subjects | Customer's prospective and existing customers/contacts included in submitted files; consumers and business contacts within licensed intent-data audiences. |
| Categories of Personal Data | Name, contact details (email, postal address, phone), company/title (B2B), hashed/pseudonymized identifiers, inferred intent/interest signals. No special-category/sensitive data is intentionally processed. |
Annex II — Technical & Organizational Measures
- Encryption of Customer Data in transit (TLS) and at rest.
- Role-based access controls limiting access to Customer Data to personnel with a need to know.
- Logical network segmentation and firewall controls around production systems.
- Vetting of Sub-processors and data partners for appropriate security and confidentiality practices, including reliance on SOC 2-certified upstream data providers where applicable.
- Maintenance of security incident detection and response procedures, including the notification commitments in Section 9.
- Periodic review of access permissions and prompt revocation upon personnel offboarding.
- Secure deletion or de-identification procedures for data subject to retention limits or deletion requests.
Annex III — Sub-processors
DemandReady Data engages Sub-processors in the following categories to provide the Services:
| Category | Purpose |
|---|---|
| Cloud hosting & infrastructure | Hosting of the website, application, and underlying data infrastructure. |
| CRM / customer relationship management | Management of Customer and prospect contact records and communications. |
| Transactional email delivery | Delivery of account, notification, and consultation-related email communications. |
| Upstream intent-data providers | Sourcing of underlying consented, opt-in intent signals included in licensed audiences. |
A current list of named Sub-processors is available upon written request to grow@demandreadydata.com.
Contact & Execution
This DPA is incorporated by reference into your Agreement with DemandReady Data as of the effective date of that Agreement. If your organization's procurement process requires a separately counter-signed copy of this DPA rather than incorporation by reference, contact us at grow@demandreadydata.com and we will provide an executable version reflecting the same terms above.
Mixed Media Ventures, LLC (DemandReady Data)
331 Newman Springs Road, Building 1, 4th Floor, Suite 143 #94
Red Bank, NJ 07701
Email: grow@demandreadydata.com