Exhibit 2 – Data Processing Agreement

This agreement (the ”Data Processing Agreement”) has been entered into between Adtraction and You (the ”Publisher”).

1. Introduction and scope

Adtraction and the Publisher have entered into an agreement which enables the Publisher to provide space on its website or other internet marketing channels for links and advertisements for the websites that have a Publisher program registered with Adtraction (the ”Publisher agreement”).

The purpose of this Data Processing Agreement is to fulfill the demands set out in Section 30 of the Swedish Personal Data Act (1998:204) (the ”PDA”) and as of 25 May 2018 the General Data Protection Regulation (EU 2016/679) and/or the new PDA (the ”GDPR”). This Data Processing Agreement covers all processing of personal data that the Publisher process and for which Adtraction is responsible under the PDA and/or the GDPR.

As a consequence of the Publisher agreement, the Publisher may receive access to personal data for which Adtraction is responsible under the PDA and/or the GDPR. Adtraction hereby grants permission for the Publisher to process personal data as set out in this Data Processing Agreement.

Adtraction and the Publisher are referred to individually as a ”Party” and jointly as the ”Parties”.

2. Validity and use of the Data Processing Agreement

This Data Processing Agreement applies to every occasion when the Publisher is processing personal data for which Adtraction is responsible under the PDA and/or the GDPR.

This Data Processing Agreement terminates automatically when the Publisher agreement terminates, for whatever reason.

The Publisher shall be of assistance when a data subject exercises its right to have personal data concerning him or her rectified, blocked, erased or restricted. Further, the Publisher shall be of assistance when a data subject exercises its right to receive personal data, which the data subject has provided.

3. Purpose of and Instructions for Processing of Personal Data

The Publisher is only allowed to process personal data in accordance with Adtraction’s instructions and only in order to fulfill its obligations under the Publisher agreement.

If the Publisher is lacking sufficient instructions for a specific situation and/or a specific instruction conflicts with the PDA and/or the GDPR the Publisher shall notify Adtraction immediately.

Adtraction shall have the right to supervise that the Publisher process personal data in accordance with this Data Processing Agreement. The Publisher shall lend assistance to Adtraction during such supervision. The Publisher shall also lend assistance to Adtraction in order for Adtraction to fulfill its obligations under the PDA and/or the GDPR.

4. Security safeguards

The Publisher will limit the access to personal data to its employees who need to have access to the personal data in order to carry out the tasks set out in the Publisher agreement. The Publisher shall be able to specify and report to Adtraction which employees who have processed personal data on a given date.

The Publisher will make sure that it does not process personal data in breach of the PDA and/or the GDPR. The Publisher will take appropriate technical and organizational measures to protect personal data against unauthorized access, destruction and change as well as ensure that only the personal data which is necessary for each specific processing purpose is processed.

In the case of a personal data breach, The Publisher shall take necessary actions to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed by the Publisher. The Publisher shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify Adtraction of the personal data breach.

The Publisher shall maintain a record of the processing activities under its responsibility. The record shall at least contain: the categories of processing carried out and if applicable transfers of personal data to a third country or an international organization, including the identification of that third country or international organization and a general description of the technical and organizational security measures for processing the data.

The Publisher shall incorporate sufficient routines to comply with the PDA and/or the GDPR.

5. Return or deletion of personal data

Following termination of the Agreement, The Publisher will return to Adtraction or otherwise make available for retrieval to Adtraction, all personal data it has processed.

Following the return or retrieval of the personal data the Publisher will promptly delete or otherwise render inaccessible all copies of personal data it has processed in connection with the Publisher agreement.

6. Compensation

The Publisher has no right to be compensated for the fulfillment of its obligation under this Data Processing Agreement.

7. Secrecy

The Publisher undertakes not to disclose information to third parties regarding the processing of personal data under this Data Processing Agreement, or other information that Adtraction has provided to the Publisher. The Publisher will make sure that the employees that are given access to personal data will be informed how the personal data is allowed to be processed and make sure that these employees are subject to this secrecy undertaking.

This secrecy undertaking is valid even after this Data Processing Agreement has been terminated.

8. Subcontractors, etc

The Publisher is not allowed to use subcontractors/processors to process personal data for which Adtraction is responsible under the PDA and/or the GDPR.

The Publisher is not allowed to transfer this Data Processing Agreement without Adtraction’s prior written consent.

9. Dispute, Choice of Law and Forum

This Data Processing Agreement shall be governed by the substantive law of Sweden. Any dispute, controversy or claim arising out of or in connection with this Data Processing Agreement, or the breach, termination or invalidity thereof, shall be settled by general courts in Sweden, with Stockholm District Court as court of first instance.

10. Liability

If a private individual, an advertiser, The Swedish Data Protection Authority and/or other third party makes demands towards Adtraction due to the processing of personal data carried out by the Publisher, the Publisher will indemnify and hold Adtraction harmless from any loss, cost and expense, if such demands are due to

  1. The Publishers breach of the Publisher Agreement or this Data Processing Agreement
  2. The Publishers breach of the PDA and/or the GDPR.

The above applies also if Adtraction is subject to administrative fines and/or other fines and cost.

11. Invalidity

If any provision in this Data Processing Agreement or part thereof is found to be invalid, this shall not entail that this Data Processing Agreement in its entirety is invalid.