These U.S. Privacy Terms form a legally binding contract between you and Snap, and are incorporated into the Business Services Terms. Some terms used in these U.S. Privacy Terms are defined in the Business Services Terms.

“CLA Personal Information” means personal information you provide to Snap via Customer List Audience of consumers in: (a) California; (b) Virginia; and (c) each of the following upon the effective date that their respective State Privacy Law comes into effect (before which they will not be deemed CLA Personal Information for the purposes of these U.S. Privacy Terms): (i) Colorado; (ii) Connecticut; and (iii) Utah.

“Customer Personal Information” means CLA Personal Information and Non-CLA California Personal Information.

“Non-CLA California Personal Information” means personal information you provide to Snap of California consumers via Business Services other than Customer List Audience.

“State Privacy Laws” means: (a) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”); (b) the Virginia Consumer Data Protection Act; and (c) each of the following once it has come into effect upon its respective effective date (before which it will not be deemed a State Privacy Law for the purposes of these U.S. Privacy Terms): (i) the Colorado Privacy Act; (ii) Connecticut Act Concerning Personal Data Privacy and Online Monitoring and (iii) Utah Consumer Privacy Act, in all cases as such laws may be amended from time to time.

“Subprocessors” means third parties authorized under these U.S. Privacy Terms to access and process Customer Personal Information in order to provide the Business Services.

As used in these U.S. Privacy Terms, the terms “consumers,” “deidentified data,” “personal information,” “processing,” ”processor,” “sell,” “service provider,” “share,” and “targeted advertising” have the meanings given in the State Privacy Laws, as applicable.

a.Each party agrees it will comply with its obligations under State Privacy Laws relating to any Customer Personal Information it processes or provides under or in relation to these U.S. Privacy Terms. Each party will notify the other party if it determines that it can no longer meet its obligations under these U.S. Privacy Terms or State Privacy Laws. You are solely liable for your compliance with each of the State Privacy Laws in your use of the Business Services.

b. If you have a reasonable belief that Snap is processing Customer Personal Information of California residents in an unauthorized manner, you have the right to notify Snap of such belief and Snap and you will work together in good faith to remediate the allegedly violative processing activities, if necessary.

c. During the term of these U.S. Privacy Terms, upon reasonable request and where required by the State Privacy Laws, Snap will make available to you all information reasonably necessary to demonstrate Snap’s compliance with these U.S. Privacy Terms with respect to Customer Personal Information.

d. You will remove from the Business Services the Customer Personal Information of any consumers who have: (i) withdrawn consent; (ii) opted out of targeted advertising; or (iii) opted out of the sale or sharing of personal information.

e. You will rectify or remove any Customer Personal Information from the Business Services that you learn is inaccurate or outdated.

f. Each party will comply with the requirements for processing deidentified data as required by the State Privacy Laws, with respect to any deidentified data it receives from the other party pursuant to the Business Services Terms.

g. Snap will process Non-CLA California Personal Information for the limited purposes described in the Business Services Terms and as otherwise permitted by CCPA/CPRA.

h. Snap will use reasonable security measures that are designed to secure Customer Personal Information from unauthorized disclosure or access, and, to the extent required by the State Privacy Laws, Snap will notify you without undue delay and, where feasible, no more than 72 hours after becoming aware of the unauthorized disclosure or access to, Customer Personal Information by a third party on systems managed or controlled by Snap.

a. Snap will act as your processor with respect to CLA Personal Information of Virginia consumers and, following the coming into force of each of the applicable State Privacy Laws, Colorado, Utah, or Connecticut consumers and agrees that it will not: (i) sell that CLA Personal Information; or (ii) retain, use, or disclose that CLA Personal Information for any purpose other than for processing on your behalf to provide the Customer List Audience program as further described in Schedule 1 and the Business Services as described in the Business Services Terms or as otherwise permitted under State Privacy Laws.

b. With respect to CLA Personal Information of California consumers, Snap agrees that, except as permitted by the CCPA/CPRA, it will not: (i) sell or share that CLA Personal Information; (ii) retain, use, or disclose that CLA Personal Information for any purpose other than for the business purposes described in the Business Services Terms; (iii) retain, use, or disclose that CLA Personal Information outside of the direct business relationship between you and Snap; or (iv) combine that CLA Personal Information with personal information Snap receives from or on behalf of another person or persons, or collects from its own interaction with the consumer.

c. Snap will ensure that personnel who have access to CLA Personal Information are bound by appropriate obligations or duties of confidentiality.

d. Upon completion of Snap’s obligations in relation to processing of CLA Personal Information under these U.S. Privacy Terms, Snap will either: (i) return all or subsets of the CLA Personal Information in Snap’s possession to you; (ii) render all or part of CLA Personal Information anonymous in such a manner that the data no longer constitutes personal information; or (iii) permanently delete or render all or parts of the CLA Personal Information unreadable.

e. Snap will provide reasonable cooperation and assistance to you to the extent required by State Privacy Laws to allow you to comply with your obligations under State Privacy Laws with respect to CLA Personal Information, including in relation to the fulfillment of consumer requests to exercise their data subject rights and your obligations in relation to data protection impact assessments

f. You authorize Snap and its affiliates to process CLA Personal Information and engage any third parties as Subprocessors to process CLA Personal Information. Snap will impose legally binding contract terms on each Subprocessor that are as restrictive as those contained in these U.S. Privacy Terms. In accordance with State Privacy Laws, here is an up-to-date list of: (i) all Subprocessors involved in processing CLA Personal Information; (ii) the purposes for which the Subprocessors process CLA Personal Information; and (iii) the location of each Subprocessor. Snap will notify you at least 30 days before adding a new Subprocessor. In the event you object to the processing of CLA Personal Information by any newly appointed Subprocessor, you will immediately inform Snap, after which Snap will either: (aa) instruct the Subprocessor to cease any further processing of CLA Personal Information, in which event these U.S. Privacy Terms shall continue unaffected; or (bb) allow you to terminate these U.S. Privacy Terms immediately.

g. During the term of these U.S. Privacy Terms, Snap will make available to you, or an internationally recognized auditing firm acting on your behalf, all information reasonably necessary to demonstrate Snap’s compliance with this Agreement, and Snap will allow for and cooperate with audits conducted by you or your designated assessor to the extent necessary to determine Snap’s compliance with these U.S. Privacy Terms with respect to CLA Personal Information if: (i) you provide no fewer than ten business days’ prior written notice to Snap; (ii) such audit is conducted during Snap’s normal business hours and in a manner that does not unreasonably interfere with Snap’s normal business operations; (iii) such audit lasts no longer than three total business days; (iv) in no event are you (or, for avoidance of doubt, any authorized third-party auditor) entitled to access or receive Snap’s proprietary or confidential information, except to the extent strictly necessary to demonstrate compliance with these U.S. Privacy Terms; and (v) you are obligated to reimburse Snap for Snap’s documented reasonable costs if that audit determines that Snap is in compliance with these U.S. Privacy Terms. In the event the audit determines Snap is out of compliance with these U.S. Privacy Terms, then Snap will be obligated for all reasonable costs of such audit.

If these U.S. Privacy Terms conflict with the Business Services Terms, any Supplemental Terms and Policies, or the Snap Terms of Service, then to the extent of the conflict the governing documents will be, in descending order: these U.S. Privacy Terms, the Supplemental Terms and Policies, the Business Services Terms, and the Snap Terms of Service.

The data processing activities carried out by Snap under these U.S. Privacy Terms are as follows:

Snap's provision of Customer List Audience to you.

For the term of these U.S. Privacy Terms plus the period from expiry of the term of these U.S. Privacy Terms until the anonymization, return, or deletion of data in accordance with these U.S. Privacy Terms.

Snap will process CLA Personal Information for the purposes of providing the Business Services to you in accordance with and as described in the Business Services Terms and these U.S. Privacy Terms.

CLA Personal Information relating to individuals provided to Snap via the Business Services, by (or at the direction of) you, which may include:

• email address

• telephone number

• mobile ad ID (IDFA/AAID)

• IP address

• cookie id

• browser user agent

• actions and events taken on websites and apps, including pages viewed, purchases, searches, check-out events, wish lists, installs, and user registration methods

Not applicable

Consumers residing in the states covered by State Privacy Laws about whom CLA Personal Information is provided to Snap via the Business Services by (or at the direction of) you.