Data Processing Agreement

Effective Date: August 7, 2025

Last Revised: July 7, 2025

This Reddit Advertising Data Processing Agreement (“DPA”) is between you and either: (i) Reddit Netherlands B.V., if you are located in the European Economic Area or Switzerland; or (ii) Reddit, Inc., if you are located in the USA, UK, or elsewhere (each referred to in this DPA as “Reddit”). This DPA is incorporated into the Reddit Advertising Services Agreement and is subject to all terms and conditions, policies, rules, and other provisions in the Ads Services Terms. Any terms that are capitalized but not defined in this DPA are defined in the Ads Services Terms. 

ARBITRATION NOTICE: YOU ARE BOUND BY THE ARBITRATION PROVISION SET FORTH IN THE REDDIT ADVERTISING SERVICES AGREEMENT. YOU ARE REQUIRED TO USE BINDING INDIVIDUAL ARBITRATION TO RESOLVE ANY DISPUTES RATHER THAN JURY TRIALS OR CLASS ACTION. UNLESS YOU OPT-OUT PURSUANT TO SECTION 18 OF THE REDDIT ADVERTISING SERVICES AGREEMENT, YOU AND REDDIT WAIVE ANY RIGHT TO RESOLVE DISPUTES IN A TRIAL, CLASS-ACTION LAWSUIT OR CLASS-WIDE ARBITRATION.

This DPA applies solely to the extent that Reddit Processes (defined below) Personal Data provided by you or on your behalf pursuant to the Ads Services Terms that is subject to Data Protection Laws (defined below). Reddit’s role with respect to such Personal Data may be as: (i) a Controller or Third Party; or (ii) Processor or Service Provider or Sub-processor of a Processor or Service Provider (each as defined below) depending on the types of Ads Services you use. Reddit may also offer and you may enable a Limited Data Use Flag.

1. Definitions

“Data Protection Laws” means all laws, rules, and regulations, as amended or superseded from time to time, applicable to the processing or protection of Personal Data, including: (i) the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”); (ii) the EU e-Privacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC); (iii) any national laws made under or pursuant to (i) or (ii); (iv) the new Federal Data Protection Act of 25 September 2020 (Switzerland); (v) the United Kingdom (“UK”) Data Protection Act 2018; (vi) the UK version of the GDPR which is part of UK law by virtue of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (vii) all United States federal and state privacy laws and their implementing regulations that apply generally to the processing of individuals’ Personal Data and that do not apply solely to specific industry sectors (e.g., financial institutions), specific demographics (e.g., children), or specific classes of information (e.g., health or biometric information) (collectively “State Privacy Laws”).

“European Data Protection Laws” means all Data Protection Laws applicable in the European Economic Area, Switzerland, or the UK.

“Personal Data” has the meaning ascribed to personal information or personal data (or other analogous variations of such terms) under Data Protection Laws.

“Restricted Transfer” means a transfer of Personal Data that is subject to European Data Protection Laws to a country outside Europe that does not provide an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws).

“Sub-processor” means any third party (including any Reddit affiliate) appointed by or on behalf of a Processor to Process Personal Data.

The terms, “Business”, “Controller”, “Consumer”, “Data Subject”, “Personal Data Breach”, “Processing”, “Processor”, “Supervisory Authority”, “Service Provider”, and “Third Party” will have the same meaning as in the Data Protection Laws, and their cognate terms will be construed accordingly. For the avoidance of doubt, the terms “Processor” and “Service Provider” shall be deemed to include any analogous role under applicable State Privacy Laws, and the terms “Controller” and “Business” shall be deemed to include any analogous role under such State Privacy Laws.

All capitalized terms not otherwise defined in this DPA will have the meaning given to them in the Ads Services Terms. In the event of a conflict in the meanings of defined terms in the Data Protection Laws, the meaning from the Data Protection Laws applicable to the relevant jurisdiction of the Data Subject or Consumer applies. If there is any inconsistency or conflict between this DPA and the Ads Services Terms as it relates to Reddit’s Processing of your Personal Data, this DPA will govern.

2. Relationship

The parties acknowledge and agree that the factual circumstances between them determine their respective roles and classifications under applicable Data Protection Laws. However, the parties anticipate that, with respect to Personal Data Processed under this DPA—and depending on the types of Ads Services you use, the location and applicable privacy rights of Data Subjects, and whether you enable the Limited Data Use Flag—the following arrangements may apply: (i) Reddit is a Processor or Service Provider and you are a Controller or Business; (ii) Reddit is a Controller or Third Party and you are a Controller or Business; or (iii) Reddit is a Sub-processor of Personal Data and you are a Processor of Personal Data on behalf of a Third Party Controller (e.g., an Advertiser on whose behalf you are using Reddit Custom Audiences). 

The parties further specify their respective roles for each processing activity under the Ads Services Terms as follows:

• For the Processing of Customer List Data in connection with Custom Audiences, you act as the Controller under GDPR, and Reddit acts as the Processor or Sub-processor. Under State Privacy Laws, you are a Business and Reddit is a Third Party with respect to such Processing.
• With respect to Event Data used for measurement, optimization, and service improvement purposes, each party acts as a Controller of the Personal Data it Processes and individually determines the purposes and means of such Processing. Under State Privacy Laws, you are a Business and Reddit acts as a Service Provider.
• In connection with the Processing of Event Data for audience creation and ad targeting, each party acts as a Controller of the Personal Data it Processes and individually determines the purposes and means of such Processing. Under State Privacy Laws, you are a Business and Reddit is a Third Party. When the Limited Data Use Flag is enabled, Reddit will not use Event Data for purposes of audience creation or ad targeting.

3. Your Responsibilities

You are solely liable for your compliance with Data Protection Laws in your collection of Personal Data and the provision of such data to Reddit. You will provide notice of your disclosure of Personal Data to Reddit consistent with the requirements of Data Protection Laws. You represent, warrant, and agree that: (i) you have secured and will maintain all necessary and legally compliant legal bases, rights, licenses, and consents from your end users necessary for Reddit to Process the Personal Data you provide; (ii) your provision of Personal Data to Reddit complies with Data Protection Laws; (iii) you have established a process for the exercise of rights of individuals under Data Protection Laws in relation to the Processing of Personal Data subject to this DPA, and have provided Data Subjects with information on such process as part of your notice; and (iv) where required under Data Protection Laws, your privacy policy includes a link to the Reddit Privacy Policy, as may be amended from time to time.

4. Reddit Responsibilities

1. Controller or Business Terms. When Reddit Processes Personal Data as a Controller or Business, Reddit agrees that it shall comply with its respective obligations under Data Protection Laws regarding any Personal Data that is provided or Processed pursuant to the Ads Services Terms.

2. Processor or Service Provider Terms. When Reddit Processes Personal Data as a Processor or Service Provider, the following terms shall apply:

   1. Instructions. Reddit will Process Personal Data on your behalf for the limited business purpose(s) set forth in your agreement with Reddit, including, where permitted by applicable law, for the purpose of providing, developing, and improving its services, and for any other purpose permitted by applicable Data Protection Laws. Reddit may aggregate and/or de-identify Personal Data for its own business purposes, provided that such data is no longer reasonably capable of being associated with or linked to an individual or household. You are instructing Reddit to Process such Personal Data for these purposes and other purposes permitted by Processors under Data Protection Laws.

   2. Confidentiality. Reddit will treat Personal Data as confidential, including ensuring each person that Processes the Personal Data is subject to an appropriate obligation of confidentiality. Reddit will also ensure that each of its Sub-processors is subject to confidentiality obligations no less protective than those imposed on Reddit under this DPA, including via written authorizations in accordance with Section 4(b)(v) (Sub-processors).

   3. Security. Reddit will implement and maintain appropriate technical and organizational measures appropriate to the nature of Personal Data, as further described in the https://business.reddithelp.com, designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, modification, or damage. Reddit may update its security measures from time to time, provided that such updates do not materially reduce the overall level of security. Reddit’s security obligations are limited to those required by applicable law and the Ads Services Terms. You acknowledge that the https://business.reddithelp.com are appropriate in relation to the risks associated with the intended Processing.

   4. Data Protection Impact Assessments and Prior Consultation. Reddit will provide reasonable assistance to allow you to undertake an assessment of the impact of Processing Personal Data, and with any consultations with a Supervisory Authority, if and to the extent such an assessment or consultation is required under Data Protection Laws, taking into account the nature of the Processing and the information available to Reddit.

   5. Sub-processors. You grant Reddit general written authorization to appoint Sub-processors in accordance with this section and Data Protection Laws. Reddit’s current list of Sub-processors is available https://business.reddithelp.com. Reddit will notify you of any additional or replacement Sub-processors by updating the list, which you should check periodically. If you object to such additional or replacement Sub-processors, you must stop using the applicable services and providing Personal Data to Reddit. With respect to each Sub-processor, Reddit will: (1) ensure that the Sub-processor executes a written contract including terms that offer at least the same level of protection for Personal Data as those set out in this DPA and meet the requirements of Data Protection Laws; and (2) where the Sub-processor fails to fulfill such obligations, subject to the terms of the Ads Services Terms, be liable for the acts and omissions of its Sub-processors to the same extent Reddit would be liable if performing the services of each Sub-processor directly under the terms of this DPA.

   6. Personal Data Breach. In the event of a Personal Data Breach impacting the Personal Data you provide to Reddit, Reddit will: (1) promptly take all necessary and appropriate corrective action to remedy the underlying causes of the Personal Data Breach and make reasonable commercial efforts to ensure that such Personal Data Breach will not recur; (2) notify you without undue delay, providing reasonable detail of the Personal Data Breach and likely impact on Data Subjects, to the extent such information is available; and (3) take any action required by Data Protection Laws.

   7. Retention. Upon completion of Reddit's obligations in relation to Processing of Personal Data under the Ads Services Terms or upon your request at any time during the term of the Ads Services Terms, Reddit will ensure that any Personal Data in Reddit’s possession is returned to you or destroyed, at your election, unless applicable law prevents Reddit from returning or destroying all or part of the Personal Data. In such case, Reddit agrees to preserve the confidentiality of the Personal Data retained by Reddit and that it will only Process Personal Data after such date in order to comply with the laws to which it is subject. Reddit may retain Personal Data in backup systems or as required for legal, regulatory, or compliance purposes, provided that such data remains subject to the confidentiality and data protection obligations of this DPA. Deletion may be accomplished by rendering Personal Data permanently de-identified in accordance with applicable law.

   8. Rights of Data Subjects and Consumers. Taking into account the nature of the Processing and the information available to Reddit, Reddit will provide reasonable assistance to enable you to comply with reasonable requests from Data Subjects and Consumers regarding their rights under Data Protection Laws, in relation to the Processing of Personal Data subject to this DPA. Such assistance will be provided regardless of which party to this DPA the request was directed to, to the extent technically feasible and provided that such assistance does not compromise Reddit’s legal obligations or business interests. Reddit reserves the right to charge reasonable fees for assistance with requests that are manifestly unfounded, excessive or repetitive.

   9. Audit. No more than once per year, upon your prior written request, to the extent required under the Data Protection Laws, Reddit will cooperate and within reasonable time provide you with: (1) a summary of any audit reports demonstrating Reddit’s compliance with Data Protection Law obligations under this DPA (without any confidential or commercially sensitive information); and (2) confirmation that such audit has not revealed any material vulnerability in Reddit’s systems, or to the extent that any such vulnerability was detected, that Reddit has fully remedied such vulnerability.

Alternatively, Reddit may, with your consent, at least annually and at Reddit’s expense, initiate a third-party audit to verify Reddit’s compliance with its obligations under the DPA. 

During such an audit and upon reasonable request, Reddit will make available to the controller all information necessary to demonstrate such compliance (subject to confidentiality and other legal protections reasonably determined by Reddit). 

5. Changes to the DPA

Reddit may change the provisions of the DPA if the change: (i) reflects a change in the name or form of a legal entity; (ii) is required to comply with applicable law, applicable regulation, or a court order or guidance issued by a governmental regulator or agency; (iii) does not: (1) result in a degradation of the overall security of the services; (2) expand the scope of, or remove any restrictions on Reddit’s Processing of Personal Data; or (3) otherwise have a material adverse impact on your rights under the DPA, as reasonably determined by Reddit.

6. Jurisdiction Specific Terms

1. Additional Terms for State Privacy Laws

   1. Each party agrees that it shall comply with its respective obligations under State Privacy Laws regarding any Personal Data that is provided or Processed pursuant to the applicable product terms.

   2. State Privacy Laws Processor or Service Provider Terms. With respect to Personal Data Processed with the https://business.reddithelp.com enabled or through services for which the applicable Reddit services otherwise state that Reddit acts as a Processor or Service Provider, and to the extent State Privacy Laws apply to Personal Data Processed pursuant to this Section 6(a)(ii), the following additional terms apply:

      1. Reddit will provide reasonable assistance to you in complying with verifiable requests from individuals, as required by State Privacy Laws and in accordance with Reddit’s standard policies and procedures, to enable you to respond to verifiable requests from individuals to exercise their rights under State Privacy Laws.
      2. Reddit will not “sell,” “share,” or use Personal Data for “targeted advertising” (as such terms are defined under State Privacy Laws).
      3. Reddit will only retain, use, or disclose such Personal Data for the limited business purpose(s) set forth in your agreement with Reddit, and will not retain, use, or disclose such Personal Data for any purpose other than the specified business purposes, including the servicing of a different business, unless expressly permitted by State Privacy Laws.
      4. Reddit will notify you if it determines it can no longer meet its obligations under State Privacy Laws with respect to Personal Data Processed under the Ads Services Terms.
      5. Reddit will not combine such Personal Data with Personal Data that it receives from, or on behalf of, other persons or with Personal Data that it collects from its own interactions with consumers, except to the extent permitted by State Privacy Laws.
      6. You may audit Reddit’s compliance with its obligations under this Section 6(a)(ii) by conducting audits as set forth in Section 4(b)(ix) of the DPA.
      7. If you reasonably believe that Reddit is Processing such Personal Data in an unauthorized manner, you have the right to notify Reddit of such belief, and the parties will work together in good faith to remediate the allegedly unauthorized use of Personal Data.

   3. State Privacy Laws Third Party Terms. This Section 6(a)(iii) applies to the extent your use of the applicable Reddit services involves you making Personal Data subject to State Privacy Laws available to Reddit as a Third Party:

      1. Reddit will use such Personal Data for the limited and specific purposes of performing the services set forth in your agreement with Reddit and as otherwise permitted by State Privacy Laws. The parties agree that you are making such Personal Data available to Reddit for such purposes.
      2. Upon your reasonable request, Reddit will take reasonable and appropriate steps to make available to you information to demonstrate, in relation to such Personal Data, Reddit’s compliance with State Privacy Laws in accordance with the applicable service terms or as otherwise determined by Reddit.
      3. If you reasonably believe that Reddit is Processing such Personal Data in an unauthorized manner, you may notify Reddit of such belief, and the parties will work together in good faith to remediate the allegedly unauthorized use of such Personal Data.
      4. Reddit will comply with applicable obligations under State Privacy Laws and will provide the same level of privacy protection as is required by State Privacy Laws.
      5. Reddit will notify you if it determines it can no longer meet its obligations under State Privacy Laws.

2. Additional Terms for European Personal Data. The following additional terms apply only to the extent Reddit Processes Personal Data originating from the UK, European Economic Area (“EEA”) or Switzerland.

   • 1. Where Reddit, as a Processor, Processes Personal Data provided by you or on your behalf, then you, as a Controller, represent, warrant, and agree that you determine the purposes for and means by which Personal Data is being or will be Processed, and the manner in which it is or will be Processed. Where Reddit acts as a Processor, it will act only on your written instructions in relation to the Processing of Personal Data under the Ads Services Terms and will inform you immediately if, in Reddit’s opinion, such an instruction infringes European Data Protection Laws. Where Reddit is required by law to Process Personal Data other than in accordance with your written instructions, Reddit will, to the extent permitted by law, inform you before commencing Processing.

   • 2. Annex 1 to these Jurisdiction Specific Terms sets out a description of the Personal Data as required by Article 28(3) of the GDPR and Article 28(3) of the UK GDPR. For the avoidance of doubt, Annex 1 does not create any obligation or rights for any party to the Ads Services Terms.

   • 3. Reddit complies with the EU-U.S. Data Privacy Framework (“DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as applicable, in relation to transfers of Personal Data from the EEA, UK, and Switzerland to the United States. The parties acknowledge and agree that Reddit shall use the Data Privacy Framework to lawfully receive such Personal Data in the United States and shall ensure that it provides at least the same level of protection to such data as is required by the DPF Principles. Reddit shall notify you if it determines that it can no longer comply with its obligations under the DPF. To the extent that a transfer of Personal Data from you to Reddit constitutes a Restricted Transfer and the DPF does not apply to such transfer (including if the DPF is invalidated or determined to be inadequate), the parties agree that the Standard Contractual Clauses (“SCCs”) (including the applicable UK International Data Transfer Addendum (“IDTA”) to the SCCs, as relevant) shall apply to such transfer and are hereby incorporated by reference, and shall take effect as set forth below:

     • 3-1. Controller to Processor relationship. If you are a Controller and Reddit is a Processor, the parties hereby agree to the SCCs for EEA/Switzerland Controller to Processor Data Transfers, together with the IDTA (each defined below, and collectively the “CP SCCs”) (which will be deemed executed by the parties as of the effective date of the Ads Services Terms and are hereby incorporated by reference). For the purpose of this Section 6(b)(3-1) the “Standard Contractual Clauses for EEA/Switzerland Controller to Processor Data Transfers” means Module Two (Transfer controller to processor) of the “Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council” as amended or replaced from time to time (the text of which is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en) and the IDTA means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses published by the UK Information Commissioner's Office under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022) (the text of which is available at: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf) (or any successor IDTA approved by the relevant UK authorities) in which you will be referred to as the "data exporter" and Reddit will be referred to as the "data importer", incorporating: (a) the relevant Options set out in Part 1 of Annex 2 to these Jurisdiction Specific Terms; (b) Annex I pre-populated with the details set out in Part 2 of Annex 2 to these Jurisdiction Specific Terms; and (c) Annex II pre-populated with the details set out in Part 3 of Annex 2 to these Jurisdiction Specific Terms. For the purposes of this Section 6(b)(3-1), the CP SCCs will come into effect upon commencement of a UK/EEA/Switzerland Data Transfer where Reddit is a Processor and you are a Controller.

     • 3-2. Processor to Sub-processor relationship. If you are a Processor on behalf of a third party Controller (for example, an advertiser on whose behalf you are using Reddit Custom Audience) and Reddit is a Sub-processor, the parties hereby agree to the SCCs for EEA/Switzerland Processor to Processor Data Transfers together with the IDTA (each defined below, and collectively the “PP SCCs”) (which will be deemed executed by the parties as of the effective date of the Ads Services Terms and are hereby incorporated by reference). For the purpose of this Section 6(b)(3-2) the “Standard Contractual Clauses for EEA/Switzerland Processor to Processor Data Transfers” means Module Three (Transfer processor to processor) of the “Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council” as amended or replaced from time to time (the text of which is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en) and the “IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses published by the UK Information Commissioner's Office under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022) (the text of which is available at: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf) (or any successor IDTA approved by the relevant UK authorities) in which you will be referred to as the "data exporter" and Reddit will be referred to as the "data importer", incorporating: (a) the relevant Options set out in Part 1 of Annex 2 to these Jurisdiction Specific Terms; (b) Annex I pre-populated with the details set out in Part 2 of Annex 2 to these Jurisdiction Specific Terms; and (c) Annex II pre-populated with the details set out in Part 3 of Annex 2 to these Jurisdiction Specific Terms. For the purposes of this Section 6(b)(3-2), the PP SCCs will come into effect upon commencement of a UK/EEA/Switzerland Data Transfer where Reddit is a Sub-processor and you are a Processor.

     • 3-3. Controller to Controller relationship. If you are a Controller and Reddit is a Controller, the parties hereby agree to the SCCs for EEA/Switzerland Controller to Controller Data Transfers together with the IDTA (each defined below and collectively, the “CC SCCs”) (which will be deemed executed by the parties as of the effective date of the Ads Services Terms and are hereby incorporated by reference). For the purpose of this Section 6(b)(3-3) the “Standard Contractual Clauses for EEA/Switzerland Controller to Controller Data Transfers” means Module One (Transfer controller to controller) of the “Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council” as amended or replaced from time to time (the text of which is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en) and the IDTA means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses published by the UK Information Commissioner's Office under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022) (the text of which is available at: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf) (or any successor IDTA approved by the relevant UK authorities) in which you will be referred to as the "data exporter" and Reddit will be referred to as the "data importer", incorporating: (a) the relevant Options set out in Part 1 of Annex 3 to these Jurisdiction Specific Terms; (b) Annex I pre-populated with the details set out in Part 2 of Annex 3 to these Jurisdiction Specific Terms; and (c) Annex II pre-populated with the details set out in Part 3 of Annex 3 to these Jurisdiction Specific Terms. For the purposes of this Section 6(b)(3-3), the CC SCCs will come into effect upon commencement of a UK/EEA/Switzerland Data Transfer where Reddit is a Controller and you are a Controller.

     • 3-4. If there is any conflict between the Sections of these Jurisdiction Specific Terms or the sections of the DPA and the CP SCCs, the PP SCCs or the CC SCCs (as applicable), in so far as the conflict relates to a UK/EEA/Switzerland Data Transfer, the CP SCCs, the PP SCCs or the CC SCCs (as applicable) will prevail. If Reddit’s compliance with Data Protection Laws applicable to UK/EEA/Switzerland Data Transfers is affected by circumstances outside of Reddit’s control, including if a legal instrument for UK/EEA/Switzerland Data Transfers is invalidated, amended, or replaced, then the parties will work together in good faith to reasonably resolve such non-compliance. In the event that additional, replacement or alternative EU SCCs or UK international data transfer mechanisms are approved by Supervisory Authorities, Reddit reserves the right to amend the Ads Services Terms and this DPA by adding to or replacing the EU SCCs or UK international data transfer mechanisms that form part of it at the date of signature in order to ensure continued compliance with Data Protection Laws.

Annex 1 – Details of Personal Data Processing

This Annex 1 includes certain details of the Processing of Personal Data as required by Article 28(3) of the GDPR and Article 28(3) of the UK GDPR.

Subject matter and duration of the Processing of the Personal Data

The subject matter and duration of the Processing of the Personal Data are as set out in the agreement for advertising services you have with Reddit.

The nature and purpose of the Processing of the Personal Data

The nature and purpose of the Processing of the Personal Data are as set out in the agreement for advertising services you have with Reddit.

The categories of Data Subjects to whom the Personal Data relates

Your customers/users or as otherwise set out in the existing agreement for advertising services you have with Reddit.

The types of Personal Data to be Processed

The types of Personal Data are as set out in the existing agreement for advertising services you have with Reddit.

Your obligations and rights

Your obligations and rights are as set out in the existing agreement for advertising services you have with Reddit.

Annex 2 – Selected Options and Annex Details for the CP SCCs and PP SCCs

Part 1 – Selected Options

For the purposes of Sections 6(b)(3-1) and 6(b)(3-2), the parties agree that the following Options for the CP SCCs or PP SCCs (as applicable) will be deemed to be incorporated:

Clause 7 (Docking clause)	Clause 7 will not be incorporated.
Clause 9 (Use of sub-processors)	Option 2 and the specific time period referred to will be two (2) days.
Clause 11 (Redress)	The Option in Clause 11(a) will not be incorporated.
Clause 13 (Supervision)	All paragraphs of Clause 13(a) will be incorporated as applicable.
Clause 17 (Governing law)	Option 1 and the governing law will be the laws of the Netherlands.
Clause 18 (Choice of forum and jurisdiction)	The courts inserted will be the courts of the Netherlands.
IDTA Options	In Table 1, the “Exporter” and the “Importer” are included in Part 2 as “Data exporter” and “Data importer” respectively; in Table 2, the first Option is selected and the “Approved EU SCCs” are the SCCs for EEA/Switzerland Controller to Processor Data Transfers and/or the SCCs for EEA/Switzerland Processor to Processor Data Transfers, as applicable; in Table 3, Annexes 1 (A and B) and II to the “Approved EU SCCs” are Part 2 and Part 3 respectively; and in Table 4, both the “Importer” and the “Exporter” can terminate the IDTA.
Switzerland Options	Data Subjects who have their habitual residence in Switzerland may bring claims under the EU SCCs before the courts of Switzerland.

Part 2 – Content of Annex I to the CP SCCs or PP SCCs

A. LIST OF PARTIES

Data exporter:

Name: as set out in the existing agreement for advertising services you have with Reddit

Address: as set out in the existing agreement for advertising services you have with Reddit

Contact person’s name, position and contact details: as set out in the existing agreement for advertising services you have with Reddit

Activities relevant to the data transferred under these Clauses: Reddit is an operator of consumer-facing web and mobile applications and you have engaged Reddit to provide Reddit services as specified in the Ads Services Terms. The processing activities are as set out in the Ads Services Terms.

Signature and date: as set out in the existing agreement for advertising services you have with Reddit

Role (controller/processor): controller or processor as applicable

Data importer:

Name: Reddit, Inc.

Address: as set out in the existing agreement for advertising services you have with Reddit

Contact person’s name, position and contact details: as set out in the existing agreement for advertising services you have with Reddit

Activities relevant to the data transferred under these Clauses: Reddit is an operator of consumer-facing web and mobile applications and you have engaged Reddit to provide Reddit services as specified in the Ads Services Terms. The processing activities are as set out in the Ads Services Terms.

Signature and date: as set out in the existing agreement for advertising services you have with Reddit

Role (controller/processor): processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred: as set out in Annex 1 to the Jurisdiction Specific Terms

Categories of personal data transferred: as set out in Annex 1 to the Jurisdiction Specific Terms

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): continuous

Nature of the processing: as set out in Annex 1 to the Jurisdiction Specific Terms

Purpose(s) of the data transfer and further processing: as set out in Annex 1 to the Jurisdiction Specific Terms

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: as per Section 4(b)(vii) of the DPA

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: as set out in Annex 1 to the Jurisdiction Specific Terms

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13: 

EEA: The competent Supervisory Authority in the EU Member State in which the data exporter is established and, in the event that the data exporter is not established in an EU Member State, the Supervisory Authority of the Netherlands (Autoriteit Persoonsgegevens). .

UK: The UK Information Commissioner

Switzerland: The Swiss Federal Data Protection and Information Commissioner 

Part 3 – Content of Annex II to the CP SCCs and PP SCCs

Reddit will implement and maintain the security measures described in the Reddit Ads Data Security Measures.

Annex 3 – Selected Options and Annex Details for the CC SCCs

Part 1 – Selected Options

For the purposes of Section 6(b)(4-3), the parties agree that the following Options for the CC SCCs will be deemed to be incorporated:

Clause 7 (Docking clause)	Clause 7 will not be incorporated.
Clause 11 (Redress)	The Option in Clause 11(a) will not be incorporated.
Clause 13 (Supervision)	All paragraphs of Clause 13(a) will be incorporated as applicable.
IDTA Options	In Table 1, the “Exporter” and the “Importer” are included in Part 2 as “Data exporter” and “Data importer” respectively; in Table 2, the first Option is selected and the “Approved EU SCCs” are the SCCs for EEA/Switzerland Controller to Controller Data Transfers; in Table 3, Annexes 1 (A and B) and II to the “Approved EU SCCs” are Part 2 and Part 3 respectively; and in Table 4, both the “Importer” and the “Exporter” can terminate the IDTA.
Switzerland Options	Data Subjects who have their habitual residence in Switzerland may bring claims under the EU SCCs before the courts of Switzerland.

Part 2 – Content of Annex I to the CC SCCs

A. LIST OF PARTIES

Data exporter:

Name: as set out in the existing agreement for advertising services you have with Reddit

Address: as set out in the existing agreement for advertising services you have with Reddit

Contact person’s name, position and contact details: as set out in the existing agreement for advertising services you have with Reddit

Activities relevant to the data transferred under these Clauses: Reddit is an operator of consumer-facing web and mobile applications and you have agreed to incorporate the Reddit Business Tools because of your use of the Reddit Business Tools. The processing activities are as set out in the Business Tool Terms.

Signature and date: as set out in the existing agreement for advertising services you have with Reddit

Role (controller/processor): controller

Data importer:

Name: Reddit, Inc.

Address: as set out in the existing agreement for advertising services you have with Reddit

Contact person’s name, position and contact details: as set out in the existing agreement for advertising services you have with Reddit

Activities relevant to the data transferred under these Clauses: Reddit is an operator of consumer-facing web and mobile applications and you have agreed to incorporate the Reddit Business Tools Terms because of your use of the Reddit Business Tools. The processing activities are as set out in the Business Tool Terms.

Signature and date: as set out in the existing agreement for advertising services you have with Reddit

Role (controller/processor): controller

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred: visitors to Your Properties and Reddit users

Categories of personal data transferred: Event Data which may include the following data:

• IP address for visitors to Your Properties
• User agent
• Advertiser Referrer URL
• Reddit advertising cookie
• Certain standard event data (like ‘add to cart’) as configured by you from visitors to the page on which you implement the Reddit Pixel
• Device/Browser Name
• OS Version
• Screen viewport width/height
• Hashed emails/MAIDS/external IDs

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): continuous

Nature of the processing: as set out in the Business Tool Terms

Purpose(s) of the data transfer and further processing: as set out in the Business Tool Terms

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The relevant time period for retention of such personal data is determined in accordance with relevant legal and regulatory requirements, the purpose for which the personal data was collected, limitation periods for any claims that might arise and industry practice guidelines.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: as set out above

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13: 

EEA: The competent Supervisory Authority in the EU Member State in which the data exporter is established and, in the event that the data exporter is not established in an EU Member State, the Supervisory Authority of the Netherlands (Autoriteit Persoonsgegevens). 

UK: The UK Information Commissioner

Switzerland: The Swiss Federal Data Protection and Information Commissioner. 

Part 3 – Content of Annex II to the CC SCCs

Reddit will implement and maintain the security measures described in the Reddit Ads Data Security Measures.