Data Processing and Sharing Agreement

WurflRTD Real-Time Data Service · ScientiaMobile Inc. · 5/7/2026 – Updated: 10/6/2026

1. ACCEPTANCE AND PARTIES

1.1 This Data Processing and Sharing Agreement (“DPSA”) governs the processing of personal data by ScientiaMobile Inc. in connection with the WurflRTD service. It is available at https://www.scientiamobile.com/wurflrtd-dpsa/ and is incorporated by reference into the WurflRTD Publisher Terms of Service available at https://www.scientiamobile.com/wurflrtd-terms-of-service/.

1.2 By deploying WurflRTD on your website — including by including it in a Prebid.js configuration — you (“Publisher”) accept the terms of this DPSA. Acceptance occurs at the point of deployment and does not require execution of a separate signed agreement. This is the same mechanism by which Publishers accept the WurflRTD Terms of Service.

1.3 ScientiaMobile Inc. is a corporation incorporated in the State of Delaware, USA, with principal offices at 12110 Sunset Hills Road, Suite 600, Reston, VA 20190 (“ScientiaMobile”).

2. DEFINITIONS

“Applicable Data Protection Law” means GDPR (EU) 2016/679, the UK GDPR, the CCPA/CPRA, and any other applicable privacy legislation in the jurisdictions where the Services are delivered.

“Beacon Data” means aggregated, non-identifying auction performance data transmitted by the WurflRTD module to ScientiaMobile’s infrastructure after each page auction completes, including for the purpose of measuring and billing Enriched Opportunities.

“Controller” means a natural or legal person who determines the purposes and means of the processing of Personal Data, as defined under Applicable Data Protection Law.

“Enriched Opportunity” means a bid request sent to a bidder that has been enriched with device intelligence data by the WurflRTD module.

“Personal Data” means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Law.

“Processor” means a natural or legal person who processes Personal Data on behalf of a Controller, as defined under Applicable Data Protection Law.

“Processing” means any operation performed on Personal Data, including collection, recording, storage, use, or disclosure.

“Services” means the WurflRTD Real-Time Data module, WURFL.js device detection service, and associated beacon analytics infrastructure provided by ScientiaMobile.

“Sub-processor” means any third party engaged by ScientiaMobile to process Personal Data in connection with the Services in ScientiaMobile’s capacity as Data Processor.

“WURFL.js Data” means device capability data derived from HTTP request headers processed by ScientiaMobile’s WURFL.js infrastructure and returned to the Publisher’s browser environment for bid request enrichment.

The terms “data subject,” “supervisory authority,” and “lawful basis” shall have the meanings given to them under Applicable Data Protection Law.

3. PROCESSING ROLES

3.1 ScientiaMobile acts in two distinct capacities in connection with the Services, as described in this Section.

3.2 Data Processor — WURFL.js Device Detection

In processing HTTP request headers (User-Agent string and UA Client Hints) to perform device detection and return WURFL.js Data to the Publisher’s browser environment, ScientiaMobile acts as a Data Processor on behalf of the Publisher. In this capacity:

• The Publisher is the Data Controller and is responsible for establishing the lawful basis for this processing.
• ScientiaMobile processes HTTP headers for the purpose of identifying device characteristics and returning WURFL.js Data to the Publisher’s Prebid.js environment.
• The obligations in Sections 5 and 6 of this DPSA govern ScientiaMobile’s processing in this capacity.

3.3 Independent Data Controller — Beacon Data and Infrastructure Logs

In collecting and processing Beacon Data transmitted by the WurflRTD module, and in processing IP addresses and other data present in ScientiaMobile’s infrastructure logs, ScientiaMobile acts as an independent Data Controller for its own purposes. In this capacity:

• ScientiaMobile independently determines the purposes and means of processing.
• ScientiaMobile relies on legitimate interest (Article 6(1)(f) GDPR) as its lawful basis, as documented in its Legitimate Interest Assessment available at scientiamobile.com/wurflrtd-legitimate-interest-assessment-lia.
• ScientiaMobile’s independent Controller processing includes, without limitation: service performance monitoring; quota management; and fraud detection and invalid traffic prevention via internal IP-reputation and fraud-detection systems. Aggregated and anonymized data derived from this processing (see Section 4.3) may further be used to improve the Services and to develop new features and products..
• Publisher instructions do not govern ScientiaMobile’s processing in this capacity.

3.4 For the avoidance of doubt, this DPSA governs only ScientiaMobile’s processing of Personal Data of end users of the Publisher’s websites in connection with the Services. It does not govern ScientiaMobile’s processing of Personal Data of the Publisher’s employees, officers, or representatives in ScientiaMobile’s own business systems, which is subject to ScientiaMobile’s general privacy policy at scientiamobile.com/privacy-policy.

4. BEACON DATA

4.1 Beacon Data consists of aggregated, non-identifying auction performance data including domain-level identifiers, device type information, and auction outcome metrics. Beacon Data does not contain end-user names, email addresses, persistent user identifiers, or any other directly identifying personal data.

4.2 ScientiaMobile uses Beacon Data as an independent Data Controller for the following purposes: monitoring service performance and quota usage; measuring and billing Enriched Opportunities; and generating aggregated performance analytics. Aggregated and anonymized data derived from Beacon Data (Section 4.3) may further be used to improve the Services and to develop new features and products.

4.3 Raw Beacon Data may be retained for a maximum of 8 weeks. Aggregated and anonymized data derived from Beacon Data may be retained indefinitely for service analytics.

4.4 Publisher expressly authorizes ScientiaMobile to collect Beacon Data from Publisher’s Prebid.js implementation where the WurflRTD module has been deployed. Publisher shall inform its end users, in Publisher’s own privacy notice, of ScientiaMobile’s independent data processing in connection with the Services, referencing ScientiaMobile’s Privacy Notice at scientiamobile.com/wurflrtd-privacy-policy.

5. OBLIGATIONS OF SCIENTIAMOBILE AS DATA PROCESSOR

In its capacity as Data Processor for WURFL.js device detection, ScientiaMobile shall:

• Process HTTP request headers for the purpose of device detection and returning WURFL.js Data to the Publisher’s browser environment.
• Ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in Schedule B.
• Not engage any Sub-processor without prior authorization from the Publisher (general authorization is given for the Sub-processors listed in Schedule A). Notice of Sub-processor changes will be posted at the DPSA URL in Section 1.1 at least 30 days in advance.
• Assist the Publisher, to the extent reasonably possible and consistent with the limited nature of data held, in responding to data subject rights requests relating to WURFL.js processing. Because ScientiaMobile does not retain device detection data linked to individual user identities, its ability to fulfill individual-level access or deletion requests is inherently limited.
• In the event of a Personal Data breach affecting data processed in ScientiaMobile’s Processor capacity that is likely to result in a risk to the rights and freedoms of natural persons, notify affected parties as required by Applicable Data Protection Law. For Publishers with known contact details, ScientiaMobile will provide direct notification. For auto-onboarded Publishers, notification will be posted prominently at scientiamobile.com/wurflrtd-privacy-policy.
• Upon reasonable written request, provide the Publisher with a summary of ScientiaMobile’s then-current technical and organizational security measures, or direct the Publisher to relevant certifications or audit summaries, in lieu of an on-site audit.

6. OBLIGATIONS OF PUBLISHER AS DATA CONTROLLER

In its capacity as Data Controller, Publisher shall:

• Ensure it has a lawful basis for any Personal Data processing it causes ScientiaMobile to carry out via the Services.
• Maintain an accurate and up-to-date privacy notice that discloses to end users the use of device detection services and the identity of ScientiaMobile as a data processor and independent data controller, referencing ScientiaMobile’s Privacy Notice at scientiamobile.com/wurflrtd-privacy-policy.
• Ensure that its Consent Management Platform (CMP) is configured in a manner consistent with the data practices described in this DPSA and the WurflRTD Privacy Notice.
• Not instruct ScientiaMobile to process Personal Data in a manner that would violate Applicable Data Protection Law.

7. IP ADDRESS PROCESSING

7.1 IP addresses received by ScientiaMobile’s infrastructure in connection with the Services are processed by ScientiaMobile as an independent Data Controller for its own purposes, including GeoIP resolution, security, fraud detection, and invalid traffic prevention. ScientiaMobile determines the purposes and means of IP address processing independently and Publisher instructions do not govern this processing.

7.2 IP addresses are, where required by Applicable Data Protection Law to be treated as Personal Data, retained for up to 36 months from the date of collection, then permanently redacted. Access to IP address data is restricted to authorized security personnel. IP addresses are not associated with device detection results and are not used to identify individual end users.

8. DATA SUBJECT RIGHTS

8.1 Publisher, as Data Controller, is responsible for responding to data subject rights requests from end users of its websites relating to Personal Data processed in connection with the Services.

8.2 ScientiaMobile will assist Publisher with data subject rights requests relating to WURFL.js processing to the extent reasonably possible. Because ScientiaMobile does not store Personal Data linked to individual user identities, its ability to fulfill access or deletion requests at the individual level is inherently limited. ScientiaMobile will inform data subjects of this limitation in response to any such request.

8.3 For data subject rights requests relating to ScientiaMobile’s independent Controller processing, end users should contact ScientiaMobile directly at privacy@scientiamobile.com. ScientiaMobile is independently responsible for responding to such requests.

9. INTERNATIONAL DATA TRANSFERS

9.1 ScientiaMobile is incorporated in the United States. To the extent that processing under this DPSA constitutes a Restricted Transfer under Applicable Data Protection Law, the Standard Contractual Clauses set out in Schedule C are incorporated into this DPSA by reference.

9.2 ScientiaMobile will inform Publishers of any change in circumstances affecting the lawful basis for international data transfers by posting an update to this DPSA at the URL in Section 1.1.

10. SECURITY

ScientiaMobile maintains the technical and organizational security measures described in Schedule B. ScientiaMobile may update these measures over time provided that updates do not materially reduce the overall level of protection afforded to Personal Data. In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of natural persons, ScientiaMobile will notify affected parties as described in Section 5 and as required by Applicable Data Protection Law.

11. SUB-PROCESSORS

Publisher grants general authorization for ScientiaMobile to engage the Sub-processors listed in Schedule A in connection with ScientiaMobile’s processing as Data Processor. ScientiaMobile will post notice of any intended changes to Sub-processors at the DPSA URL in Section 1.1 at least 30 days in advance of the change taking effect.

12. DURATION AND TERMINATION

12.1 This DPSA is effective from the date of first deployment of WurflRTD and remains in force until Publisher ceases to deploy WurflRTD or ScientiaMobile terminates access in accordance with the WurflRTD Terms of Service.

12.2 Upon termination, ScientiaMobile will cease processing new data from Publisher’s domain in its Processor capacity. Existing data will be handled in accordance with ScientiaMobile’s standard retention schedules as described in this DPSA. Given the auto-onboarding model, ScientiaMobile has no obligation to identify and selectively delete aggregated or anonymized data associated with a former Publisher’s domain from its standard infrastructure logs.

12.3 Sections 3, 4, 7, 8, 9, and 13 survive termination.

13. GENERAL

13.1 This DPSA constitutes the entire agreement between the Parties with respect to data processing in connection with the Services. In the event of any conflict between this DPSA and the WurflRTD Terms of Service, this DPSA shall prevail with respect to data protection matters.

13.2 ScientiaMobile may update this DPSA from time to time to reflect changes to the Services, changes in Applicable Data Protection Law, or other operational reasons. Updated terms take effect 30 days after being posted at the URL in Section 1.1. Continued deployment of WurflRTD after that date constitutes acceptance of the updated terms.

13.3 If any provision of this DPSA is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

13.4 This DPSA is governed by the laws of the Commonwealth of Virginia, USA, without regard to its conflict of laws principles, except to the extent that Applicable Data Protection Law requires otherwise.

Publishers requiring a bilaterally executed data processing agreement should contact ScientiaMobile at privacy@scientiamobile.com to discuss commercial tier options.

SCHEDULE A — APPROVED SUB-PROCESSORS

The following Sub-processors are engaged by ScientiaMobile in connection with its processing as Data Processor. Notice of any intended additions or replacements will be posted at scientiamobile.com/wurflrtd-dpsa/ at least 30 days in advance.

SCHEDULE B — TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

ScientiaMobile maintains the following measures, at minimum:

• Encryption of data in transit using TLS 1.2 or higher.
• Access controls limiting Personal Data access to authorized personnel only, with role-based access policies enforced.
• IP addresses are retained for up to 36 months then permanently redacted. Access to IP-bearing log data is restricted to authorized security personnel.
• Raw Beacon Data is not retained beyond 8 weeks.
• Regular internal reviews of security practices and data handling procedures.
• Personal data breach detection, response, and notification procedures consistent with GDPR Article 33 requirements.

ScientiaMobile may update these measures over time provided that updates do not materially reduce the overall level of protection afforded to Personal Data.

SCHEDULE C — STANDARD CONTRACTUAL CLAUSES

To the extent that processing under this DPSA constitutes a Restricted Transfer under Applicable Data Protection Law, the following Standard Contractual Clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 are incorporated by reference:

Module 2 (Controller to Processor) — WURFL.js Device Detection

Applies to transfers in connection with WURFL.js device detection processing, with Publisher as data exporter (Controller) and ScientiaMobile as data importer (Processor), completed as follows:

• Clause 7: optional docking clause applies.
• Clause 11: optional language does not apply.
• Clause 17: Option 1 applies; governed by the laws of Ireland.
• Clause 18(b): disputes resolved before the courts of Ireland.
• Annexes I and II: completed as set out in the executed-form Standard Contractual Clauses document “Schedule C — Completed Standard Contractual Clauses (Modules One and Two)”, available from ScientiaMobile on request, which forms part of this Schedule C. Annex I.C: the Irish Data Protection Commission shall act as competent supervisory authority, without prejudice to Clause 13.

Module 1 (Controller to Controller) — Beacon Data and Infrastructure Processing

Applies to transfers in connection with Beacon Data and infrastructure log processing, with Publisher as data exporter (Controller) and ScientiaMobile as data importer (independent Controller), completed as follows:

• Clause 7: optional docking clause applies.
• Clause 11: optional language does not apply.
• Clause 17: Option 1 applies; governed by the laws of Ireland.
• Clause 18(b): disputes resolved before the courts of Ireland.
• Annexes I and II: completed as set out in the executed-form Standard Contractual Clauses document “Schedule C — Completed Standard Contractual Clauses (Modules One and Two)”, available from ScientiaMobile on request, which forms part of this Schedule C. Annex I.C: the Irish Data Protection Commission shall act as competent supervisory authority, without prejudice to Clause 13.

For transfers of Personal Data protected by UK Privacy Law, both sets of Standard Contractual Clauses apply as modified by the UK International Data Transfer Addendum (version B1.0) issued by the UK Information Commissioner’s Office under Section 119A of the UK Data Protection Act 2018.

To the extent of any conflict between this DPSA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.