Sales House Agreement

Monetization Program

CONTRAT DE RÉGIE ET DE SERVICES

 2

PLEASE READ THIS SALES HOUSE AGREEMENT CAREFULLY (hereafter referred to as the
“Monetization Program”). You recognise that the terms and conditions of the Monetization
Program are binding. If You do not agree with the terms and conditions of the Monetization
Program, do not accept the Monetization Program.

The Monetization Program is concluded at the acceptance date of its terms and conditions
between « You », publisher of a digital radio station and having a member account on
Shoutcast service (hereafter referred to as “You” or the « Publisher ») and TargetSpot
(hereafter referred to as “TargetSpot”).

The Monetisation Program is provided by :

TargetSpot Belgium SPRL, company incorporated under Belgian laws, headquartered at

Boulevard International, 55K, B-1070 Brussels, Belgium, registered with the Crossroads bank
for enterprises under company number 0684.758.038 or by one of its affiliated company
depending on which territory the monetization is operated and in which territory the Publisher
is broadcasting its Streams.

Preamble

TargetSpot operates an internet advertising site located at the URL www.targetspot.com

(hereafter referred to as the “Website”) and provides advertising services in the audio digital
market, including the following ad units targeted by a TargetSpot advertiser : (i) “pre-roll” or
“in-stream” advertising, in the form of audio and/or video ad units that appear before or within
streaming audio and/or video content; (ii) mobile advertising, in the form of audio and display
ad units that appear within mobile applications ; (iii) banner, sponsored link, video or other ad
units within the Publisher media player ; and (iv) banner, sponsored link, video or other ad
units within the Publisher web site.

TargetSpot is the most advanced and largest platform in the world of audio digital advertising
market. TargetSpot offer can reach listeners wherever they are located and wherever they
listen the radio. TargetSpot offers indeed the Publisher one of the most advanced targeting
technologies in the field of digital audio advertising (geolocation, targeting tool, demo).
Listeners can hear different Ads depending on where they are listening the radio.

TargetSpot is a partner of Shoutcast (www.shoutcast.com). Via Shoutcast broadcasting tools

and hosting service, the Publisher can start its own radio station on line and participate to the
Monetisation Program that TargetSpot offers. The Publisher can then monetize its audience
with TargetSpot and generate advertising revenue. TargetSpot is offering to the Publisher an
international monetization solution, targeting notably the following countries : (i) in Europe :
France, Spain, Germany, Belgium, Italy, Great Britain, the Netherlands and Switzerland as well
as (ii) the United States of America, the Canada and a part of Latin America. The territories
where TargetSpot offers a monetization solution may evolve from time to time.

The Publisher operates a digital radio station and offers digital audio streams (hereafter
referred to as “Streams”) to the final listeners on the internet. The Publisher wishes to access
to the TargetSpot Monetization Program (under the technical prerequisites and access
conditions described in Appendix 1) and entrust TargetSpot with the non-exclusive sale
(programmatically and/or by direct sales), to any interested advertiser or agent acting on

Updated on June 19th 2018

 3

behalf of advertisers (hereinafter referred to as "Advertisers"), of its Streams dedicated to

advertising (hereafter “Ad Inventory”).

Article 1. – Purpose

The Publisher wants to participate to the Monetisation Program at the conditions detailed in
Appendix 1. For this purpose, the Publisher grants to TargetSpot, non-exclusively, the sale and
marketing of its Ad Inventory (programmatically and by direct sales). In connection with the
sale and marketing of the Ad Inventory of the Publisher by TargetSpot under the Monetization
Program and subject to the Publisher compliance with the technical prerequisites and more
generally, with the access conditions to the TargetSpot Monetization Program (Appendix 1),
TargetSpot will therefore make its best efforts to (i) prospect directly advertisers or media
agencies of the market; (Ii) to ensure the commercial and operational management of the
relations with advertisers and media agencies; (Iii) to perform technical services of Ad
insertions (Ad replacement or Ad injection method) in the Publisher's Ad Inventory. This is an
obligation of means for TargetSpot.

The purpose of the Monetization Program is not the establishment of a joint venture, nor the
establishment of any subordination link between the Parties.

Article 2. – Duration and early termination of the Monetization Program

The Monetization Program may only start as from the date of the acceptance of its terms and
conditions by the Publisher and at the condition that the Publisher fulfil the Technical
Prerequisites and access conditions to the Monetization Program (see Appendix 1).

The Monetization Program is concluded for an indefinite period of time.

TargetSpot and the Publisher shall have the possibility to terminate the Monetization Program
at any time with one (1) month notice given by e-mail to the other Party, at the e-mail address
of the Publisher (provided in its Shoutcast Member Account) when the termination is carried
out by TargetSpot and at the following e-mail address: support@shoutcast.com when the
termination is carried out by the Publisher.

TargetSpot may early terminate the Monetization Program, immediately, without prior notice
or compensation to the Publisher in any way, if the Publisher does not comply with its
obligations pursuant to the Monetization Program and, notably if TargetSpot is aware of a
breach of the warranties obligations by the Publisher provided for in article 3 below or as from
the date when TargetSpot has knowledge of a false audience generation on the Publisher’s
Streams or Ad Inventory provided for in article 5 below.

In case of termination of the Monetization Program for any reason, the respective rights of the
Parties shall be settled in accordance with the practice of the French advertising market ; the
Ad insertion orders in progress and the advertising orders in portfolio must be thus executed
in full and at the conditions defined here above.

TargetSpot will collect all its commissions on Ad insertion orders signed with the advertisers
until the termination date of the Monetization Program and still to be broadcast.

Updated on June 19th 2018

 4

It is expressly agreed between the Parties that neither the end of the Monetization Program
nor the early termination of the Monetization Program shall, for any reason whatsoever, result
in the payment of any compensation on either side.

Article 3. – Warranties

3.1. The Publisher warrants for the duration of the Monetization Program that it will use a
technology compatible with the technical prerequisites mentioned in Appendix 1 and that it
will provide to TargetSpot the access and the availability of its Ad Inventory under the
conditions specified in Appendix 1.

3.2. The Publisher warrants TargetSpot to comply with all applicable laws and regulations,
including, but not limited to, laws and regulations relating to intellectual property, advertising,
consumer protection, personal data protection and minors protection, etc.

3.3. The Publisher has sole editorial control over the content of its Streams (programming)
and as such, the Publisher warrants TargetSpot that it has all the necessary authorizations for
this purpose and, in particular, that it has acquired the authorizations of all the right holders
on the content of its Streams, notably the authorizations of the authors, composers, publishers,
phonogram producers and performers of the musical works and sound recordings which it
broadcasts, either directly or through the collective management organisations which
represent them, in all the territories where the content of its Streams is broadcast and warrants
TargetSpot against any claims in this respect and agrees to replace TargetSpot in the event of
any claim (by any natural or legal person) related to the content of Publisher’s Streams.

More generally, the Publisher warrants to TargetSpot, its affiliates, subsidiaries and associates,
its employees, directors and consultants against any loss, liability, damage, expense or claim,
including damages, penalties, interests, costs and lawyer expenses resulting from (I) the
creation, the broadcasting and the hosting of the Streams; (ii) any proven or alleged breach
of warranties given by the Publisher to TargetSpot; (Iii) any third party claim relating to the
necessary authorizations required copyrights and more usually for the distribution and
broadcasting of the Streams or relating to the names, logos and trademarks used by the
Publisher; (Iv) any claim related to the character of the content of the Publisher’s Streams
which shall be defamatory, libelous, slanderous, abusive or infringing public order or moral or
violating any law, regulation, order, judgment or decision.

In particular, TargetSpot cannot be held liable regarding the content of the Publisher’s Streams
whether online, sent, received, transmitted or broadcast.

The entire provisions of the Article 3 will survive to the termination of the Monetization
Program.

Article 4. – Revenue Share

TargetSpot will invoice the Advertisers and media agencies for the campaigns inserted in the
Ad Inventory of the Publisher and will receive the corresponding revenue. TargetSpot then
undertakes to share with the Publisher a percentage of this cashed revenue from these Ad
insertion orders in the Ad Inventory of the Publisher (if any), under the conditions described
in Appendix 2 of the Monetization Program.

Updated on June 19th 2018

 5

TargetSpot undertakes to share a part of the collected revenues in accordance with the
conditions described in Appendix 2, notably under condition of the effective payment of the
advertising campaign by the Advertiser or media agency to TargetSpot.

TargetSpot therefore does not bear any delcredere obligation and is in no case liable for the
default of payment of the Advertisers or media agencies. In case of non-payment or partial
payment by the Advertiser or its agent, TargetSpot will make reasonable debt recovery actions.
In case of partial payment, the cashed sums will be shared between the Publisher and
TargetSpot under the conditions stipulated in Appendix 2 of the Monetization Program.

Article 5 - False Audience generation

The Publisher shall refrain from using alternative audience generation methods of which
listeners are unaware (for example by using a Player in mute mode or preventing using the
Stop function) or technical means (such as Bots) generating listeners that are not real. All
other means shall also be punished immediately. TargetSpot disclaim any liability towards the
Publisher in case of false audience generation recorded and this, for any reason and from
whatever origin (cyber-attack or other reason). TargetSpot shall conduct periodic checks to
control and avoid such infringement. Should such an infringement be recorded, the Publisher
shall be notified by TargetSpot to cease and to make cease such infringement immediately.

In such cases, TargetSpot reserves the right to terminate immediately the Monetization
Program without any compensation for the Publisher and without prejudice of any judicial
proceedings to be introduced or any damages. TargetSpot reserves also the right to make, at
its sole discretion, the “Shoutcast Member Account” of the Publisher terminated by its partner
Shoutcast as well as the access to all the TargetSpot and its partner’s affiliated services and
to suspend definitively the payment of any revenue share pursuant to the Monetization
Program, without any compensation to the Publisher.

Article 6. – Confidentiality

6.1 – Principle

In general, the Parties consider themselves bound by the strictest professional secrecy. Each
Party undertakes to use appropriate means to keep confidential the information disclosed to
each other during the execution of the Monetization Program.

6.2 – Confidential Information

The Parties shall not communicate to any person, directly or indirectly, information of any kind,
including notably commercial, industrial, technical, financial, nominative information which will
be communicated by the other Party or of which they may have become aware during the
execution of the Monetization Program.

6.3 – Non-Confidential Information

Updated on June 19th 2018

 6

However, the Parties are not required to treat information as confidential information if such
information:

- was in the public domain at the time of its disclosure or is entered into public domain
without breach of the Monetization Program ;
- was known by one Party, without confidentiality obligation, at the effective date of the
Monetization Program;
- is disclosed by one Party with the prior and written consent of the other Party;

6.4 – Information deemed confidential

Databases, software and documentation are designated as confidential information. As well as

the Monetization Program, and its Appendix are confidential information. Except the case of a
legal, administrative or judicial obligation, these confidential information may not be published
nor communicated to third parties without the express prior and written consent of both
Parties.

The obligation of confidentiality shall survive the termination of the Monetization Program
during three (3) years.

Article 7 – Use of distinctive signs, logo, names or trademarks

TargetSpot is authorized, within the framework of and for the strict requirements of the
Monetization Program, in particular for marketing or promotional purposes, to reproduce, on
any medium whatsoever and worldwide, any distinctive signs, logo, names and trademarks
belonging to the Publisher.

The Monetization Program does not imply any assignment of the intellectual property rights
on TargetSpot's trademarks, distinctive signs, logos or names to the Publisher who is forbidden
to use them for any purpose without express prior and written authorization of TargetSpot.

Article 8 - Intuitu personae

The Parties agree that the Monetization Program is concluded "intuitu-personae".

Consequently, the Publisher is not authorized to assign to a third party all or part of the rights
and obligations arising therefrom for him, without the express prior and written consent of
TargetSpot.

Article 9. – Privacy and Personal Data Protection

9.1 – Personal data of the Publisher processed by TargetSpot

By entering into the Monetization Program, the Publisher acknowledges that TargetSpot may
process personal data relating to the Publisher including but not limited to personal data
originating from TargetSpot’s Partner Shoutcast. Information about how TargetSpot processes
the Publisher’s personal data can be found in Appendix 3.

9.2 – Processing of personal data by TargetSpot on behalf of the Publisher

In the performance of the Monetization Program, TargetSpot may process, on behalf of the
Publisher, personal data relating to the listeners of the Publisher’s Streams or end-users of its

Updated on June 19th 2018

 7

radio station-service. In that case, TargetSpot acts as a processor on behalf of the Publisher
(acting as a controller) and Appendix 4 (which includes the necessary provisions to comply
with Article 28 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation)) will apply.

The Publisher warrants that the Personal Data (as defined in Appendix 4) were collected in
compliance with the applicable Data Protection Law (as defined in Appendix 4) and that it is
entitled under the Data Protection Law to permit TargetSpot to process the Personal Data.
This includes, without limitation, Publisher’s compliance with its obligations to process Personal
Data on the basis of a valid legal ground and to provide the mandatory information under Data
Protection Law to the Data Subjects (as defined in Appendix 4). The Publisher further
guarantees TargetSpot against any claim or complaint made by a listener of its Streams or
end-users of its radio station service in relation with the Monetization Program and the
processing of the Personal Data.

Article 10. – Integral Nature of the Monetization Program

This Monetization Program, its Appendixes and Addenda thereto, represent the entire exclusive
agreement between the Publisher and TargetSpot and express the full rights and obligations
of the Parties.

If one or more articles of the Monetization Program shall be declared invalid under a law, a
regulation or as a result of a final judicial decision, this article shall have no effect or shall be
considered as modified to the smallest extent necessary to make it valid and effective while
respecting as far as possible the intention of the Parties; the rest of the Monetization Program
shall not be affected and shall remain in full force and executable in accordance with its terms.

The Parties shall replace, as far as possible, the invalid provision with a provision corresponding
to the intention of the Parties originally expressed in the provision to be replaced, with the
objectivity and loyalty which are the basis of existing relations between the Parties.

If one of the Party does not at any time exercise one or more of the rights recognized by the
Monetization Program, it shall not be deemed to have waived it for the future and shall retain
entire exercise of all rights without any exception.

Article 11. – Communication between the Parties

For the execution of the Monetization Program, any notice and other communication between
the Parties will be made via e-mail, at the following e-mail address for TargetSpot :
support@targetspot.com ; for the Publisher at the e-mail address provided by the Publisher in
its “Shoutcast Member Account”.

Article 12. – Modifications

The Publisher agrees that the Monetization Program may be subject to change. Therefore,
amendments to the Monetization Program may be made by TargetSpot at its sole discretion
and without prior written notice to the Publisher. The Amendments to the Monetization
Program shall be considered as tacitly accepted by the Publisher fifteen (15) days after the e-

Updated on June 19th 2018

 8

mail notification of such changes to the Publisher (notification to the e-mail address provided
by the Publisher in its “Shoutcast Member Account”) by TargetSpot.

Article 13. – Applicable law – Jurisdiction clause

This Monetization Program will be governed by and construed in accordance with the laws of
Belgium.

Any dispute arising out of the validity, interpretation and/or execution of the Monetization
Program and its consequences shall be subject to the exclusive jurisdiction of the Commercial
Court of Brussels, after an attempt has been made to reach a settlement agreement between
the Parties which has remained unsuccessful, notwithstanding the plurality of defendants and
warranty claims.

APPENDIX 1
Technical Prerequisites
Access conditions to the TargetSpot Monetization Program

Updated on June 19th 2018

 9

A. Audio Ad Inventory

1. Technical prerequisites :
To be able to participate to the Monetisation Program, the Publisher has to use a server
software provided by Shoutcast, a partner’s company of TargetSpot or be a user of “Shoutcast
for Business” on Shoutcast Service :
- user of Shoutcast Server Software or user of any version of Shoutcast DNAS server
2.5 or
- having purchased the hosting service called “Shoutcast For Business” provided by
Shoutcast on www.shoutcast.com.

To be able to participate to the Monetization Program, the Publisher has therefore prior to be
registered itself as a “Shoutcast member” on www.shoutcast.com and to create a “Shoutcast
Member Account”.

2. Triggering Ads conditions :

To be able to trigger Ads in its Streams, the Publisher has to choose an Ad-Stitching method
and a triggering method (metadata and silent tone detection). The Publisher is invited to set
up for these methods through Shoutcast Partner of TargetSpot, using its “Shoutcast Member
Account”, through the Shoutcast Radio Manager. The Ad-Stitching methods proposed are “Ad
replacement” or “Ad injection” methods.

The Publisher will also have to be compliant regarding the audio formats used for its Streams
(in MP3 audio format (bitrate between 64 kbps until 320 kbps) or in the AAC format (bitrate
between 32 kbps until 128 kbps).

If these technical prerequisites and triggering Ads conditions are met, TargetSpot will be able,
in its sole discretion, to decide to insert Ads in such Ad Inventory provided by the Publisher.
These effective Ad insertions will also depend on the existing partnerships of TargetSpot in
the territories where the Publisher is broadcasting its Streams and on the targeting desired by
TargetSpot’s customers (Advertisers/media agencies). TargetSpot does therefore not warrant
the Publisher the effective Ad insertions in the Publisher's Ad Inventory.

In case of Ad insertions in the Publisher’s Ad Inventory, the content of the Publisher audio file
will not be heard and will be replaced by an Ad. If the listeners of the Publisher’s Streams are
located in countries where TargetSpot does not have any advertising partner or in cases where
listeners of the Publisher’s Streams are not targeted by TargetSpot advertising campaigns, the
content of the Publisher's audio file will be heard.

B. Banner Ad Inventory

Updated on June 19th 2018

 10

To be eligible to participate to the Monetisation Program, an additional condition shall be

required by TargetSpot regarding the necessary compatible technology to allow the « synchro
banner » Ad.

APPENDIX 2
Revenue Share and Payment Methodology

Definition:

- Net Revenue: the revenue cashed by TargetSpot in case of Ad insertions in Your Ad

Inventory after deduction of any discounts, price reductions granted by TargetSpot to
Advertisers, media agencies and/or intermediaries commissions.

- Payment Activation Conditions: mean that You have to fill in (in your “Shoutcast
Member Account”) and give to TargetSpot all the necessary, true, accurate, up to date and in
accordance with the tax legislation of Your country of residence, information to allow payment
by TargetSpot of your revenue share through Paypal pursuant to the Monetization Program
(Your Paypal Account).

Either in case the Publisher is a user of the hosting service “Shoutcast for Business” or a user
of the Shoutcast Server Software, TargetSpot will pay to the Publisher a revenue share of 50%
of the Net Revenue actually cashed by TargetSpot, in the event of Ad insertions in the
Publisher's Ad Inventory (if any), subject (i) to the Publisher’s compliance with the technical
prerequisites and triggering Ads conditions to the Monetization Program (Appendix 1) and (ii)
according to the existing partnerships of TargetSpot in the territories where the Publisher is
broadcasting its Streams.

You will have access, for information purposes only, to a TargetSpot tool which is called
“Passport” which will summarize the Monetization Program and which will give You an
estimated revenue* generated on Your Streams via the Monetization Program, if any (see
passport.targetspot.com).

If You have generated revenue on Your Streams through the Monetization Program,
TargetSpot will make a balance sheet every month with estimated revenue* and, subject to
(i) the effective payment to TargetSpot by the Advertisers/media agencies, (ii) the fulfilment
by You of the Payment Activation Conditions and (ii) the credit balance threshold condition
described below, a payment will be made to the PayPal account of the relevant Publisher (60)
business days after the express or tacit acceptance by the Publisher of the “Repayment
Note”(see further below).

Any Paypal costs related to this transaction will be borne by the Publisher.

This payment will be made under the condition that the Publisher's Shoutcast Member Account
(visible in the Section “revenue” of Your “Shoutcast Member Account”) reaches a credit balance

Updated on June 19th 2018

 11

threshold of at least 25EUR/$25 during that month. If not, the amounts existing on the
Publisher's Shoutcast Member Account (visible in the Section “revenue”) will be cumulated
during the calendar year. In the event that the Publisher does never reach the credit balance
threshold of 25EUR/$25 during the calendar year, the amounts existing on its Shoutcast
Member Account will be lost.

In case You do not meet the Payment Activation Conditions pursuant to the Monetization
Program during more than 180 days as from the registration date of You as a Shoutcast
Member or as from the date of the last payment made by TargetSpot to You or any of
TargetSpot affiliates companies, the amounts existing on Your “Shoutcast Member Account”
pursuant to this Monetization Program will be definitively lost.

“Repayment Note” :
Power of Attorney granted by the Publisher to TargetSpot for Self-Billing
With respect to the sums to be paid by TargetSpot or any affiliates companies to the Publisher,
with acceptance of the Monetization Program, the Publisher authorizes TargetSpot to issue,
on its behalf, an invoice mentioning the repayment which will be executed by TargetSpot in
virtue of the Monetization Program. This invoice, hereinafter referred to as the "Repayment
Note", shall be issued each month (if applicable) after effective payment by the
Advertisers/media agencies to TargetSpot (between an average of 90 and 120 business days
after Ad insertion if any). The Repayment Note shall be issued in two (2) originals by
TargetSpot and communicated by e-mail to the Publisher (to the e-mail address provided in
its “Shoutcast Member Account”). The Publisher retains full liability regarding its obligations in
terms of invoicing and with respect to its national VAT tax administration. The Publisher will
not be able to rely on TargetSpot's default in the issuance of the Repayment Note in order to
avoid its obligations to declare VAT and/or of the due collected tax. The Publisher remains
liable for the payment of the VAT due, if applicable, pursuant the Belgian General Tax Code
(notably article 56bis of the Belgian Tax Code), when VAT has been wrongly billed.

The Publisher, if applicable, agrees and warrants TargetSpot to:

- inform TargetSpot if it is subject to VAT;

- inform TargetSpot of any option or waiver of the option to pay VAT;
- if applicable, inform TargetSpot that it benefits from a special scheme (in particular the
basic franchise scheme provided for in article 56 bis of the General Tax Code);
- inform TargetSpot of any change in the identification of its company and must modify
these mentions if necessary in the parameters of its “Shoutcast Member Account” on
www.shoutcast.com (Shoutcast Radio Manager);
- retain the copy of the Repayment Note addressed to it in its own accounting;
- declare and pay the tax authorities of VAT relating to the said Repayment Note and to
handle any dispute which may arise with the tax authorities of VAT, without TargetSpot
being concerned;
- in the event that the Publisher does not have an establishment in Belgium, it undertakes
to mention on the Repayment Note any tax or deduction due in accordance with its
national tax legislation. More generally, the Publisher undertakes to inform TargetSpot of
any information relating to any national tax legislation applicable and which may have an
impact for TargetSpot in the execution of the Monetization Program.

The Publisher, if applicable, shall have a period of thirty (30) days as from the issuing date of
the Repayment Note to notify to TargetSpot its reservations duly motivated, if necessary. After

Updated on June 19th 2018

 12

this thirty (30) days period, the Publisher will no longer be able to contest the Repayment Note
issued by TargetSpot which will be considered as definitively and tacitly accepted.
In these circumstances, in the event of express or tacit acceptance of the Repayment Note by
the Publisher, the payment by TargetSpot of the Repayment Note shall be made within sixty
(60) days as from this acceptance. Otherwise, the payment will be made within sixty (60) days
as from the reception date by TargetSpot of an amended invoice issued by the Publisher, in
accordance with the provisions of the Directive 2010/45/UE and its transposition in Belgian
law.

APPENDIX 3
Information notice on processing of Publisher’s personal data

By entering into the Monetization Program, the Publisher acknowledges that TargetSpot may
process personal data relating to the Publisher, including personal data originating from
TargetSpot’s Partner Shoutcast.

1. Identification of the data controller

TargetSpot (as defined above) will act as the data controller.

2. Categories of personal data processed

The personal data processed by TargestSpot are collected through the creation of the
“Shoutcast Member Account” on Shoutcast website www.shoutcast.com, which is a
prerequisite to the conclusion of the Monetization Program. The following personal data will
thus be processed by TargetSpot: image (optional), username, first and last names, email
address, password, birthdate, phone number, address, country and language, credit card
information, VAT number, tax ID.

3. Use of the personal data

The personal data may be processed for the purposes of creating, identifying, verifying and
managing the Publisher’s subscriptions, setting the preferred language, controlling the
Publisher’s access rights, contacting and answering the Publisher’s queries, correcting
assignments of access and functions, identifying use/misuse of the services and, more
generally, for the purpose of providing the services and executing the Monetization Program.

TargetSpot may process the personal data for direct marketing purposes, including by email
(subject to the Publisher’s prior consent, unless TargetSpot has a legal right to do so).

4. Legal basis for the processing

TargetSpot relies on the necessity to execute the Monetization Program in order to process
the Publisher’s personal data.

TargetSpot relies on the Publisher’s consent to send direct marketing communications unless

Updated on June 19th 2018

 13

TargetSpot has a legal right to do so.

5. Security measures
TargetSpot implements policy, rules and security measures for the protection of personal data.

TargetSpot diligently updates, corrects and eliminate personal data that are inaccurate,
incomplete or irrelevant.

TargetSpot warrants that, for persons acting under its authority, access to personal data and
the possibilities for processing these personal data are limited to what is needed by these
persons for the exercise of their duties.

TargetSpot informs persons acting under its authority of the provisions of European and
Belgian data protection and privacy laws, as well as any relevant requirements concerning
protection of privacy in the processing of personal data.

TargetSpot ascertains compliance of programmes used for automatic processing of personal

data and monitors the regularity of their application.

TargetSpot ascertains that any person who has access to personal data can only process such
personal data on instructions of TargetSpot, except in the case of an obligation imposed by or
in virtue of the law, a decree or a court order.

TargetSpot takes the necessary technical and organizational measures to safeguard against
accidental or unauthorized destruction, accidental loss and modification, access or any other
unauthorized processing of personal data.

6. Transfer or personal data

The Publisher acknowledges that TargetSpot may disclose personal data to its subcontractors
for the above-mentioned purposes, both inside and outside the European Economic Area,
namely its affiliates companies: TargetSpot Inc. ; TargetSpot France EURL ; TargetSpot Espana
SL; TargetSpot GmbH. The Publisher acknowledges that this may involve transfers of personal
data to countries that do not provide an adequate level of protection. Appropriate contractual
measures will be taken to ensure the security of the Publisher’s personal data in compliance
with the applicable privacy and personal data protection legislation. A copy of those
appropriate contractual measures can be provided upon request. TargetSpot will always
choose a subcontractor that provides sufficient guarantees with regard to technical and
organizational security measures concerning data processing.

7. Retention of personal data

The personal data collected will be erased six (6) months after the end of the Monetization
Program, unless TargetSpot has a legal obligation to retain personal data for a longer period
of time.

Some anonymised data may be kept thereafter exclusively for statistical purposes.

Updated on June 19th 2018

 14

8. Rights of the Publisher

The Publishers are entitled to access the personal data relating to them, as collected and
processed by TargetSpot as data controller, and request the modification or suppression of
the Publisher’s personal data if it is incorrect or unnecessary. The Publisher also has the right
to ask for the restriction of the processing or to object to the processing as well as the right
to data portability (as the case may be). When applicable, the Publisher has the right to
withdraw consent at any time, without affecting the lawfulness of processing based on consent
made prior to such withdrawal.

The Publisher may exercise these rights by sending an email to TargetSpot at

privacy@targetspot.com, together with a copy of her/his identity card or other
identification document. In addition, the Individuals may object to the processing of such
Publisher’s personal data for direct marketing purposes at any time, free of charge and without
having to provide a justification by following the abovementioned procedure.

The Publisher also has a right to lodge a complaint with a supervisory authority (in particular
in the Member State of the European Union of its usual place of residence, place of work or
the place where the violation occurred) if the Publisher considers that the processing of its
own Publisher’s personal data infringes the data protection legislation.

APPENDIX 4
Data Processing Addendum

1. Definitions

For the purposes of this Appendix 4, the following capitalized terms shall have the meaning

Updated on June 19th 2018

 15

specified below and other capitalized terms used but not defined in this Appendix have the
same meanings as set forth in the Monetization Program:

(a) "Data Subject" shall mean the identified or identifiable individual whose Personal
Data is processed;

(b) "Data Protection Law" shall mean (i) any and all applicable laws implementing
the Directive 95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of personal data
and on the free movement of such data (as may be modified or replaced), including
but not limited to the Belgian law of 8 December 1992 on the protection of
individuals regarding the processing of personal data as amended, any directly
applicable EU regulations (including but not limited to Regulation (EU) 2016/679
of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation – “GDPR”) which is applicable as
from 25 May 2018) as well as any delegated act in relation to the GDPR, Belgian
laws and decrees executing the GDPR and (ii) any similar applicable legislations
from countries outside of the European Union;

(c) "Personal Data" shall mean “personal data” as defined in the Data Protection Law
which is subject of the Processing, relating to the listener of the Publisher’s Streams
or an end-user of its radio station-service and including any other information
directly related to and necessary for the carrying out of the Purposes;

(d) "Processing" shall mean the “processing” as defined in the Data Protection Law
of the Personal Data of each Data Subject by TargetSpot on behalf of the Publisher,
which includes the processing of the Personal Data by TargetSpot and the transfer
of the Personal Data to the Publisher;

(e) "Purposes" shall mean the limited, specific and legitimate purposes of the
Processing, namely the performance of the services;

(f) “Subprocessor” shall mean any person (excluding an employee of TargetSpot)

appointed by or on behalf of TargetSpot to process Personal Data on behalf of the
Publisher.

2. Qualification

For the avoidance of doubt, the Parties acknowledge that where Data Protection Law applies,
the Publisher acts as the controller and TargetSpot as the processor of Personal Data to be
processed. Accordingly, the Publisher remains solely responsible for determining the means
and the purposes of TargetSpot's Processing of Personal Data under the Monetization Program.

3. Processing of Personal Data

TargetSpot agrees that any Processing of Personal Data by TargetSpot in respect of which
TargetSpot acts as processor on behalf of the Publisher shall be carried out in accordance with
the Data Protection Law and the provisions of this Appendix.
Without prejudice to the independence of the Parties, the Personal Data shall only be

Updated on June 19th 2018

 16

processed in accordance with the instructions of the Publisher and solely for the Purposes, to
the exclusion of any other purposes. The Publisher hereby generally instructs TargetSpot to
process Personal Data for the Purposes and to the extent necessary to provide the Services in
compliance with TargetSpot's obligations under the Monetization Program.
Without prejudice to the independence of the Parties, TargetSpot represents and warrants
that TargetSpot and any person acting under the authority of or on behalf of TargetSpot and
having access to the Personal Data shall only process the Personal Data in accordance with
the instructions of the Publisher, except in case of a legal obligation, and in accordance with
the Data Protection Law. To this end, TargetSpot shall inform and train all persons acting
under its authority and having access to the Personal Data about the provisions of Data
Protection Law.

4. Subprocessing – Onward transfer of Personal Data

TargetSpot shall not engage any Subprocessor without prior general or specific written
authorisation of the Publisher. Where TargetSpot engages a Subprocessor for carrying out
specific processing activities on behalf of the Publisher, the same data protection obligations
as set out in this Appendix 3 shall be imposed on that Subprocessor by way of a written
agreement, in particular providing sufficient guarantees to implement appropriate technical
and organisational measures. Where such Subprocessor fails to fulfil its obligations under Data
Protection Law, TargetSpot shall remain fully liable to the Publisher for the performance of
such Subprocessor's obligations.
The Publisher hereby specifically authorizes TargetSpot to engage the following Subprocessors
and disclose Personal Data to its sub-contractors for the above-mentioned purposes, both
inside and outside the European Economic Area, namely :

- Supply Side Platforms

Appnexus
SpotX
Adswizz
Rubicon
Triton

- Demand Side Platforms

The Trade Desk

- Data Management Platforms

Google
Krux
Claritas
Bisnode
Quantcast

- Other Sub-Processors
Dax (UK)
RMS (DE)
Mediamond (IT)
TMX (NL)

Updated on June 19th 2018

 17

An updated list of Subprocessors is available on the Website.

The Publisher hereby further generally authorizes TargetSpot to engage any other
Subprocessor provided that TargetSpot informs the Publisher of any intended changes
concerning the addition or replacement of Subprocessors. The Publisher will have the
possibility to object to such addition or replacement on the basis of objective grounds.
With respect to each Subprocessor, TargetSpot shall:
(i) carry out adequate due diligence to ensure that the Subprocessor is capable of
providing the level of protection for Personal Data required by this Appendix;
(ii) ensure that the EU Standard Contractual Clauses regarding the transfer of personal
data to processors established in third countries which do not ensure an adequate
level of data protection (hereinafter the “EU Standard Contractual Clauses”)
are at all relevant times signed between the Publisher and the Subprocessor if the
engagement of such Subprocessor involves a transfer to a country located outside
of the European Economic Area which does not ensure an adequate level of data
protection and where no appropriate safeguard exists (hereinafter the “Restricted
Transfer”). For the purposes of this obligation, the Publisher hereby grants to
TargetSpot a mandate (proxy) to enter into EU Standard Contractual Clauses in the
name and on behalf of the Publisher with the Subprocessors; and
(iii) provide to the Publisher for review such copies of the agreements with
Subprocessors (which may be redacted to remove confidential commercial
information not relevant to the requirements of the Monetization Program) as the
Publisher may request from time to time.
TargetSpot shall not communicate, disclose or transfer, either free of charge or in return for
payment, the Personal Data to any other legal person or individual, except pursuant to the
prior written instructions of the Publisher and except where such communication, disclosure
or transfer: (i) is necessary to perform the Services or for the Purposes; or (ii) is required by
any applicable law, regulation, or governmental authority in which case TargetSpot will,
wherever possible, notify the Publisher promptly in writing prior to complying with any such
request for communication, disclosure or transfer and shall comply with all reasonable
directions of the Publisher with respect to such communication, disclosure or transfer.

5. Security

TargetSpot shall ensure – having regard to the state of technological development and the
cost of implementing any such measures as well as the sensitive nature of the Personal Data
to be processed – that appropriate technical and organizational measures are taken against
accidental or unauthorized destruction, accidental loss, as well as against alteration of, access
to and any other unauthorized processing of the Personal Data. Without limitation to the
foregoing, TargetSpot shall, in particular, take adequate technical and organizational measures
to:
i. ensure that access to the Personal Data is only granted to persons acting under its
authority and strictly on a need-to-know basis;
ii. deny unauthorized persons access to data processing systems within which the
Personal Data is processed (access control);
iii. prevent the use of data processing systems by unauthorized persons (access control);
iv. ensure that persons authorized to use a data processing system are only able to access
the Personal Data to which their access privileges apply (access control);

Updated on June 19th 2018

 18

v. ensure that the Personal Data cannot be read, copied, modified or removed without
the authorization of TargetSpot during electronic transfer or during transport or storage
on data media and that it is possible to check and determine to whom communication
of the Personal Data is made through data transfer facilities (checking the identity of
any person who forwards the Personal Data and any person to whom the Personal
Data is forwarded);
vi. ensure that the Personal Data is only processed in accordance with the Publisher’s
instructions (instruction checking);
vii. ensure the reliability of any employee, agent or contractor of the Publisher or any
Subprocessor and that they are subject to confidentiality obligations (reliability and
confidentiality);
viii. ensure that the Personal Data is protected against accidental destruction or loss
(availability checking);
ix. ensure that pseudonymisation and encryption of Personal Data are used where
possible; and
x. ensure that Personal Data processed for other purposes can be processed separately
(separation checking).
Without prejudice to Clause 7, TargetSpot agrees to inform the Publisher in writing without
delay and, in any case, within three (3) business days of any accidental or unlawful destruction
or accidental loss or damage, alteration, unauthorized disclosure or access to the Personal
Data.

6. Cooperation

TargetSpot shall provide in a prompt manner such co-operation as is reasonably necessary to

enable the Publisher to ensure compliance with the Data Protection Law, including but not
limited to providing co-operation where the Publisher must respond to requests for exercising
the Data Subject's rights granted by Data Protection Law. In particular, TargetSpot shall:
(i) promptly notify the Publisher if TargetSpot or any Subprocessor receives a request from
a Data Subject under any Data Protection Law in respect of Personal Data; and
(ii) ensure that TargetSpot and/or any Subprocessor only responds to such request upon
express written instructions of the Publisher or as required by applicable laws to which
TargetSpot and/or the Subprocessor is subject, in which case TargetSpot shall to the extent
permitted by applicable laws inform the Publisher of that legal requirement before TargetSpot
and/or the Subprocessor responds to the Data Subject’s request.
TargetSpot shall as soon as reasonably practicable and in any event in a manner that conforms
to any time-scales set out in the Data Protection Law, provide the Publisher with a copy of the
Personal Data that it processes, and/or correct or delete any inaccuracies in such Personal
Data, as directed by the Publisher

7. Personal Data breach

In case of any Personal Data breach (defined by the GDPR as “a breach of security leading to
the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access
to, personal data transmitted, stored or otherwise processed”), TargetSpot shall, without
delay, notify the Publisher of such breach. The notification must, at least, describe the nature
of the Personal Data breach including where possible, the categories and approximate number
of Data Subjects concerned and the categories and approximate number of Personal Data
records concerned, describe the likely consequences of the Personal Data breach, describe the

Updated on June 19th 2018

 19

measures taken or proposed to be taken to address the Personal Data breach, including, where
appropriate, measures to mitigate its possible adverse effects.

8. Audit and inspection

TargetSpot shall, at the request of the Publisher, submit its equipment used for the Processing
of Personal Data (if any) for audit of the Processing performed by TargetSpot. Such audit shall
be performed by the Publisher or a third party (selected by the Publisher and reasonably
acceptable to TargetSpot) to act on its behalf, at the Publisher’s expense, at TargetSpot’s
offices or at another mutually agreed location during normal business hours upon fifteen (15)
days prior written notice and shall make reasonable endeavors to avoid causing any damage,
injury, or disruption in TargetSpot premises, equipment, personnel and business while its
personal are on those premises in the course of such an audit or inspection. Audit reports shall
only include detail sufficient to verify TargetSpot’s compliance with its obligations under this
Appendix.

For the performance of the audit or inspection, the Publisher will give a list of authorized
person(s) (“Authorized Person”). TargetSpot undertakes to give access to its premises to
the Authorized Person provided that such Authorized Person:
(i) produces reasonable evidence of identity;
(ii) works during normal business hours of TargetSpot unless the audit needs to be
conducted on an emergency basis.

9. Data Protection Impact Assessment

TargetSpot shall assist the Publisher with any relevant data protection impact assessment and
prior consultations with supervisory authorities or other competent data privacy authorities
that would be required under Articles 35 or 36 of the GDPR, subject to terms and conditions
and fees to be agreed upon on a case-by-case basis.

10. Deletion or return of Personal Data

TargetSpot shall ensure that any copies of Personal Data in the possession of TargetSpot are
promptly, and in any event within one month of the date of cessation of any services, returned
to the Publisher or destroyed (at the Publisher’s option) upon the Publisher’s notice and/or
when they are no longer required for the performance of TargetSpot’s obligations under the
Monetization Program, whichever occurs first, and TargetSpot shall delete existing copies
unless Data Protection Law requires storage of the Personal Data.

11. Liability

Without prejudice to Clause 12, TargetSpot shall be liable for the Processing of the Personal
Data which is consigned to it by the Publisher. TargetSpot undertakes to indemnify and hold
harmless the Publisher, its directors and employees against any and all costs, charges,
damages, expenses and losses (including costs incurred in recovering same), that are incurred
by the Publisher as a result of any breach by TargetSpot of any representation or warranty in
this Appendix or the failure to comply with any of its obligations under this Appendix. Where

Updated on June 19th 2018

 20

a Subprocessor fails to fulfil its obligations under Data Protection Law, TargetSpot shall remain
fully liable to the Publisher for the performance of such Subprocessor's obligations. This Clause
11 sets out the entire financial liability of TargetSpot (including any liability for the acts or
omissions of its employees, agents and sub-contractors) to the Publisher in respect of any
breach of the obligations contained in this Appendix.

12. Limitation of liability

Notwithstanding anything to the contrary in this Appendix and/or the Monetization Program,
TargetSpot’s total, aggregate maximum liability to the Publisher arising out of or in connection
with this Appendix 4 and/or the Monetization Program, whether in tort (including negligence)
or for breach of contract, or otherwise howsoever arising, shall not exceed , for all claims, the
revenue share payments paid to this Publisher by TargetSpot under the Monetization Program
in the one (1) month period immediately preceding the day on which the cause of action has
accrued. This Clause 12 sets out the entire financial liability of TargetSpot (including any
liability for the acts or omissions of its employees, agents and sub-contractors) to the Publisher
in respect of any breach of the obligations contained in this Appendix. The existence of more
than one claim will not enlarge or extend these limits. The Parties acknowledge and agree that
the foregoing liability limitations are essential elements of this Appendix 4 and that in the
absence of such limitations, the material and economic terms of this Appendix 4 and the
Monetization Program would be substantially different.

13. Modifications of the applicable Data Protection Law

TargetSpot may, by providing at least thirty (30) calendar days' written notice to the Publisher,
make variations to or replace the template EU Standard Contractual Clauses and enter into
amended or new EU Standard Contractual Clauses as per Clause 4, subsection (ii), where such
variations or replacements are required as a result of any change in, or decision of a competent
authority under, the Data Protection Law, to allow the Restricted Transfers referred to in Clause
4, subsection (ii), to be made (or continue to be made) in compliance with the Data Protection
Law.

*
TargetSpot disclaim the accuracy of any revenue information given on “passport.targetspot.com” website as this revenue
information is an estimate and given to the Publisher for information purposes only.

Updated on June 19th 2018