Data Protection Addendum

This Data Protection Addendum ("Addendum") explains who is responsible for personal data when an application developer, publisher, or other business (the "Publisher") integrates anyIP SDK, and sets out what each party commits to under data protection law. It forms part of the Publisher Terms of Service and of any separately executed Publisher Agreement.

The first part answers the questions publishers ask most often. The second part, the Addendum terms, is the binding text and prevails if the two ever differ. How we handle data about the people who use your app is explained to them in our Privacy Policy and End User License Agreement.

Data Protection at a Glance#

Who is the data controller?#

There are three separate sets of data, and each has its own controller:

• Data the SDK processes about users who opt in (the device's IP address, a pseudonymous device identifier, the device operating system, and the signed consent receipt): ELEGANT NETWORKS PTE. LTD. is the controller. We decide why and how this data is processed, we show the consent screen, and we keep the consent record.
• Your app's own data (accounts, analytics, content, and anything else your app collects): you are the controller. The SDK does not access it and we never receive it.
• The content of traffic routed through the SDK: the business customer of anyip.io that sends a request decides what to fetch, so it is the controller of any personal data in that request and its response. We handle that traffic on the customer's behalf under the anyip.io Data Processing Agreement. Neither you nor the user who opted in sees or controls it, and our Approved Use Policy limits it to publicly accessible websites.

Is this an Article 28 processing agreement?#

No. We do not process personal data on your behalf or on your instructions, so Article 28 of the GDPR does not apply between us and you do not need a processor agreement with us for the SDK. Each of us is an independent controller of its own data. This Addendum records that split and what each side commits to.

Are we joint controllers?#

No. You decide to include the SDK in your app, but we alone decide what the SDK processes, for which purposes, and how: we build and control the consent screen, the data the SDK collects, and what happens to that data. You receive only aggregate participation figures, not SDK data, and you cannot direct how SDK data is used, so we do not treat this as joint controllership under Article 26 of the GDPR.

What do users agree to, and on what legal basis?#

Nothing happens until a user actively accepts the SDK's own consent screen, which is separate from your app's terms. Accepting lets business customers of anyip.io reach publicly accessible websites through the user's internet connection and IP address. Our legal bases are:

• Consent (GDPR Article 6(1)(a)) for routing traffic and the processing that routing requires.
• Legitimate interests (Article 6(1)(f)) for security, abuse prevention, and keeping the consent receipt after a user opts out, so the choice stays provable.
• Legal obligation (Article 6(1)(c)) where the law requires us to keep or disclose data.

Users can withdraw at any time in your app's settings, by uninstalling the app, or on our web opt-out page.

Where is the data processed?#

ELEGANT NETWORKS PTE. LTD. is a Singapore company. The SDK sends its data directly to our servers and not through your systems, so your app does not transfer SDK data to us. If a restricted transfer of personal data between us does take place, for example when you forward a user's request, the EU Standard Contractual Clauses and the UK Addendum apply, as set out in section 8.

Do you use sub-processors?#

Yes. Hosting and infrastructure providers process SDK data for us under written contracts that bind them to data protection obligations. Email contact@anyip-sdk.com for the current list.

How do users exercise their rights?#

Users contact us directly at contact@anyip-sdk.com and can opt out at any time as described above. If a user sends you a request about the SDK, forward it to us and we will handle it.

What do we need to do as a publisher?#

• Integrate the SDK as we supply it, and leave the consent screen and the sharing setting exactly as they come.
• Mention the SDK in your app's privacy policy (suggested wording below).
• Never send personal data to the SDK or to us.
• Keep the SDK out of apps directed at children.
• Never penalize a user for declining or opting out: your app's core features must work the same either way.
• Forward any request or complaint about the SDK to us.

Suggested wording for your privacy policy:

This app includes anyIP SDK, provided by ELEGANT NETWORKS PTE. LTD. (Singapore). Only if you accept its separate consent screen, the SDK lets business customers that have been checked and approved reach publicly accessible websites through your internet connection and IP address. ELEGANT NETWORKS PTE. LTD. is an independent controller of the data the SDK processes: your IP address, a pseudonymous device identifier, your device's operating system, and a record of your consent. Its privacy policy is at https://anyip-sdk.com/privacy/. You can turn sharing off at any time in this app's settings.

Do we need to sign anything?#

No. This Addendum applies automatically once you have accepted the Publisher Terms of Service or signed a Publisher Agreement, so there is nothing separate to sign. The current version always lives at this address.

Addendum Terms#

These terms bind ELEGANT NETWORKS PTE. LTD. ("we", "us") and the Publisher ("you").

1. Scope and Precedence#

1.1 This Addendum applies to personal data processed in connection with your integration of anyIP SDK. It supplements the Publisher Terms of Service and any separately executed Publisher Agreement (together, the "Agreement").

1.2 On data protection matters, this Addendum prevails over the Publisher Terms of Service. A separately executed Publisher Agreement that expressly addresses data protection controls to the extent of any conflict with this Addendum.

2. Definitions#

• "Applicable Data Protection Law" means every law on personal data that applies to a party's processing under this Addendum, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Singapore Personal Data Protection Act 2012, and the California Consumer Privacy Act as amended.
• "SDK Data" means the personal data we process through the SDK about Users, as described in section 4.
• "App Data" means personal data that your app processes other than through the SDK.
• "Customer Traffic" means the requests that business customers of anyip.io send through the network, and the responses to them.
• "Consent Screen" means the screen, built and controlled by us and displayed by the SDK, on which a User accepts or declines participation.
• "Consent Receipt" means the signed record of a User's choice on the Consent Screen, including what was agreed and when.
• "User" means an individual who is shown the Consent Screen in your app.
• "Controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meanings given in the GDPR, or the equivalent terms under other Applicable Data Protection Law.

3. Roles of the Parties#

3.1 We are an independent controller of SDK Data.

3.2 You are an independent controller of App Data. We do not access App Data.

3.3 The parties are not joint controllers, and neither processes personal data on behalf of the other under this Addendum. Each party is responsible for its own compliance with Applicable Data Protection Law.

3.4 We process Customer Traffic on behalf of the business customer that sends it, under that customer's agreement with anyip.io and the anyip.io Data Processing Agreement. You have no access to and no role in Customer Traffic, and this Addendum does not apply to it.

4. Description of the Processing#

• Data subjects: Users. Traffic is routed only through the connections of Users who accept the Consent Screen.
• Personal data: the device's IP address, a pseudonymous device identifier, the device operating system, and the Consent Receipt. The SDK collects no names, email addresses, contacts, messages, files, or browsing history.
• Special categories of data: none.
• Purposes: routing Customer Traffic to publicly accessible websites through the internet connection and IP address of Users who opted in; recording and proving consent; security and abuse prevention; compliance with legal obligations; and counting participating devices to report aggregate figures to you and calculate what we pay you.
• Legal bases: consent for routing; legitimate interests for security, abuse prevention, and keeping Consent Receipts; legal obligation where the law requires it.
• Age: Users must be at least 18 years old, or the age of majority where they live if higher, to accept the Consent Screen.
• Retention: as set out in our Privacy Policy. Consent Receipts are kept after a User opts out so the choice remains provable.

5. Our Commitments#

5.1 Consent first. The SDK routes no Customer Traffic through a device until its User has accepted the Consent Screen and a Consent Receipt has been recorded.

5.2 Transparency. We build and control the Consent Screen and the End User License Agreement and Privacy Policy it links to. If a change materially affects what Users agreed to, the SDK asks them again before the change applies to them.

5.3 Withdrawal. We stop routing through a device when its User turns sharing off, uses our web opt-out page, or uninstalls the app.

5.4 Data subject rights. We handle requests about SDK Data in line with Applicable Data Protection Law.

5.5 Security. We maintain appropriate technical and organizational measures to protect SDK Data, taking into account the state of the art, the cost of implementation, and the risks involved. Access to SDK Data is limited to personnel who need it and who are bound by confidentiality.

5.6 Sub-processors. We engage sub-processors only under written contracts that impose data protection obligations meeting Article 28 of the GDPR. The current list is available on request.

5.7 Personal data breaches. We handle any personal data breach affecting SDK Data, including notifying supervisory authorities and Users where Applicable Data Protection Law requires, and we inform you without undue delay where the breach affects Users of your app.

5.8 Network rules. Every business customer must accept our Approved Use Policy, which limits Customer Traffic to publicly accessible websites and blocks banking, other financial-institution, and government websites by default.

6. Your Commitments#

6.1 Integration. You integrate the SDK only in the form we supply. You must not modify, hide, overlay, simulate, pre-select, or otherwise interfere with the Consent Screen, the Consent Receipt, or the SDK's sharing setting, and you must not accept the Consent Screen on a User's behalf.

6.2 Sharing setting. You keep the SDK's sharing setting available to Users in your app's settings.

6.3 Transparency. Your app's privacy policy identifies the SDK and ELEGANT NETWORKS PTE. LTD. as an independent controller of SDK Data, and links to our Privacy Policy.

6.4 No data from you. You do not pass personal data, including App Data, to the SDK or to us, except a User request you forward under section 6.7.

6.5 Children. You do not include the SDK in an app directed at children.

6.6 No penalty for declining. You do not penalize a User for declining or withdrawing, and your app's core features work the same either way. Withholding only a benefit that was offered in exchange for opting in, such as an ad-free mode, is not a penalty.

6.7 Requests. You forward to us without undue delay any request, complaint, or regulator inquiry you receive about SDK Data.

7. Cooperation#

7.1 Each party gives the other reasonable help with data subject requests, regulator inquiries, and data protection impact assessments that concern the SDK.

7.2 Each party tells the other promptly if a supervisory authority contacts it about the SDK, unless the law prohibits it.

8. International Transfers#

8.1 We are established in Singapore. The SDK sends SDK Data directly from the device to us; it does not pass through your systems.

8.2 Where one party transfers personal data to the other in a country that Applicable Data Protection Law does not recognize as providing adequate protection, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), are incorporated into this Addendum, with the transferring party as data exporter and the receiving party as data importer. Clause 7 and the option in Clause 11 do not apply; under Clause 13 the competent supervisory authority is the one determined by the data exporter's establishment or representative; and Clauses 17 and 18 select the law and courts of Ireland. Annex I is completed by sections 3 and 4 of this Addendum, and Annex II by section 5.5.

8.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with its tables completed from this Addendum. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

9. Liability#

Each party is liable for its own compliance with Applicable Data Protection Law. Liability under this Addendum is subject to the limitations and exclusions in the Agreement, except where Applicable Data Protection Law or the Standard Contractual Clauses do not allow them.

10. Term#

This Addendum applies for as long as the Agreement is in force or your app includes the SDK, whichever is later. When it ends, each party keeps or deletes personal data in line with its own obligations; we keep Consent Receipts as described in our Privacy Policy.

11. Changes to This Addendum#

We may update this Addendum. Changes follow the process in the Publisher Terms of Service, including at least 30 days' advance notice of any material change.

12. Governing Law#

This Addendum is governed by the same law, and disputes are resolved in the same forum, as the Agreement: the laws and courts of Singapore under the Publisher Terms of Service, unless a separately executed Publisher Agreement provides otherwise. The Standard Contractual Clauses, where they apply, are governed by the law and courts chosen in section 8.

Contact#

Questions about this Addendum, requests for the sub-processor list, and data protection requests go to contact@anyip-sdk.com.