Integral Ad Science Holding (IAS) DRS/A Draft registration statement (amended)

Exhibit 10.2

MANAGEMENT AGREEMENT

This MANAGEMENT AGREEMENT (this “Agreement”) is made as of July 19, 2018, by and among Vista Equity Partners Management, LLC, a Delaware limited liability company (“VEP”), Kavacha Topco, LLC, a Delaware limited liability company (“Topco”), Kavacha Intermediate, LLC, a Delaware limited liability company (“Intermediate”), Kavacha Holdings, Inc., a Delaware corporation (“Parent”), and Integral Ad Science, Inc., a Delaware corporation (“IAS”, and together with Topco, Intermediate and Parent, as any such company’s name or corporate form may change from time to time and such company’s successors and assigns, the “Company”).

WHEREAS, Parent, Kavacha Merger Sub, Inc., a Delaware corporation, IAS and Shareholder Representative Services LLC, a Colorado limited liability company, solely in its capacity as the Equityholders’ Representative are parties to that certain Agreement and Plan of Merger, dated as of June 1, 2018 (the “Merger Agreement”), as amended from time to time, pursuant to which IAS became an indirect subsidiary of Topco.

WHEREAS, the Company from time to time desires to retain and avail itself of VEP, and VEP desires to perform for the Company and its affiliates certain services; and

WHEREAS, VEP, by and through its officers, employees, agents and affiliates, have developed, in connection with the conduct of their businesses and affairs, expertise in the fields of management, finance and strategic planning.

NOW, THEREFORE, in consideration of the promises and the mutual covenants contained herein, the parties do hereby agree as follows:

1. Term. This Agreement shall remain in effect unless the Company and VEP terminate this Agreement by mutual written agreement (the “Term”).

2. Appointment. The Company hereby retains VEP to render management and consulting services to the Company (or to such subsidiaries of the Company as the Company may request) during the term as herein contemplated.

3. Services. VEP, by and through its officers, employees, agents and affiliates, as VEP, in its sole discretion, shall designate from time to time, agrees to perform or cause to be performed such management and consulting services (including, but not limited to management, finance, marketing, operational and strategic planning, relationship access, corporate development and analysis of potential mergers and acquisitions) for the Company and its affiliates as mutually agreed upon by and between VEP and the Companies’ respective boards of directors (or equivalent governing body). In addition, VEP intends to provide certain services and assistance to the Company, and to provide the Company with certain resources available to VEP in order to enhance the equity value of the Company; provided, that the provision of such resources do not compromise VEP or impair its ability to conduct its business, as determined in VEP’s sole discretion. The Company agrees to hire VEP as its financial adviser in connection with any future (a) material debt or equity financing of the Company or its subsidiaries (including any sale of capital stock of the Company or its subsidiaries), (b) merger or sale of any material portion of the Company’s consolidated assets, and (c) acquisition of assets of another entity outside the ordinary course of business or of any capital stock of another entity.

4. Expenses.

(a) The Company shall reimburse VEP for all reasonable out-of-pocket costs and expenses incurred in connection with services rendered hereunder. Such costs and expenses shall be reimbursed promptly by the Company upon submission of customary expense reports.

(b) In the event, and during any period, that any loan or credit agreements to which the Company is a party prohibits the payment of all or any portion of VEP’s out-of-pocket costs and expenses required to be reimbursed pursuant to clause (a) above, then such out-of-pocket cost or expense, or portion thereof, that is not permitted to be paid shall accrue and be paid at the earliest date that the payment thereof is no longer prohibited.

(c) In no event shall the lenders party to any loan or credit agreement to which the Company is a party have any liability to VEP as a result of any prohibition in such loan or credit agreement with respect to the payment of all or any portion of the out-of-pocket costs and expenses payable by the Company to VEP pursuant to this Section 4.

(d) Each obligation hereunder of the entities comprising the Company shall be a joint and several obligation of each of them.

5. Independent Contractor. VEP and the Company agree that VEP shall perform its services hereunder as an independent contractor, retaining control over and responsibility for its own operations and employees.

6. Liability. Neither of VEP nor any of its affiliates, partners, employees or agents shall be liable to the Company or its subsidiaries or affiliates for any loss, liability, damage or expense arising out of or in connection with the performance of services contemplated by this Agreement.

7. Indemnity.

(a) The Company and its affiliates shall defend, indemnify and hold harmless VEP, its affiliates, partners, employees, agents, directors, managers, officers and controlling persons (collectively, the “Indemnified Parties”) from and against any and all loss, liability, damage, expense, or obligations of any kind or nature (whether accrued or fixed, absolute or contingent), joint or several, arising from any claim (a “Claim”) by any person or entity with respect to, or in any way related to, the services (including, without limitation, the engagement of VEP pursuant to this Agreement and the performance by VEP of services pursuant to this Agreement) contemplated by this Agreement (including attorneys’ fees) resulting from any act or omission by the Indemnified Parties. The Company and its affiliates shall defend at their own cost and expense any and all suits or actions (just or unjust) which may be brought against the Company and/or its affiliates and the Indemnified Parties. The Company and its affiliates shall defend at their own cost and expense any and all suits or actions (just or unjust) which may be brought in which the Indemnified Parties may be impleaded with others upon any Claim upon any matter, directly or indirectly, related to or arising out of this Agreement or the performance

2

hereof by the Indemnified Parties, except that if such damage shall be proven to be the direct result of gross negligence, bad faith or willful misconduct by any of the Indemnified Parties, then such Indemnified Party shall reimburse the Company and its affiliates for the costs of defense and other costs incurred by the Company and its affiliates in proportion to such Indemnified Party’s culpability as proven. In the event of the assertion against any Indemnified Party of any Claim or the commencement of any action or proceeding, the Company shall be entitled to participate in such action or proceeding and in the investigation of such Claim and, after written notice from the Company to such Indemnified Party, to assume the investigation or defense of such Claim, action or proceeding with counsel of the Company’s choice at the Company’s expense; provided, however, that such counsel shall be reasonably satisfactory to the Indemnified Party. Notwithstanding anything to the contrary contained herein, the Company may retain one firm of counsel to represent all Indemnified Parties in such claim, action or proceeding; provided, however, that the Indemnified Party shall have the right to employ a single firm of separate counsel (and any necessary local counsel) and to participate in the defense or investigation of such claim, action or proceeding, and the Company shall bear the expense of such separate counsel (and local counsel, if applicable), if (x) in the opinion of counsel to the Indemnified Party use of counsel of the Company’s choice could reasonably be expected to give rise to a conflict of interest, (y) the Company shall not have employed counsel satisfactory to the Indemnified Party to represent the Indemnified Party within a reasonable time after notice of the assertion of any such claim or institution of any such action or proceeding or (z) the Company shall authorize the Indemnified Party to employ separate counsel at the Company’s expense. The Company further agrees that with respect to any Indemnified Party who is employed, retained or otherwise associated with, or appointed or nominated by, the VEP Parties or any of its affiliates and who acts or serves as a director, officer, manager, fiduciary, employee, consultant, advisor or agent of, for or to the Company or any of its subsidiaries, that the Company or such subsidiaries, as applicable, shall be primarily liable for all indemnification, reimbursements, advancements or similar payments (the “Indemnity Obligations”) afforded to such Indemnified Party acting in such capacity or capacities on behalf or at the request of the Company, whether the Indemnity Obligations are created by law, organizational or constituent documents, contract (including this Agreement) or otherwise. Notwithstanding the fact that VEP and/or any of its respective affiliates, other than the Company (such persons or entities, together with its and their respective heirs, successors and assigns, the “VEP Parties”), may have concurrent liability to an Indemnified Party with respect to the Indemnity Obligations, the Company hereby agrees that in no event shall the Company or any of its subsidiaries have any right or claim against any of the VEP Parties for contribution or have rights of subrogation against any VEP Parties through an Indemnified Party for any payment made by the Company or any of its subsidiaries with respect to any Indemnity Obligation. In addition, the Company hereby agrees that in the event that any VEP Parties pay or advance an Indemnified Party any expenses with respect to an Indemnity Obligation, the Company will, or will cause its subsidiaries to, as applicable, promptly reimburse any such VEP Parties for such payment or advance upon request; subject to the receipt by the Company of a written undertaking executed by the Indemnified Party and the VEP Party that makes such payment or advance to repay any such amounts if it shall ultimately be determined by a court of competent jurisdiction that such Indemnified Party was not entitled to be indemnified by the Company. The foregoing right to indemnity shall be in addition to any rights that any Indemnified Party may have at common law or otherwise and shall remain in full force and effect following the completion or any

3

termination of the engagement. If for any reason the foregoing indemnification is unavailable to any Indemnified Party or insufficient to hold it harmless as and to the extent contemplated by this Section 7, then the Company shall contribute to the amount paid or payable by the Indemnified Party as a result of such Claim in such proportion as is appropriate to reflect the relative benefits received by the Company and its affiliates, on the one hand, and the Indemnified Party, as the case may be, on the other hand, as well as any other relevant equitable considerations.

(b) The Company hereby acknowledges that the Indemnified Parties have certain rights to indemnification, advancement of expenses and/or insurance provided by investment funds managed by VEP and certain of its affiliates (collectively, the “Fund Indemnitors”). The Company hereby agrees with respect to any indemnification, hold harmless obligation, expense advancement or reimbursement provision or any other similar obligation whether pursuant to or with respect to this Agreement, the organizational documents of the Company or any of its subsidiaries or any other agreement, as applicable, (i) that the Company and its subsidiaries are the indemnitor of first resort (i.e., their obligations to the Indemnified Parties are primary and any obligation of the Fund Indemnitors to advance expenses or to provide indemnification for claims, expenses or obligations arising out of the same or similar facts and circumstances suffered by any Indemnified Party are secondary), (ii) that the Company shall be required to advance the full amount of expenses incurred by any Indemnified Party and shall be liable for the full amount of all expenses, liabilities, obligations, judgments, penalties, fines, and amounts paid in settlement to the extent legally permitted and as required by the terms of this Agreement, the organizational documents of the Company or any of its subsidiaries or any other agreement, as applicable, without regard to any rights any Indemnified Party may have against the Fund Indemnitors, and (iii) that the Company, on behalf of itself and each of its subsidiaries, irrevocably waives, relinquishes and releases the Fund Indemnitors from any and all claims against the Fund Indemnitors for contribution, subrogation or any other recovery of any kind in respect thereof. The Company further agrees that no advancement or payment by the Fund Indemnitors on behalf of any Indemnified Party with respect to any claim for which any Indemnified Party has sought indemnification from the Company shall affect the foregoing and the Fund Indemnitors shall have a right of contribution and/or be subrogated to the extent of such advancement or payment to all of the rights of recovery of any Indemnified Party against the Company. The Company agrees that the Fund Indemnitors are express third-party beneficiaries of the terms of this Section 7(b).

8. Representations and Warranties. The Company represents and warrants to VEP that: (a) the Company has taken all action necessary to permit it to execute and deliver this Agreement and the other documents and instruments to be executed by it pursuant hereto and to carry out the terms hereof and thereof; (b) this Agreement and each such other document and instrument, when duly executed and delivered by the Company, will constitute a valid and binding obligation of the Company, enforceable against the Company in accordance with its terms; and (c) the Company is not required to obtain any order, consent, approval or authorization of, or to make any declaration or filing with, any third party or governmental authority in connection with the execution and delivery of this Agreement and the other documents and instruments to be executed by it pursuant hereto or the consummation of the transactions contemplated hereby and thereby, except for such order, consent, approval, authorization, declaration or filing as which has been or will be obtained or made.

4

9. Notices. All notices, requests, consents and other communications provided for herein shall be in writing and shall be (a) delivered in person, (b) transmitted by telecopy or electronic mail, (c) sent by first-class, registered or certified mail, postage prepaid, or (d) sent by reputable overnight courier service, fees prepaid, to the recipient at the address, telecopy number, or electronic mail address set forth below, or such other address, telecopy number or electronic mail address as may hereafter be designated in writing by such recipient. Notices shall be deemed given upon personal delivery, seven days following deposit in the mail as set forth above, upon acknowledgment by the receiving telecopier or by the recipient of the electronic mail or one day following deposit with an overnight courier service.

If to Topco, Intermediate, Parent or IAS:

c/o Vista Equity Partners Management, LLC

Four Embarcadero Center, 20th Floor

San Francisco, CA 94111

Attention:         David A. Breach, Michael Fosnaugh and Rod Aliabadi

E-mail:             dbreach@vistaequitypartners.com;

                         mfosnaugh@vistaequitypartners.com;

                         raliabadi@vistaequitypartners.com

with a copy (which shall not constitute notice to Topco, Intermediate, Parent, or IAS) to:

Kirkland & Ellis LLP

555 California Street

Suite 2900

San Francisco, CA 94104

Attention: Stuart E. Casillas, P.C.

Facsimile No.: (415) 439-1500

E-mail: casillas@kirkland.com

If to VEP:

Vista Equity Partners Management, LLC

Four Embarcadero Center, 20th Floor

San Francisco, CA 94111

Attention:         David A. Breach, Michael Fosnaugh and Rod Aliabadi

E-mail:             dbreach@vistaequitypartners.com;

                         mfosnaugh@vistaequitypartners.com;

                         raliabadi@vistaequitypartners.com

with a copy (which shall not constitute notice to VEP) to:

Kirkland & Ellis LLP

555 California Street

Suite 2900

5

San Francisco, CA 94104

Attention: Stuart E. Casillas, P.C.

Facsimile No.: (415) 439-1500

E-mail: casillas@kirkland.com

10. Miscellaneous.

(a) Amendment and Waiver. The provisions of this Agreement may be amended and/or waived only with the prior written consent of each of VEP and the Company.

(b) Survival of Representations and Warranties. All representations and warranties contained herein or made in writing by any party in connection herewith shall survive the execution and delivery of this Agreement and the consummation of the transactions contemplated hereby.

(c) Successors and Assigns. Except as otherwise expressly provided herein, all covenants and agreements contained in this Agreement by or on behalf of any of the parties hereto shall bind and inure to the benefit of the respective successors and assigns of the parties hereto whether so expressed or not.

(d) Severability. Whenever possible, each provision of this Agreement shall be interpreted in such manner as to be effective and valid under applicable law, but if any provision of this Agreement is held to be prohibited by or invalid under applicable law, such provision shall be ineffective only to the extent of such prohibition or invalidity, without invalidating the remainder of this Agreement.

(e) Counterparts. This Agreement may be executed simultaneously in two or more counterparts, any one of which need not contain the signatures of more than one party, but all such counterparts taken together shall constitute one and the same agreement.

(f) Descriptive Headings; Interpretation. The descriptive headings of this Agreement are inserted for convenience only and do not constitute a substantive part of this Agreement. The use of the word “including” in this Agreement shall be by way of example rather than by limitation.

(g) Governing Law. ALL QUESTIONS CONCERNING THE CONSTRUCTION, VALIDITY AND INTERPRETATION OF THIS AGREEMENT SHALL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE WITH THE DOMESTIC LAWS OF THE STATE OF NEW YORK, WITHOUT GIVING EFFECT TO ANY CHOICE OF LAW OR CONFLICT OF LAW PROVISION OR RULE (WHETHER OF THE STATE OF NEW YORK OR ANY OTHER JURISDICTION) THAT WOULD CAUSE THE APPLICATION OF THE LAWS OF ANY JURISDICTION OTHER THAN THE STATE OF NEW YORK.

6

(h) Arbitration.

(i) Resolution of Disputes. If a Dispute arises between the parties, the parties agree to use the following procedures in good faith to resolve such Dispute promptly and non-judicially. For purposes of this Agreement, “Dispute” shall mean any alleged material breach of any representation, warranty or obligation herein, or a disagreement regarding the interpretation, performance or nonperformance of any provision thereof, or the validity, scope and enforceability of these dispute resolution procedures, or any dispute regarding any damages arising from the termination of this Agreement. Any party may give written notice to any other party of the existence of a Dispute (a “Dispute Notice”).

(ii) Negotiation. Within ten days after delivery of any Dispute Notice the parties involved in the Dispute shall meet at a mutually agreeable time and place and thereafter as often as they deem reasonably necessary to exchange relevant information and attempt in good faith to negotiate a resolution of the Dispute. If the Dispute has not been resolved within ten days after the first meeting of the parties, or, if the party receiving the Dispute Notice will not meet within ten days after receipt of the Dispute Notice, then either party may, by delivering notice to the other party, commence arbitration proceedings.

(iii) General Dispute Resolution Provisions.

(A) All deadlines specified in this Section 10(h) may be extended by mutual agreement. The procedures specified in this Section 10(h) are an essential provision of this Agreement and are legally binding on the parties. These procedures shall be the sole and exclusive procedures for the resolution of any Dispute between the parties arising out of or relating to this Agreement. Any and all actions to enforce the obligations under this Section 10(h) shall be brought in any court of competent jurisdiction in courts located in San Francisco, California.

(B) The parties acknowledge that the provisions of this Section 10(h) are intended to provide a private resolution of Disputes between them. Accordingly, all documents, records, and other information relating to the Dispute shall at all times be maintained in the strictest confidence and not disclosed to any third party, other than the arbitrators, except where specifically allowed hereunder. All proceedings, communications and negotiations pursuant to this Section 10(h) are confidential. In the event of any judicial challenge to, or enforcement of, any order or award hereunder, any party may designate such portions of the record of such proceedings, communications, and negotiations as such party deems appropriate to be filed under seal. All proceedings, communications and negotiations pursuant to this Section 10(h) shall be treated as compromise negotiations for all purposes, including for purposes of the US Federal Rules of Evidence and state rules of evidence. None of the statements, disclosures, offers, or communications (or other assertions made in any proceeding or negotiation) made pursuant to this Section 10(h) shall be deemed admissions, nor shall any of said statements, disclosures, offers, communications or assertions be admissible for any purpose other than the enforcement of the terms of this Section 10(h).

The parties agree to act in good faith to comply with all of their respective obligations under this Agreement as much as possible as if there were no Dispute during any pending mediation or arbitration hereunder.

7

The parties agree that the terms of this Section 10(h) shall survive the termination or expiration of this Agreement.

(iv) WAIVER OF JURY TRIAL. The parties agree to have any Dispute decided by neutral arbitration as provided in this Section 10(h) and the parties are giving up any rights they might possess to have the Dispute litigated in a court or by a jury trial. The parties are giving up their judicial rights to discovery and appeal, unless such rights are specifically included in this Section 10(h). The parties acknowledge and agree that their agreement to this arbitration provision is voluntary. FOR THE AVOIDANCE OF DOUBT AND IN FURTHERANCE OF THE FOREGOING, EACH PARTY HERETO HEREBY WAIVES AND COVENANTS THAT IT WILL NOT ASSERT (WHETHER AS PLAINTIFF, DEFENDANT OR OTHERWISE) ANY RIGHT TO TRIAL BY JURY IN ANY FORUM IN RESPECT OF ANY ISSUE OR ACTION, CLAIM, CAUSE OF ACTION OR SUIT (IN CONTRACT, TORT OR OTHERWISE), INQUIRY, PROCEEDING OR INVESTIGATION ARISING OUT OF OR BASED UPON THIS AGREEMENT OR THE SUBJECT MATTER HEREOF OR IN ANY WAY CONNECTED WITH OR RELATED OR INCIDENTAL TO THE TRANSACTIONS CONTEMPLATED HEREBY, IN EACH CASE WHETHER NOW EXISTING OR HEREAFTER ARISING.

(i) Other Activities. To the fullest extent permitted by law: (i) any Covered Person (as defined below) shall have the right to, and shall have no duty (contractual or otherwise) not to, directly or indirectly: (A) engage or otherwise participate in any manner whatsoever in the same, similar or competing business activities or lines of business as the Company or its subsidiaries, (B) do business with any client or customer of the Company or its subsidiaries, or (C) make investments in competing businesses of the Company or its subsidiaries, and such acts shall not be deemed wrongful or improper; (ii) no Covered Person shall be liable to the Company or its subsidiaries, for breach of any duty (contractual or otherwise), including without limitation fiduciary duties, by reason of any such activities or of such person’s participation therein; and (iii) in the event any Covered Person acquires knowledge of a potential transaction or matter that may be a corporate opportunity for the Company or its subsidiaries, on the one hand, and a Covered Person, on the other hand, or any other person, no Covered Person shall have any duty (contractual or otherwise), including without limitation fiduciary duties, to communicate, present or offer such corporate opportunity to the Company or its subsidiaries and shall not be liable to the Company or its subsidiaries for breach of any duty (contractual or otherwise), including without limitation fiduciary duties, by reason of the fact that the Covered Person directly or indirectly pursues or acquires such opportunity for itself, directs such opportunity to another person, or does not present or communicate such opportunity to the Company or its subsidiaries, even though such corporate opportunity may be of a character that, if presented to the Company or its subsidiaries, could be taken by the Company or its subsidiaries. The Company renounces any interest or expectancy of the Company in, or in being offered an opportunity to participate in, any such opportunity. “Covered Persons” include Vista Equity Partners Fund VI, L.P., Vista Equity Partners Fund VI-A, L.P., and VEPF VI FAF, L.P., Vista Equity Partners Management, LLC and their respective affiliates and any of their respective managed investment funds and portfolio companies (excluding the Company and its subsidiaries) and their respective partners, members, directors, managers, employees, stockholders, agents, any successor by operation of law (including by merger) of any such

8

person, and any entity that acquires all or substantially all of the assets of any such person in a single transaction or series of related transactions. Notwithstanding anything in this Section 10(i) to the contrary, for so long as VEP and its affiliates hold at least 50.1% of the outstanding membership interests of Topco, to the extent of any conflict between this Section 10(i) and the Amended and Restated Limited Liability Company Agreement of Topco (the “Topco LLC Agreement”), the Topco LLC Agreement shall control.

(j) Complete Agreement. This Agreement, together with the Data Protection Addendum, embodies the complete agreement and understanding among the parties hereto with respect to the subject matter hereof, and supersedes and preempts any prior understandings, agreements or representations by or among such parties, written or oral, which may have related to the subject matter hereof in any way.

* * * *

9

IN WITNESS WHEREOF, the parties hereto have executed this Management Agreement on the date first written above.

VISTA EQUITY PARTNERS MANAGEMENT, LLC
By:	VEP Group, LLC
Its:	Senior Managing Member
By:	/s/ Robert F. Smith
Name:	Robert F. Smith
Title:	Managing Member
KAVACHA TOPCO, LLC
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President

KAVACHA INTERMEDIATE, LLC
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President
KAVACHA HOLDINGS, INC.
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President

INTEGRAL AD SCIENCE, INC.
By:	/s/ Don Epperson
Name:	Don Epperson
Title:	Chief Executive Officer

{Management Agreement}

DATA PROTECTION ADDENDUM

This Data Protection Addendum (“DPA”), which forms part of the Management Agreement (“Agreement”) among: (i) Vista Equity Partners Management, LLC (“VEP”); (ii) Kavacha Topco, LLC, a Delaware limited liability company (“Topco”); Kavacha Intermediate, LLC, a Delaware limited liability company (“Intermediate”); Kavacha Holdings, Inc., a Delaware corporation (“Parent”); and Integral Ad Science, Inc., a Delaware corporation (“IAS”, and together with Topco, Intermediate and Parent, as any such company’s name or corporate form may change from time to time and such company’s successors and assigns, the “Company”), to which it is attached, reflects the Parties’ agreement with regards to the processing of EU Personal Data. Each of VEP and Company may be referred to herein as a “Party” or the “Parties”.

The DPA applies to VEP’s processing of Personal Data provided by the Company or/and its affiliates to VEP. Except as expressly stated otherwise, in the event of any conflict between the terms of this DPA, including any policies or appendices referenced herein, and the Agreement, the terms of this DPA shall take precedence.

1. Definitions

1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

1.1.1 “Company” is as defined above;

1.1.2 “Data Protection Legislation” means all applicable legislation relating to the protection and processing of Personal Data in any relevant jurisdiction, including (without limitation): the Data Protection Directive (95/46/EC), the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Data Protection (Processing of Sensitive Personal Data) Order 2000, or any other legislation which implements any other current or future legal act of the European Union concerning the protection and processing of personal data (including Regulation (EU) 2016/679 (the General Data Protection Regulation) and any national implementing or successor legislation), and including any amendment or re-enactment of the foregoing;

1.1.3 “Personal Data” has the meaning given to it in the Data Protection Legislation and relates only to personal data, or any part of such personal data, of which VEP is a controller in connection with the performance of its obligations under this DPA and the Agreement;

1.1.4 “Standard Contractual Clauses” means the standard contractual clauses for the transfer of Personal Data from the EU to controllers established in third countries (controller to controller transfers), as set out in the Annex to Commission Decision 2004/915/EC and attached at Schedule 1 hereto; and

1.1.5 “VEP” means Vista Equity Partners Management, LLC.

1.2 The terms, “Data Subject”, “processing and process”, “supervisory authority”, and “controller”, “processor” and “appropriate technical and organisational measures” shall have the meanings given to them in the Data Protection Legislation.

1.3 The word “include” shall be construed to mean include without limitation, and cognate terms shall be construed accordingly.

2. Data Protection

2.1 The Parties acknowledge and agree that, for the purposes of the Data Protection Legislation, VEP is a controller of the Personal Data. VEP shall comply, and take all reasonable steps to cause its employees, agents and subcontractors to comply, with its obligations under applicable Data Protection Legislation.

2.2 VEP shall: (i) only process the Personal Data to the extent necessary to exercise its rights, and perform its obligations, under the Agreement and this DPA; and (ii) shall not do or omit to do anything that would cause the Company (or its affiliates) to breach its obligations under Data Protection Legislation.

2.3 VEP shall implement appropriate technical and organisational measures to ensure a level of security of the Personal Data appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of processing.

2.4 In the event of a notice, dispute or claim brought by a data subject, supervisory authority, or other third party concerning the processing of the Personal Data against either or both Parties, the Parties will inform each other about any such notices, disputes or claims, and will cooperate with each other to resolve the matter with the relevant data subject, supervisory authority or other third party. The Parties agree to provide reasonable assistance to each other to enable each Party to comply with any data subject requests in respect of the Personal Data that are received by either Party under Data Protection Legislation and to respond to any other queries or complaints from data subjects.

2.5 VEP shall only transfer the Personal Data to, or process the Personal Data in, any country outside the European Economic Area in accordance with Data Protection Legislation (which may include VEP entering into the Standard Contractual Clauses).

IN WITNESS WHEREOF, this DPA is entered into and becomes a binding part of the Agreement with effect from the date first set out above.

KAVACHA TOPCO, LLC
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President

KAVACHA INTERMEDIATE, LLC
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President
KAVACHA HOLDINGS, INC.
By:	/s/ Michael Fosnaugh
Name:	Michael Fosnaugh
Title:	Vice President

INTEGRAL AD SCIENCE, INC.
By:	/s/ Don Epperson
Name:	Don Epperson
Title: Dated:	Chief Executive Officer July 19, 2018

VISTA EQUITY PARTNERS MANAGEMENT, LLC
By:	/s/ Robert F. Smith
Name: Robert F. Smith
Title: Managing Member

Dated: July 19, 2018

Schedule 1

 EUROPEAN COMMISSION  DIRECTORATE-GENERAL JUSTICE    Directorate C: Fundamental rights and Union citizenship  Unit C.3: Data protection

Commission Decision C(2004)5721

SET II

Standard contractual clauses for the transfer of personal data from the Community to third countries (controller to

controller transfers)

Data transfer agreement

between

KAVACHA TOPCO, LLC; KAVACHA INTERMEDIATE, LLC; KAVACHA HOLDINGS, INC.; and INTEGRAL AD SCIENCE, INC.                                                                                                              (name)

c/o Vista Equity Partners Management, LLC, 4 Embarcadero Center, 20^th Floor, San Francisco, CA 94111 (address and country of establishment)

hereinafter “data exporter”

and

VISTA EQUITY PARTNERS MANAGEMENT, LLC                                         (name)

4 Embarcadero Center, 20^th Floor, San Francisco, CA 94111                               (address and country of establishment)

hereinafter “data importer”

each a “party”; together “the parties”.

Definitions

For the purposes of the clauses:

a) “personal data”, “special categories of data/sensitive data”, “process/processing”, “controller”, “processor”, “data subject” and “supervisory authority/authority” shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the authority” shall mean the competent data protection authority in the territory in which the data exporter is established);

b) “the data exporter” shall mean the controller who transfers the personal data;

c) “the data importer” shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection;

d) “clauses” shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

I. Obligations of the data exporter

The data exporter warrants and undertakes that:

a) The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.

b) It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.

c) It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.

d) It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.

e) It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required.

II. Obligations of the data importer

The data importer warrants and undertakes that:

a) It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

b) It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data.

c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.

d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfil the undertakings set out in these clauses.

e) It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause I(e).

f) At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage).

g) Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion.

h) It will process the personal data, at its option, in accordance with:

i. the data protection laws of the country in which the data exporter is established, or

ii. the relevant provisions¹ of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by such authorisation or decision for the purposes of the transfer(s) of the personal data², or

iii. the data processing principles set forth in Annex A.

Data importer to indicate which option it selects:                                                                                                          

Initials of data importer:                                                                                                                                                  ;

i) It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and

i. the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection, or

ii. the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or

iii. data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or

iv. with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer

III. Liability and third party rights

a) Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the data exporter under its data protection law.

b) The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).

¹  “Relevant provisions” means those provisions of any authorisation or decision except for the enforcement provisions of any authorisation or decision (which shall be governed by these clauses).

²  However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must be applied when this option is chosen and take precedence over any comparable provisions of the Commission Decision selected.

IV. Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause.

V. Resolution of disputes with data subjects or the authority

a) In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

c) Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of the authority which is final and against which no further appeal is possible.

VI. Termination

a) In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.

b) In the event that:

i. the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a);

ii. compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;

iii. the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;

iv. a final decision against which no further appeal is possible of a competent court of the data exporter’s country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or

v. a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs

then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.

c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.

d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

VII. Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

VIII. Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

Dated:

FOR DATA IMPORTER

VISTA EQUITY PARTNERS MANAGEMENT, LLC

By:	/s/ Robert F. Smith
Name:	Robert F. Smith
Title:	Managing Member

Dated: July 19, 2018

FOR DATA EXPORTER

COMPANY

KAVACHA TOPCO, LLC
By:	/s/ Michael Fosnaugh

Name:	Michael Fosnaugh
Title:	Vice President

KAVACHA INTERMEDIATE, LLC
By:	/s/ Michael Fosnaugh

Name:	Michael Fosnaugh
Title:	Vice President
KAVACHA HOLDINGS, INC.
By:	/s/ Michael Fosnaugh

Name:	Michael Fosnaugh
Title:	Vice President

INTEGRAL AD SCIENCE, INC.
By:	/s/ Don Epperson
Name:	Don Epperson
Title:	Chief Executive Officer

Dated: July 19, 2018

ANNEX A

DATA PROCESSING PRINCIPLES

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter.

4. Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.

5. Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority.

6. Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II.

7. Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes.

8. Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:

a) i. such decisions are made by the data importer in entering into or performing a contract with the data subject, and

ii. the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.

or

b) where otherwise provided by the law of the data exporter.

ANNEX B

DESCRIPTION OF THE TRANSFER

(To be completed by the parties)

Data subjects

The personal data transferred concern the following categories of data subjects:

Employees of the Company or affiliated entities, executives, directors, employee candidates, vendors, other business relationships.

Purposes of the transfer(s)

The transfer is made for the following purposes:

We process personal information to enable us to perform the management and consulting services provided under the Agreement (including, but not limited to management, finance, marketing, operational and strategic planning, relationship access, corporate development and analysis of potential mergers and acquisitions). We process Company candidates’ data for administration, research, database development and business operation purposes. We also process personal information in order to maintain our own accounts and records, promote our services and to support and manage our employees and partners.

Categories of data

The personal data transferred concern the following categories of data:

• personal details (e.g., name, title, email, address, taxpayer ID number, passport number, driver licence number etc.)

• financial details (e.g. compensation including bonus amounts and account information to facilitate payment)

• business of the person whose personal information we are processing (e.g., job title)

• education and employment details

• family details

• lifestyle and social circumstances

• photographs

Recipients

The personal data transferred may be disclosed only to the following recipients or categories of recipients:

• Vista Consulting Group, LLC

• Other affiliates, including affiliated investment funds and the limited partners thereof

• suppliers and service providers (e.g. data hosting providers, auditors and third parties undertaking KYC reviews and background checks, amongst others)

• business associates

• financial organisations

• ombudsman, regulatory and governmental authorities

• employment and recruitment agencies

• current, past or prospective employers

• healthcare professionals, social and welfare organisations (e.g., for HR-related benefits and pensions providers)

• educators and examining bodies

• trade associations and professional bodies

• debt collection and tracing agencies

• credit reference agencies

• complainants, enquirers

• courts and tribunals

• family, associates or representatives of the person whose personal data we are processing

Sensitive data (if appropriate)

The personal data transferred concern the following categories of sensitive data:

• physical or mental health details

• trade union membership

• offences and alleged offences

• criminal proceedings, outcomes and sentences

Data will be stored for no longer than is necessary for the purpose.

Contact points for data protection enquiries

Data importer

Vista Equity Partners Management, LLC

4 Embarcadero Center, 20^th Floor

San Francisco, CA 94111

Data exporter

Kavacha Topco, LLC

Kavacha Intermediate, LLC

Kavacha Holdings, Inc.

Integral Ad Science, Inc.

c/o Vista Equity Partners Management, LLC

4 Embarcadero Center, 20^th Floor

San Francisco, CA 94111