1. Scope and application

This Publisher Policy (the "Policy") sets out the guidelines and requirements applicable to publishers using the Helix supply-side platform and related services (the "Helix Services"). Helix is operated by Xapads Media Pte. Ltd., a company incorporated in the Republic of Singapore with UEN 201729601K and registered office at 7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987 ("Helix", "we", "us", "our"). As a publisher (referred to as "Publisher" or "You"), you are required to adhere to this Policy

when using the Helix Services to monetise advertising inventory ("Publisher Inventory"). This Policy applies to individual publishers, app aggregators, resellers, networks, exchanges, and supply-side platforms that integrate with Helix. Publisher Inventory may include websites, mobile applications, connected TV ("CTV") and over- the-top applications, in-app and mobile web inventory, applications managed by aggregators, other reseller models, and other digital media properties accessible through the Helix Services (collectively, the "Publisher Properties").

By participating in the Helix Services, you agree to comply with:

• (a) this Policy, and any updates or changes made by Helix;
• (b) the terms of the agreement between you and Helix; and
• (c) all applicable laws and regulations in performing your role as a publisher.

Failure to adhere to this Policy may result in suspension of monetisation of your inventory sources, withholding or cancellation of amounts otherwise payable, and/or termination of your account.

2. Onboarding and inventory approval

You must inform Helix of any new Publisher Property you wish to onboard. Helix will conduct an onboarding review of each such property.

Helix reserves the right to refuse participation to any Publisher or Publisher Property at any time, in its sole discretion. Approval of a Publisher Property does not prevent Helix from later terminating that participation where we determine that you have breached this Policy or your agreement with us.

You consent to Helix monitoring, recording, using, and disclosing information about any Publisher Property in order to verify compliance with this Policy and your agreement. Helix may conduct periodic audits of approved Publisher Properties.

Material changes in the content, ownership, or operation of any Publisher Property must be reported to Helix within ten (10) business days.

All mobile applications must be listed in official application stores, and all CTV applications must be approved by the relevant platform operator.

App aggregators, resellers, networks, and supply-side platforms making inventory available through Helix must additionally:

• (a) submit a complete portfolio of the properties and applications they intend to monetise;
• (b) attest to compliance with this Policy in respect of each such asset;
• (c) notify Helix before adding any new property or application to that portfolio; and
• (d) provide, on request, evidence of their authority to monetise each property.

3. Inventory authorisation and transparency

You must:

• (a) add the Helix-specified entries to your ads.txt and app-ads.txt files to authorise Helix to sell your inventory;
• (b) maintain those files accurately and update them as necessary;
• (c) notify Helix promptly of any change or issue affecting your ads.txt or app-ads.txt entries;
• (d) ensure, by contractual requirement or terms and conditions, that Helix is listed in the ads.txt and app-ads.txt files of any downstream partner through which your inventory is made available;
• (e) where applicable, maintain accurate sellers.json entries and include Helix and its partners in the IAB SupplyChain Object in all bid requests.

For inventory covered by a published ads.txt or app-ads.txt file, you may send requests to Helix only where your Helix-assigned seller account ID appears in that file.

Helix publishes a sellers.json file identifying the sellers operating on the Helix platform. You must provide accurate information for the purposes of that file, including your legal entity name, domain, and the nature of your relationship to the inventory you make available. You must notify Helix promptly where that information changes.

All information you provide in connection with the Helix Services must be correct and complete, including any description of the characteristics of the inventory and related data, and must not be misrepresented in any way. We require full transparency in order to assess the quality of inventory you make available.

4. Media placement

You are responsible for ensuring that all placements on Publisher Properties comply with this Policy, including on any Publisher Property managed on behalf of a third party.

• (a) No more than three (3) media units may be viewable at one time on any page or screen.
• (b) No placement may be displayed in a pop-up, pop-under, or in an email.
• (c) No element on the page may obscure any portion of a placement, redirect users to unwanted sites, modify browser settings, or otherwise adversely interfere with user navigation.
• (d) No placement may appear on non-content-based pages, on applications or pages that do not match the domains approved and vetted by Helix, or on any property that Helix has disapproved or rejected.
• (e) No placement may appear on undeveloped or dormant properties.
• (f) No placement may appear on properties where substantial portions are gated behind a login, paywall, or subscription, unless such access is typical for the content type and has been pre- approved by Helix with test access provided.
• (g) No placement may appear on properties lacking clear attribution of ownership or operation. Publisher Properties must provide end users with a transparent and accessible method of contacting the owner or operator.

5. Technical integration

• (a) No media unit may be triggered by, or integrated into, any adware, toolbar, add-on, browser plug-in, or similar software application.
• (b) Helix-supplied code must be implemented without modification, and without altering in any manner the behaviour, targeting, or delivery of placements.
• (c) You must not strip, remove, or otherwise interfere with any third-party tag or wrapper implemented by Helix or its partners.
• (d) You are responsible, at your own expense, for ensuring that Publisher Properties operate Helix-supplied technology compatibly and that advertising displays correctly. Helix has no obligation to notify you where it becomes aware that advertising is not displaying properly.
• (e) Your inventory specifications and the criteria you provide to Helix must be true and accurate.

6. Ad refresh

You may load new advertising only where:

• (a) the end user navigates to a new page or screen;
• (b) the current page is substantially updated with new content and at least one (1) minute has elapsed since the last refresh;
• (c) the ad unit has remained in view for at least thirty (30) seconds, as measured by an MRC- accredited verification company.

In no event may an ad unit be refreshed more than twenty (20) times per end user session, or within less than thirty (30) seconds of a previous refresh.

7. Content quality and Made-for-Advertising

Publisher Properties must contain a minimum of original content and may not be "Made-for- Advertising" ("MFA") properties, defined as sites or applications that:

• (a) contain content offering little or no value;
• (b) contain content taken from other sources without clear attribution, or in violation of law or any third-party right;
• (c) consist predominantly of advertising with little substantive content, or are designed primarily to display advertising; or
• (d) are generated by artificial intelligence and populated with synthesised or plagiarised content with falsified attributions of ownership.

Where Publisher Properties contain original financial or health-related content, appropriate disclaimers must be included in accordance with applicable legal and platform standards.

8. Prohibited content

Publisher Properties may not display or include any of the following.

Weapons and violence

• (a) Promotion or sale of firearms, ammunition, explosives, other weapons, or related design materials, including combat knives, stun guns, and air weapons
• (b) Depiction, glorification, or description of violence, pain, suffering, torture, or death of or against humans or animals

Adult content

• (a) Pornography, nudity, adult or mature content, sexually explicit or suggestive content
• (b) Adult-themed dating or escort services, "mail-order bride" or similar services
• (c) Anime or manga containing unlicensed, pirated, or adult content (legitimate licensed content is permitted)

Hate and discrimination

• (a) Incitement of hatred against, or discrimination of, any race, religion, creed, class, gender, sexual orientation, ethnic group, individual, group, or protected class

Controlled substances

• (a) Promotion or use of illegal drugs, drug paraphernalia, or methods of evading drug testing
• (b) Sale or promotion of tobacco products, cigars, cigarette papers, or blunt wraps

Intellectual property infringement

• (a) Sale or promotion of replica or imitation designer goods
• (b) Sale or distribution of term papers or student essays
• (c) Promotion of illegal file-sharing, torrent, or other methods facilitating intellectual property infringement

Fraudulent and deceptive content

• Including content that:
• (a) installs spyware, trojans, viruses, or other malware
• (b) sends an SMS message or initiates a charge without explicitly notifying the user and requiring a deliberate action
• (c) falsely claims a third-party plug-in is outdated in order to induce a download
• (d) promotes hacking, cracking, or warez
• (e) is misleading, or does not reflect what the user will find at the click-through destination
• (f) employs phishing techniques to obtain sensitive information by misrepresenting identity
• (g) falsifies user interactions, such as faked clicks
• (h) mimics system errors or messages
• (i) includes deepfakes or other manipulated media presented as genuine

Other prohibited categories

• (a) Cult or occult-related content
• (b) Excessive profanity
• (c) Defamatory, libellous, abusive, harassing, offensive, or obscene content
• (d) Unmoderated user-generated content, or a significant proportion of user-generated content
• (e) Misinformation, disinformation, or propaganda relating to politics, health, science, or public safety, as determined by Helix
• (f) Any other content that is illegal, promotes illegal activity, products, or services, promotes harmful activity, or otherwise infringes the rights of others

8.1 Restricted content

The following are permitted only with regional legal compliance and the prior written approval of Helix:

• (a) Promotion or sale of alcohol-related products or content, subject to regional legal compliance, applicable age restrictions, and Helix approval
• (b) Promotion or facilitation of gambling, betting, or lottery content, subject to regional licensing and Helix approval

Approval may be granted for specified territories only, and may be withdrawn at any time. You must not make restricted content available in any territory for which approval has not been granted.

9. Legal compliance and sanctions

You must not make inventory available on any media that violates, or promotes the violation of, any applicable law, rule, or regulation in any relevant jurisdiction. You must not make inventory available where that inventory, or its owner, publisher, or supplier, is subject to sanctions under: (i) the laws of Singapore (including sanctions regulations administered under Singapore's United Nations Act 2001 and related subsidiary legislation, and, where applicable, the Strategic Goods (Control) Act 2002; (ii) United Nations Security Council resolutions; (iii) the United States Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list and related programmes; (iv) EU restrictive measures; (v) India's Foreign Exchange Management Act (FEMA) and related OFAC-equivalent restrictions; or (vi) any other applicable sanctions regime. You must not make inventory available where the publisher has been designated as a disinformation source by a competent authority.

You must not make available inventory on any media that includes content for which you lack the legal right or authority.

10. Privacy, consent, and data protection

You must disclose clearly and, where required by applicable law, obtain valid consent for any data collection, sharing, and use that occurs on any Publisher Property as a result of your use of the Helix Services.

In particular, you must provide end users with clear and comprehensible information about, and obtain effective consent for, the use of cookies and similar technologies on the end user's device where that activity occurs through your use of the Helix Services.

You must:

• (a) maintain and publish a privacy policy on every Publisher Property where data collection occurs, disclosing the collection methods used, that data is collected for interest-based and cross-application advertising, the categories of parties with whom data is shared, the categories of data collected, and the purposes of collection;
• (b) transmit valid and accurate consent signals to Helix, including the IAB TCF consent string, the Global Privacy Platform string, or other applicable framework signal;
• (c) not transmit any signal indicating consent where valid consent has not been obtained;
• (d) comply with all applicable privacy and data protection laws in each jurisdiction in which Publisher Properties are made available.
• (e) where Publisher Properties are accessible to users in the European Union or United Kingdom, comply with the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and/or the UK GDPR and PECR.
• (f) where Publisher Properties are accessible to users in the United States, comply with the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) and all applicable US state privacy laws,
• (g) where Publisher Properties are accessible to users in India, comply with India's Digital Personal Data Protection Act 2023 (DPDP Act),
• (h) where Publisher Properties are accessible to users in Singapore, comply with the Personal Data Protection Act 2012 (PDPA), including the Do Not Call provisions where applicable;
• (i) not collect, process, or transmit to Helix any special category / sensitive personal data (as defined under GDPR Art.9, DPDP Act, or equivalent) unless expressly authorised by Helix in writing and a valid legal basis exists;
• (j) cooperate with Helix in responding to data subject access requests, erasure requests, and regulatory enquiries within the timelines required by applicable law.

The Helix Services are also subject to the Helix Services Privacy Policy.

11. Children's inventory

11.1 Publisher Properties must not be directed toward children (defined as individuals under the age of 13 in the United States under COPPA, under 13 in the United Kingdom under the Data Protection Act 2018, s.9 (which sets the UK's own digital consent age below the GDPR default), under 16 in the European Union under GDPR Art.8 unless a lower age (no lower than 13) applies under the relevant EU member state's implementing law, or under the age specified by applicable law in any other jurisdiction).

11.2 If, despite the foregoing prohibition, any Publisher Property is or becomes directed toward children or is likely to be accessed by children:

• (a) you must immediately notify Helix and set the RTB child-directed flag on all associated bid requests;
• (b) you must not transmit any persistent identifier, precise location data, advertising ID, or other personal data in connection with such inventory;
• (c) you must not enable interest-based or behavioural advertising on such inventory;
• (d) you must comply with the US Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code (Children's Code), GDPR Art.8, India's DPDP Act provisions on children, and any other applicable child-protection legislation; and
• (e) you must exclude such inventory from the Helix bid stream unless Helix has provided express written authorisation with specific child-safe demand sources identified.

11.3 Helix reserves the right to refuse, suspend, or terminate any inventory that it reasonably believes may be child-directed, without prior notice.

12. Invalid and fraudulent traffic

You must not use, and must not permit the use of, any mechanical, computerised, fraudulent, deceptive, or otherwise invalid or artificial means of increasing viewership, engagement, impressions, usage, or any other measure of traffic, directly or indirectly, on any Publisher Property (individually and collectively, "User Engagements"). Prohibited means and methods include, without limitation:

• (a) bots, robots, malware, automated view- or engagement-generating tools, or similar programs
• (b) third-party services generating views or engagements through repeated manual clicks or automated means, including paid-to-view or paid-to-surf services
• (c) placeholders or transparently-rendered placements, as opposed to fully visible placements capable of attracting organic user interaction
• (d) masking or cloaking a Publisher Property's URL, or any other means of obscuring the true source of traffic
• (e) domain spoofing or misrepresentation of the inventory source
• (f) automated query tools, computer-generated search requests, inappropriate link baiting, or improper search engine optimisation services
• (g) purchased traffic driven to pages displaying placements
• (h) auto-spawning of browsers, automatic redirection of visitors, blind or misleading text links, forced clicks
• (i) toolbars, adware, or similar applications generating User Engagement through pop-ups, redirection, browser modification, or interference with navigation
• (j) spam or other unsolicited or unlawful communications
• (k) inappropriate newsgroup, comment, microblog, or similar postings
• (l) purchase of keywords infringing trademark rights in order to drive traffic
• (m) keyloggers and monitoring software
• (n) proxy avoidance tools and anonymisers
• (o) spyware and adware

Helix will determine, in its sole discretion, whether any device or technology operates in a manner that generates valid User Engagement, and may disqualify any User Engagement generated by means or methods that it determines to be invalid or prohibited.

Where valid or organically generated User Engagements are co-mingled with views or engagements resulting from prohibited methods, whether or not intentionally, Helix may determine in its sole discretion that all such User Engagements — both valid and invalid — are disqualified.

Helix uses MRC-accredited vendors in making determinations regarding User Engagements, and reserves the right to change or supplement those vendors at any time. You agree to comply with all applicable IAB standards.

Where User Engagements are disqualified, Helix may withhold, cancel, or recover any amount paid or payable in respect of them, whether before or after payment has been made. Notwithstanding the foregoing, where Helix seeks to recover amounts already paid to you, such recovery must be initiated within one hundred and eighty (180) days of the date on which the relevant payment was made, unless the invalid traffic is attributable to fraud or intentional misconduct by you or your agents, in which case no time limit applies.

13. Responsibility for third-party conduct

You are responsible for any activity originating from the IP addresses of Publisher Properties, or from any computer, server, or cloud-based service owned, used, contracted, or otherwise controlled by you.

You must contractually bind all third-party partners — including affiliates, sub-publishers, resellers, and SDK providers — to comply with this Policy. Failure to control partner conduct may result in disqualification of your inventory.

It is your responsibility to ensure that no advertising network, affiliate, or other person or entity engages in any prohibited means or method in relation to any Publisher Property. Helix has no obligation or liability to you, or to any other person, where User Engagements are invalidated, amounts owing or payable are withheld or cancelled, or your account is disabled as a result of such activities — even where those activities are subsequently found to have been caused by a third party.

14. Enforcement and termination

14.1 Failure to adhere to this Policy may result in:

• (a) Warning — written notice identifying the violation, with a remediation period;
• (b) Restriction — suspension of specific Publisher Properties, ad units, or inventory types;
• (c) Suspension — suspension of monetisation or account access pending investigation;
• (d) Withholding — withholding, cancellation, or recovery of amounts that would otherwise be payable to you;
• (e) Termination — permanent termination of your account and agreement.

Helix reserves the right to apply any of the above measures in any order, and to suspend, disable, or terminate any account at any time, in its sole discretion. The measure applied will depend on the severity and recurrence of the violation, but Helix is not obliged to apply measures sequentially and may proceed directly to suspension or termination where the violation is severe.

Enforcement action does not limit any other right or remedy available to Helix under your agreement or at law.

14.2 Appeal process.

Where enforcement action is taken under this clause, you may submit a written appeal to supply@thehelix.media within fourteen (14) calendar days of receiving notice of the action. Helix will review the appeal and respond within thirty (30) calendar days. Helix's decision on appeal is final. The submission of an appeal does not suspend any enforcement measure already in effect.

15. Reporting violations

If you become aware of any violation of this Policy, or of any undesired or malicious advertising serving on your inventory, contact us at supply@thehelix.media.

16. Relationship to your agreement

This Policy is incorporated into and forms part of the agreement between you and Helix. Any capitalised term not defined in this Policy has the meaning given in that agreement. "Agreement" means all documents signed or accepted between you and Helix, including as applicable any advertising services agreement, master services agreement, insertion order, and any addendum or amendment to them.

Where this Policy conflicts with the Agreement, the Agreement prevails.

"Personal data" (and equivalent terms such as "personal information") has the meaning given under the data protection law applicable in the relevant jurisdiction, including GDPR Art.4(1), the PDPA s.2, the DPDP Act s.2(t), and the CCPA/CPRA, as context requires. Where these definitions differ, you must comply with whichever is the broadest definition applicable to the relevant data.

17. Changes to this Policy

Helix may update or modify this Policy at any time, in its sole discretion. For material changes (including changes to prohibited content categories, privacy obligations, or enforcement procedures), Helix will provide at least fourteen (14) calendar days' advance notice by email to the address associated with your account or by prominent notice on the Helix publisher dashboard. For non-material changes, updates take effect when posted and the "last updated" date will be revised accordingly. It is your responsibility to ensure that you adhere to this Policy, including any updates. Your continued use of the Helix Services after the effective date of any change constitutes acceptance of the revised Policy.

18. Contact

Xapads Media Pte. Ltd.

7 Temasek Boulevard, #12-07, Suntec Tower One

Singapore 038987

UEN: 201729601K

Supply enquiries and policy violations: supply@thehelix.media

Legal notices: legal@thehelix.media

Data protection enquiries: dpo@thehelix.media

Enforcement appeals: supply@thehelix.media

19. Data processing roles and responsibilities

19.1 For the purposes of applicable data protection law:

• (a) where personal data is collected by you on Publisher Properties and transmitted to Helix in the bidstream, you and Helix each act as independent controllers of that data (each determining its own purposes and means of processing);
• (b) neither party is a processor of the other in respect of bidstream data;
• (c) where Helix processes personal data solely on your behalf and under your instructions (e.g., first-party audience data you upload for targeting), Helix acts as a processor and the parties shall enter into a Data Processing Agreement in accordance with GDPR Art.28 or equivalent applicable law.

19.2 Each party shall maintain appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

19.3 In the event of a personal data breach (as defined under GDPR Art.4(12) or equivalent applicable law) affecting data transmitted between you and Helix, the party that becomes aware of the breach must notify the other party without undue delay and in any event within 48 hours of becoming aware, providing sufficient detail to enable the other party to meet its own regulatory notification obligations.

19.4 You represent and warrant that you have a lawful basis under applicable data protection law for any personal data you transmit to Helix in connection with the Helix Services, and that such transmission does not violate any applicable law, regulation, or third-party right.

20. International data transfers

20.1 Personal data transmitted by you to Helix may be transferred to and processed in Singapore. You acknowledge and agree to such transfers;

20.2 Personal data originating from the EU/EEA or UK is transmitted to Helix, the parties shall ensure that an appropriate transfer mechanism is in place (e.g., EU Standard Contractual Clauses (Module 1: Controller to Controller), UK International Data Transfer Agreement, or an adequacy decision);

20.3 You must not transmit personal data to Helix from any jurisdiction where such transfer would violate applicable data protection law without first ensuring an adequate transfer mechanism is in place and notifying Helix in writing;

20.4 Because Helix processes personal data using infrastructure located in India, Helix is itself a data fiduciary for the purposes of India's Digital Personal Data Protection Act 2023 in respect of that processing, independent of the position of any publisher. Depending on the volume and sensitivity of personal data processed and the number of data principals affected, Helix may be liable to be notified by the Central Government as a "Significant Data Fiduciary," which carries additional obligations (including appointment of a data protection officer based in India, periodic data protection impact assessments, and independent data audits). This clause does not reduce your own obligations under clause 10.

21. Governing law

This Policy is governed by and construed in accordance with the laws of the Republic of Singapore, without reference to its choice of law rules. Any dispute arising under this Policy shall be resolved in accordance with the dispute resolution mechanism set out in your Agreement with Helix.

Nothing in this clause limits a data subject's statutory rights of complaint or action under applicable data protection law, including the right to lodge a complaint with a supervisory authority or to bring proceedings in the courts of their habitual residence.