Privacy policy

The “Website” refers to the website(s) at www.variant3d.io, and their subdomains, and related domains. This Website is owned or operated by Global Apparel Partners, Inc. DBA Variant3D and/or its affiliates and subsidiary companies (collectively the "COMPANY"). This privacy policy ("Privacy Policy") applies to information that you provide to COMPANY or is collected about you via this Website and/or by your use of services (collectively, the "Services") that may be provided by this Website or by the COMPANY via some other means, including as set forth below and as defined in the applicable Terms and Conditions (which may also be found under the link labeled “Terms” on the Website) or other terms.

This Privacy Policy is intended to provide you notice of COMPANY's information management practices, including the types of information gathered, how it is used and safeguarded, and the degree to which you may control the maintenance and sharing of your information. Your use of any COMPANY Service or Website constitutes acceptance of and agreement to this Privacy Policy and any other applicable terms. This Privacy Policy is part of and incorporated by reference into the Terms and Conditions for this Website. Certain terms used herein are defined in the Terms and Conditions.

“Users” refer to users of the Websites and Services. Because the Websites and Services are intended to facilitate marketing and transactions among its Users, personally identifiable information that you provide or is provided about you, such as but not limited to your name, company name, shipping address, billing address, telephone numbers, e-mail address, and payment information such as billing terms may be shared with other Users. Information such credit card information is only shared with parties associated with you or as needed to facilitate a transaction you have agreed to.

For the purposes of EU data protection laws (“EU Data Protection Law”), COMPANY is a data controller (i.e., the COMPANY is responsible for, and controls the processing of, your personal data). In providing our Service and the Website, our customers may upload data to us, which may include personal information or data about our customers’ end users (all of which we call “Customer Data”). Customer Data is owned and controlled by our customers, and any Customer Data that we maintain or process we consider to be strictly confidential. We collect and process Customer Data solely on behalf of our customers, and in accordance with our agreements with the customers. We do not use or disclose Customer Data except as authorized and required by our customers and as provided for in our agreements with our customers, such as the Terms and Conditions and this Privacy Policy.

When you create a User Account or accept one, you are agreeing to be subscribed to our e-mail newsletters, if any. You may also be asked for other information at the same or later time.

In order to use the COMPANY’s Services, you will need to register and create, or otherwise accept, a user account ("User Account"). Note that when you log into a User Account, you are agreeing to be bound by this Privacy Policy and the Terms and Conditions, and are also “accepting” your User Account. There may or may not be a cost to create a User Account. You may be asked to choose a user name, screen name, or member name (each, a "User Name") and password. You may also be asked to provide certain personally identifiable information and other information about yourself, such as your first and last name, company name, billing and shipping address, telephone number, and e-mail address. The Website allows you to update certain information when you are logging in.

This Privacy Policy does not apply to any information you may disclose publicly in such Services. In some instances, you may choose to create a "Public Profile" that will be available to others on the Internet. Public Profiles are managed entirely by you, and you are solely responsible for your Public Profile's content and its "public" or "private" status. The COMPANY bears no responsibility for any action or policies of any third parties who collect any information that users may disclose in user forums or other public areas of this Website. You are also responsible for maintaining and updating the registration information in your User Account with current and complete information.

You can unsubscribe from receiving marketing e-mails from the Website by clicking the link contained within such e-mails sent to you. You cannot unsubscribe from receiving correspondence regarding non-marketing e-mails, including but not limited to correspondence with parties involved in a transaction with you, or emails with the COMPANY regarding your User Account and activities on or through the Website.

You should be aware that it is not always possible to completely remove or modify information in our databases. In addition, we may institute a policy in which User information is deleted after a certain amount of time, and therefore, your User information may no longer exist in the COMPANY's active database(s). Even if you choose to unsubscribe or otherwise modify your User Account settings, the COMPANY reserves the right to contact you regarding your account and your use of this Website and/or the Services.

To participate in some Services such as sweepstakes, contests and surveys ("Special Promotions"), or to make online purchases or subscriptions (such purchases or subscriptions herein referred to as "Purchases"), you may need to provide personally identifiable information, such as name, address, e-mail address, phone number, and date of birth. Your information may be collected by COMPANY or by a third party, such as a co-sponsor or a vendor involved in, or providing services in connection with, a Special Promotion, or an e-commerce partner in the case of a Purchase.

If you make a Purchase or enter a sweepstakes or other Special Promotion on one of our sites or through our Services, the COMPANY will collect your personally identifiable information, and you are deemed to consent to us providing your information to third parties who provide certain services such as processing of credit card transactions, customer service, promotion or sweepstakes administration, order fulfillment and/or prize delivery, as applicable. (As more fully described below in Section XII, these third parties are generally prohibited from using this information for their own marketing purposes and/or from sharing, selling, or otherwise distributing any personal data of our customers, unless you choose to opt in for such additional uses and/or disclosure by the third parties, under their respective privacy policies.). Also, by entering a sweepstakes or other Special Promotion, you are agreeing to the official rules that govern that sweepstakes or other Special Promotion, which may contain specific provisions applicable to you, including, except where prohibited by law, allowing the sponsor(s) of the promotion to use your name, voice or likeness in advertising or marketing associated with the promotion.

If you make a purchase or enter a promotion (such as a sweepstakes) in which the COMPANY is participating on a third party's website (or through some other means or medium), we will collect your information from the third party only if you opt-in to receive additional communications from us, or we are required to fulfill some function in relation to your activity (e.g., to send your order or deliver a prize).

If you submit to the Website a comment, photograph or other content to be published, online or offline (including on-air, in a DVD, or any other format), we may publish your name or other personally identifiable information in connection with publishing the content and you are hereby deemed to give us permission to do such.

‍

In some situations, we may also collect personally identifiable information and other information about you through other means, directly or indirectly. For example, if you access any COMPANY content, or purchase such content via your wireless carrier or through another third party, the COMPANY may collect information directly from you or through the third party. Likewise, if you use our software, or provide information to other companies who share information about their customers, we may collect additional information about you. In each of these cases, the COMPANY will apply this Privacy Policy to any personally identifiable information.

Some COMPANY Websites and Services may ask you to submit personally identifiable, as well as other information about other people and/or their affiliated companies. Such information may be used to facilitate transactions among those people, and third parties. As such, such information may be shared and used by all such parties to the extent the COMPANY desires or otherwise allows such information to be shared. You are hereby accepting and agreeing to such use and sharing of information.

Some Services may offer support and technical assistance through customer service centers via telephone, online chat, or e-mail. Whenever you communicate with customer service, you do so with the understanding that an operator may view and make changes to the information in your User Account in order to provide the assistance that you need.

As part of the registration process for some Services, you may be asked to provide information that does not personally identify you. For example, you may be asked to provide information concerning your personal preferences, purchasing habits, and the like. This information is generally optional but may be included in your User Account profile. COMPANY requests this information to understand you better and to also bring to your attention new services, programs, or offers that may be of interest to you.

In many cases, COMPANY will automatically collect certain non-personally identifiable information about your use of the Websites and Services. COMPANY might collect, among other things, information concerning the type of Internet browser or computer operating system you are using, the domain name of your Internet service provider, your "click path" through the COMPANY sites or "click-through" from an e-mail, the Website or advertisement that was linked to or from the COMPANY site when you visited, and your IP address. To do this, COMPANY may use cookies and other technology (see below). If you are using any Services of ours that are wireless, we may also automatically collect information such as the type of wireless device you are using, your mobile identification number (assigned by your telecommunications carrier) and telecommunications carrier. Your use of our Websites and Services, and information provided through these technologies, will be anonymous unless you provide us with personally identifiable information, have provided such information in the past, or have a User Account.
Information that is in a form that is anonymized, or is otherwise not capable of being associated with you or cannot identify you, is not considered personal data, and as such the COMPANY reserves the right to use and share such data in its discretion without the limitations set forth in this Privacy Policy. You may choose not to provide the COMPANY with personal data, but then you may not be able to fully take advantage of certain features of our Services and we may not be able to provide you with certain requested information, products and/or services.

This Website's pages or e-mail messages may contain cookies, web beacons (also known as clear gifs), or similar technologies as they become available. Cookies are information files that this Website may place on your computer to provide extended functionality. The COMPANY may use cookies for a number of purposes, such as tracking usage patterns on the Website, measuring the effectiveness of advertising, limiting multiple responses and registrations, facilitating your ability to navigate the Website, providing advertising to you about our products and services or those of third parties on the Website or other websites, and/or as part of a verification or screening process. Most browsers are initially set up to accept cookies. Most browsers will allow you to erase cookies from your computer hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. You should refer to your browser instructions, "Help" screen, or similar such resource to learn more about how to manage cookies and possibly reset your browser to refuse all cookies or to indicate when a cookie is being sent by indicating this in the preferences, options, or similar such menu in your browser. However, it is possible that some parts of this Website will not operate correctly if you disable cookies and you may not be able to take advantage of some of this Website's features. You should consult with your browser's provider/manufacturer if you have any questions regarding disabling cookies.

The COMPANY’s web pages may include advertisements for third parties and their products, and those third-party advertisements may include a cookie or web beacon served by the third party. The COMPANY does not control cookies in such third-party ads, and visitors are encouraged to check the privacy policies of advertisers and/or ad services to learn about their use of cookies and other technology. The COMPANY's Privacy Policy does not cover the use of information collected from you by third party ad servers. These companies may use information (not including your name, address, e-mail address or telephone number) about your visits to this and other Websites in order to provide advertisements on this site and other sites about goods and services that may be of interest to you.

A web beacon is a small graphic image that allows the party that set the web beacon to monitor and collect certain information about the viewer of the web page, web-based document or e-mail message, such as the type of browser requesting the web beacon, the IP address of the computer that the web beacon is sent to and the time the web beacon was viewed. Web beacons can be very small and invisible to the user, but, in general, any electronic image viewed as part of a web page or e-mail, including HTML based content, can act as a web beacon. The COMPANY may use web beacons to count visitors to the web pages on the Website or to monitor how our users navigate the Website, and the COMPANY may include web beacons in e-mail messages in order to count how many messages sent were actually opened, acted upon or forwarded.

COMPANY recognizes the sensitivity of personally identifiable information concerning children and minors. COMPANY is committed to complying with all applicable laws and regulations regarding children, including the Children's Online Privacy Protection Act ("COPPA"). This site is only intended for persons 18 and over. If you are under 18 years of age, immediately discontinue use of this site and leave this Website. The COMPANY will not knowingly collect, maintain, or disclose any personally identifiable information from a person under 18.
If you are a parent or guardian who has discovered that your child under the age of 18 has submitted his or her personally identifiable information without your permission or consent, COMPANY will make reasonable efforts to remove the information from its active list, at your request. To request the removal of your child's information, please send an e-mail to privacy@variant3d.io and be sure to include in your message the same User Name and password and/or e-mail address that your child submitted.

a. Non-Personally Identifiable Information.
From time to time, COMPANY may use and share with third parties aggregate, non-personally identifiable User information to show general demographic and preference information among users of the COMPANY Web sites. For example, the COMPANY may produce and share with others “trend reports” using such aggregate, non-personally identifiable User information, generated based on information gathered on Users from order information (i.e. products purchased, amount spent, type of product, general addresses to be shipped to etc), retailer information related to purchases (i.e. type of retailer and their buying habits) and brand information (i.e. type of product a manufacturer or brand showcases).

‍
When you visit or download information from this Website, our web servers may automatically collect website usage information. Website usage information is non-personally identifying information that describes how our visitors use the Website. It can include the number and frequency of visitors to each web page and the length of their stays, browser type, referrer data that identifies the web page visited prior and subsequent to visiting the Website, and IP addresses (see below for more information on IP addresses). COMPANY may use IP addresses for a number of purposes, such as system administration, to generally determine your computer's server location, to report aggregate information to our business partners or to audit use of the Website. We also may determine your screen resolution and the technology available in order to serve you the most appropriate version of a web page, e-mail or similar service.
b. Personally Identifiable Information.
COMPANY uses information about you to deliver the Services that you request, to keep you informed about changes affecting our Services or your account, to inform you of other Services or offers in which you might be interested, and to improve and enhance our sites and Services. If you provide COMPANY with personally identifiable information, we will take all reasonable and appropriate steps to protect it from unauthorized disclosure.

When you create a User Account or accept one, you are opting in to receive e-mail from us. You can always opt out of future marketing messages by following the directions in each message to "unsubscribe”. However, if you choose to opt out of marketing messages, we reserve the right to contact you regarding your account status, technical support, product information, changes to account terms, and any other matter that might affect our service to you and/or any products you purchased from us or registered with us, as applicable.

As stated in the Terms and Conditions, you will be deemed to have consented to the disclosure to, and use by, a subsequent owner or operator of a COMPANY Website or Service, of any information about you contained in the applicable COMPANY database, if COMPANY or one of its companies assigns its rights and obligations regarding any of your information at the time of a merger, acquisition, or sale of all or substantially all of COMPANY's or such COMPANY company's assets related to the applicable site or Service to a subsequent owner or operator. In the event of such a merger, acquisition, or sale, your continued use of the Website or any related Service signifies your agreement to be bound by the Terms and Conditions and Privacy Policy of the Website's or Service's subsequent owner or operator.

The COMPANY and other entities may work together in order to provide portions of the COMPANY Websites and some Services (e.g., to fulfill prizes won in a sweepstakes, or to provide other support for a Service). These companies will handle your personally identifiable information in accordance with this Privacy Policy.

As stated above in Section V, COMPANY may also work with third parties to provide some Services on our Websites. In connection with those Services, you are deemed to consent to us sharing your information with third parties who provide services such as processing of credit card transactions, customer service, promotion administration, order fulfillment and/or prize delivery, as applicable. Third parties who provide, or participate in, Services on COMPANY Websites are prohibited from using our customers' personally identifiable information for marketing purposes and/or from sharing, selling, or otherwise using such information, unless you choose to opt in to marketing, sharing, or other uses by the third parties. If you do not want your information to be used for marketing (or other purposes unrelated to the provision of COMPANY Services) by a third party who participates in a Service on one of our sites, do not opt in to such use by that third party when you register to participate in the Service.

Please note that whenever you opt in to receive future communications from a third party, your information will be subject to the third party's privacy policy. If you later decide that you do not want that third party to use your information, you will need to contact the third party directly, as we have no control over how third parties use information. You should always review the privacy policy of any party that collects your information to determine how that entity will handle your information. COMPANY will not share, sell, rent, or disclose any personally identifiable information that we have collected except as stated herein, or in the following instances: 1) we have been given your consent to disclose; 2) we have previously informed you of the disclosure, including by means of our Privacy Policy or on the Website, or through the Service where you provided your information; 3) we are required by law, legal process, or court order to disclose; 4) disclosure is necessary to identify, contact, or bring legal action against someone who may cause or be causing harm to, or interference with, COMPANY's rights or property, other COMPANY Website users, or anyone else; or 5) to respond to an inquiry, request or complaint that you have made. COMPANY may also use IP addresses in cooperation with Internet service providers to identify users if we deem it necessary to comply with law, to enforce compliance with this Privacy Policy or our Terms and Conditions, or to protect our sites, customers, or others.
c. Information Disclosed to other Users of this Website.
The Services of the Website may include functionality that may allow you i) to market or advertise your services or items you wish to sell, ii) view information about or contact others about the services or items they wish to sell, and/or iii) transact with others. When you seek to market or advertise the services or items you wish to sell, you are consenting that information related to such services or items, as well as your identity and contact information, will be shared publicly with other users of the Website. When you seek to contact others about the services or items they wish to sell, you are consenting that information about you, such as your interests, preferences, identity and contact information, will be shared with those you are seeking to contact. When you seek to transact with others, your communication will be shared with those you are seeking to transaction with, as well as your identity and contact information.
d. Control Over Your Information; Special Notes Regarding the EU and Switzerland.
i) Modifying Account Information. If you have an User Account with us, you have the ability to modify certain information in your account (e.g., your contact information) through “profile,” “account,” “settings,” or “preferences” options provided on the Website. If you have any questions about modifying or updating any information in your account, please contact using the contact details as described in Section XVI below. Please note that COMPANY does not own or control the Customer Data uploaded to our Service by our customers, and cannot modify or delete Customer Data except at the request of our customer, or as permitted by our Terms and Conditions.

ii) Email Communications. See Section IV.

iii) For Residents in the EU and Switzerland.
If you are located in the EU or Switzerland, you have the following rights in respect of your personal data that we hold:
a) Right of access. The right to obtain access to your personal data;
b) Right to rectification. The right to obtain rectification of your personal data without undue delay where that personal data is inaccurate or incomplete;
c) Right to erasure. The right to obtain the erasure of your personal data without undue delay in certain circumstances, such as where the personal data is no longer necessary in relation to the purposes for which it was collected or processed;
d) Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal data in certain circumstances, such as where the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of that personal data;
e) Right to portability. The right to portability allows you to move, copy or transfer personal data easily from one organization to another; and
F) Right to object. You have a right to object to processing based on legitimate interests and direct marketing.

If you wish to exercise one of these rights, please contact us using the contact details described in Section XVI below.

You also have the right to lodge a complaint to your local data protection authority. Further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

‍

While the COMPANY takes reasonable and appropriate precautions to protect your personally identifiable information from unauthorized disclosure and to prevent possible security breaches in our Websites, Services, and customer databases, no website, Internet transmission, computer system, or wireless connection is completely secure. Consequently, COMPANY cannot guarantee that unauthorized access, hacking, data loss, or other breaches will never occur. Your use of the COMPANY Websites and Services is at your own risk. COMPANY urges you to take steps to determine what information you will submit to the Website, keep your information safe by memorizing your password or keeping it in a safe place (separate from your account information), logging out of your User Account, and closing your Web browser.

Whenever you give COMPANY sensitive or confidential information (for example, credit card numbers for Purchases), COMPANY will take commercially reasonable steps to protect the transmission of such information by establishing a secure connection with your Web browser. COMPANY employs a security technology known as a secure-socket-layer ("SSL") to protect the transmission of payment information to the site. Unless otherwise specified herein or on the Website where you make a Purchase, credit and debit card numbers are used only for payment processing and are not retained for marketing purposes.

COMPANY sites may frame, and/or contain links to, or advertisements about, non-COMPANY Web sites. Other sites may also reference, advertise, or link to COMPANY Websites. COMPANY does not endorse or sponsor other websites, is not responsible for the privacy practices or the content of non-COMPANY sites, expressly disclaims any statements or assertions made on such websites, and denies and disclaims all liability associated with your use of, and the content on, such other sites and advertisements.

By providing any personally identifiable information to COMPANY, all users, including, without limitation, users in the member states of the European Union (“EU”), fully understand and unambiguously consent to this Privacy Policy and to the collection, storage, and processing of such information in the United States of America.

Regarding processing of your persona data in the EU, the purposes for which we may do so are:
i) The provision of personal data by you may be necessary for the performance of any contractual relationship we have with you;
ii) Where it is necessary for compliance with our legal obligations laid down by EU law;
iii) Where in our legitimate interests (provided these are not overridden by your interests and fundamental rights and freedoms – this includes our own legitimate interests and those of other entities and branches in our group of companies) such as:
a) to contact you and respond to your requests and enquiries;
b) for business administration, including statistical analysis;
c) to provide the Services and the Website to you;
d) for fraud prevention and detection; and
e) to comply with applicable laws, regulations or codes of practices.

We may also process your personal data on the basis of your freely given, specific, informed and unambiguous consent. You should be aware that you are entitled under the EU Data Protection Law to withdraw your consent where that has been given, at any time. If you do this and we have no alternative lawful reason to process your personal data, this may affect our ability to provide you with rights to use the Services and the Website.

COMPANY is dedicated to protecting your personally identifiable information and welcomes comments and questions on this Privacy Policy. You may e-mail your questions or comments to:
Privacy@variant3d.io
Please note that information submitted to the Website via a "contact us," "help" or other similar e-mail address or form will not necessarily receive a response. We will not use the information provided to these e-mail addresses or forms for marketing purposes unrelated to your request.

COMPANY reserves the right to change this Privacy Policy and its Terms and Conditions at any time. In case of any material change to the Privacy Policy, we will replace the "Privacy Policy" link on the home page of our sites with a link entitled "Updated Privacy Policy" for no less than 30 days. All changes to the Privacy Policy will be effective when posted, and your continued use of any COMPANY Website or Service after the posting will constitute acceptance of, and agreement to be bound by, those changes.

COMPANY is dedicated to protecting your personally identifiable information and welcomes comments and questions on this Privacy Policy. You may e-mail your questions or comments to:
Privacy@variant3d.io
Please note that information submitted to the Website via a "contact us," "help" or other similar e-mail address or form will not necessarily receive a response. We will not use the information provided to these e-mail addresses or forms for marketing purposes unrelated to your request.

A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes ("California customer") is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes. In general, if the business has made such a disclosure of personal information, upon receipt of a request by a California customer, the business is required to provide a list of all third parties to whom personal information was disclosed in the preceding calendar year, as well as a list of the categories of personal information that were disclosed.

However, under the law, a business is not required to provide the above-described lists if the business adopts and discloses to the public (in its privacy policy) a policy of not disclosing customer's personal information to third parties for their direct marketing purposes unless the customer first affirmatively agrees to the disclosure, as long as the business maintains and discloses this policy. Rather, the business may comply with the law by notifying the customer of his or her right to prevent disclosure of personal information and providing a cost free means to exercise that right.

As stated in our Privacy Policy, we do not share information with third parties for their direct marketing purposes unless you affirmatively agree to such disclosure, typically by opting in to receive information from a third party that is participating in a sweepstakes or other promotion on one of our sites. If you do ask us to share your information with a third party for its marketing purposes, we will only share information in connection with that specific promotion, as we do not share information with any third party on a continual basis. To prevent disclosure of your personal information for use in direct marketing by a third party, do not opt in to such use when you provide personally identifiable information on one of our sites. Please note that whenever you opt in to receive future communications from a third party, your information will be subject to the third party's privacy policy. If you later decide that you do not want that third party to use your information, you will need to contact the third party directly, as we have no control over how third parties use information. You should always review the privacy policy of any party that collects your information to determine how that entity will handle your information.

California customers may request further information about our compliance with this law by e-mailing Privacy@variant3d.io. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this e-mail address.

1. Background

1.1 “Customer” refers to “You”, a user of the Website, as referenced in the Terms and Conditions.

1.2 In the event that we Process any Customer Personal Data (each as defined below) and (i) the Customer Personal Data relates to Data Subjects (as defined below) located in the EEA; or (ii) you are established in the EEA, this Data Processing Addendum (the “DPA“) shall apply to the processing of such Customer Personal Data.

1.3 In the event of a conflict between any of the provisions of this DPA and the remaining provisions of the Terms and Conditions (including as the incorporate the Privacy Policy), the provisions of this DPA shall prevail.

1.4 Each party will comply with all applicable requirements of the Data Protection Laws (as defined below). This DPA is in addition to, and does not relieve, remove, or replace, either party’s obligations under the Data Protection Laws.

1.5 The Customer and COMPANY acknowledge that for the purposes of the Data Protection Laws, the Customer is the Controller and COMPANY is the Processor.

2. DEFINITIONS
2.1 Unless otherwise set out below, each capitalised term in this DPA shall have the meaning set out in the Terms and Conditions and the following capitalised terms used in this DPA shall be defined as follows:
(a) “Customer Personal Data” means the personal data described in ANNEX 2 and any other personal data that the COMPANY processes on behalf of the Customer in connection with the COMPANY’s provision of the Services or Website;
(b) “Data Protection Laws” means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“GDPR“) and all applicable legislation protecting the fundamental rights and freedoms of persons and their right to privacy with regard to the Processing of Customer Personal Data;
(c) “European Economic Area” or “EEA” means the Member States of the European Union together with Iceland, Norway, and Liechtenstein;
(d) “Party” means each of the Customer and the COMPANY;
(e) “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Customer Personal Data;
(f) ”Standard Contractual Clauses” means the Standard Contractual Clauses (processors) approved approved by European Commission Decision C(2010)593 set out in ANNEX 1 to this DPA or any subsequent version thereof released by the European Commission (which will automatically apply), and which includes ANNEX 2 (Details of the Processing) and ANNEX 3 (Technical and Organisational Measures) to this DPA;
(g) “Subprocessor” means any Processor engaged by the COMPANY who agrees to receive from the COMPANY any Customer Personal Data;
(h) “Terms” shall refer to the Terms and Conditions of the Website, of which the Privacy Policy and this DPA are incorporated into; and
(i) the terms “personal data“, “Controller“, “Processor“, “Data Subject“, “Process” and “Supervisory Authority” shall have the same meaning as set out in the GDPR.

3. DATA PROCESSING
3.1 Instructions for Data Processing. The COMPANY will only Process Customer Personal Data in accordance with (a) the Terms (including this DPA), to the extent necessary to provide the Service to the Customer, and (b) the Customer’s written instructions, unless Processing is required by European Union or Member State law to which the COMPANY is subject, in which case the COMPANY shall, to the extent permitted by applicable law, inform the Customer of that legal requirement before Processing that Customer Personal Data. The Terms (including this DPA) (subject to any changes to the Service agreed between the Parties) shall be the Customer’s complete and final instructions to the COMPANY in relation to the processing of Customer Personal Data.

3.2 Processing outside the scope of the Terms (including this DPA) will require prior written agreement between the Customer and the COMPANY on additional instructions for Processing.

3.3 Required consents. Where required by applicable Data Protection Laws, the Customer will be responsible for ensuring that all Data Subjects have given/will give all necessary consents for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms.

3.4 Privacy notices. Customer warrants and represents that
(a) it has provided all applicable notices to Data Subjects required for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms; or
(b) in respect of any Customer Personal Data collected by the COMPANY on behalf of the Customer, it has reviewed and confirmed the notices provided by the COMPANY to Data Subjects as accurate and sufficient for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms.

4. TRANSFER OF PERSONAL DATA
4.1 Authorised Subprocessors. The Customer agrees that COMPANY may use each of the subcontractors as a Subprocessor to Process Customer Personal Data.

4.2 The Customer agrees that the COMPANY may use subcontractors to fulfil its contractual obligations under the Terms. The COMPANY shall notify the Customer from time to time of the identity of any Subprocessors it engages. If the Customer (acting reasonably) does not approve of a new Subprocessor, then without prejudice to any right to terminate the Terms, the Customer may request that the COMPANY moves the Customer Personal Data to another Subprocessor and the COMPANY shall, within a reasonable time following receipt of such request, use all reasonable endeavours to ensure that the Subprocessor does not Process any of the Customer Personal Data.

4.3 Except as set out in Section 1 and 4.2 of this DPA, the COMPANY shall not permit, allow or otherwise facilitate Subprocessors to Process Customer Personal Data without the prior written consent of the Customer and unless the COMPANY enters into a written agreement with the Subprocessor which imposes the same obligations on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on the COMPANY under this DPA.

4.4 Liability of Subprocessors. The COMPANY shall at all times remain responsible for compliance with its obligations under the DPA and will be liable to the Customer for the acts and omissions of any Subprocessor approved by the Customer as if they were the acts and omissions of the COMPANY.

4.5 International Transfers of Personal Data. To the extent that the Processing of Customer Personal Data by the COMPANY involves the export of such Customer Personal Data to a country or territory outside the EEA, other than a country or territory ensuring an adequate level of protection for the rights and freedoms of Data Subjects in relation to the Processing of Personal Data as determined by the European Commission, such transfer shall be governed by the Standard Contractual Clauses. In the event of any conflict between any terms in the Standard Contractual Clauses, this DPA and the Terms, the Standard Contractual Clauses shall prevail.

5. DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS
5.1 COMPANY Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the COMPANY shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in ANNEX 3 of this DPA.

5.2 Upon request by the Customer, the COMPANY shall make available all information reasonably necessary to demonstrate compliance with this DPA.

5.3 Security Incident Notification. If the COMPANY or any Subprocessor becomes aware of a Security Incident, the COMPANY will (a) notify the Customer of the Security Incident without undue delay after becoming aware of the Security Incident, (b) investigate the Security Incident and provide such reasonable assistance to the Customer (and any law enforcement or regulatory official) as required to investigate the Security Incident, and (c) take steps to remedy any non-compliance with this DPA.

5.4 COMPANY Employees and Personnel. The COMPANY shall treat the Customer Personal Data as the confidential information of the Customer, and shall ensure that any employees or other personnel of the COMPANY have agreed in writing to protect the confidentiality and security of Customer Personal Data.

6. ACCESS REQUESTS AND DATA SUBJECT RIGHTS
6.1 Data Subject Requests. Except as required (or where prohibited) under applicable law, the COMPANY shall notify the Customer of any request received by the COMPANY or any Subprocessor from a Data Subject in respect of their personal data included in the Customer Personal Data, and shall not respond to the Data Subject.

6.2 The COMPANY shall provide the Customer with the ability to correct, delete, block, access, or copy the Customer Personal Data in accordance with the functionality of the Service.

6.3 Government Disclosure. The COMPANY shall notify the Customer of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any data protection supervisory authority) unless otherwise prohibited by law or a legally binding order of such body or agency.

7. Assistance
7.1 Where applicable, taking into account the nature of the Processing, and to the extent required under applicable Data Protection Laws, the COMPANY shall provide the Customer with any information or assistance reasonably requested by the Customer for the purpose of complying with any of the Customer’s obligations under applicable Data Protection Laws, including:

(a) using all reasonable endeavours to assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising Data Subject rights laid down in the GDPR; and

(b) providing reasonable assistance to the Customer with any data protection impact assessments and with any prior consultations to any Supervisory Authority of the Customer, in each case solely in relation to Processing of Customer Personal Data and taking into account the information available to the COMPANY.

8. Duration and TERMINATION
8.1 Deletion of data. Subject to Section 8.2 of this DPA below, the COMPANY shall, at the Customer’s election and within 90 (ninety) days of the date of termination of the Terms:

(a) delete, and use all reasonable efforts to procure the deletion of, Customer Personal Data Processed by us or any Subprocessors; or
(b) return a complete copy of all Customer Personal Data by secure file transfer in such a format as notified by the COMPANY to the Customer (and delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data Processed by the COMPANY or any Subprocessors). Where this Section 8.1(b) applies, the COMPANY shall not be required to provide a copy of the Customer Personal Data to the Customer).

8.2 The COMPANY and its Subprocessors may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that the COMPANY shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.

Standard Contractual Clauses (processors)
For the purposes of this ANNEX 1, references to the “data exporter” and “data importer” shall be to you and to Company respectively (each a “party”; together “the parties”).

Clause 1
Definitions
For the purposes of the Clauses:
(a) ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
(b) ‘the data exporter’ means the controller who transfers the personal data;
(c) ‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
(d) ‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
(e) ‘the applicable data protection law‘ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
(f) ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2
Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Annex 2 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause
The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter
The data exporter agrees and warrants:
(a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
(b) that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;

(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Annex 3 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
(g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Annex 3, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
(j) that it will ensure compliance with Clause 4(a) to (i).

Clause 5
Obligations of the data importer
The data importer agrees and warrants:
(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in Annex 3 before processing the personal data transferred;
(d) that it will promptly notify the data exporter about:
(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
(ii) any accidental or unauthorised access, and
(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
(f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex 3 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
(h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
(i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;
(j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6
Liability
The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor en tity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction
The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
(a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
(b) to refer the dispute to the courts in the Member State in which the data exporter is established.
2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities
The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9
Governing Law
The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10
Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11
Subprocessing
The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor’s obligations under such agreement.
The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated as needed. The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12
Obligation after the termination of personal data processing services
The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, if requested by the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Details of the Processing of Customer Personal Data

This ANNEX 2 includes certain details of the processing of Customer Personal Data as required by Article 28(3) of the GDPR.

1. Subject matter and duration of the Processing of Customer Personal Data.

The subject matter of the Processing of Customer Personal Data is the use of and access to the Services and/or Website by the Customer in accordance with the Terms.

The duration of the Processing of Customer Personal Data is the term of the Terms, subject to Section 8.2 of this DPA.

2. The nature and purpose of the Processing of Customer Personal Data.

The nature and purpose of the Processing is the Processing of Customer Personal Data provided by the Customer to the COMPANY, or collected by the COMPANY on behalf of the Customer, for the purposes of providing the Services and/or Website to the Customer.

3. The types of Customer Personal Data to be Processed.

The types of Customer Personal Data to be Processed includes the following information relating to employees and other personnel of the Customer, authorised by the Customer to use the Services and/or Website on its behalf, and relating to employees and other personnel of the Customers’ customers: first name and last name; contact information (including email address); usage information, non-traditional identifiers of users, and any other Personal Data the Customer or its users submit to the COMPANY in the course of its use of the Services and/or Website.

4. The categories of Data Subject to whom the Customer Personal Data relates.

Employees and other personnel of the Customer, authorised by the Customer to use the Services on behalf of the Customer, and employees and other personnel of the Customers’ customers.

5. The obligations and rights of the Customer.

The obligations and rights of the Customer are as set out in the Terms (including this DPA).

Technical and Organisational Security Measures

1. The COMPANY maintains internal policies and procedures, or procures that its Subprocessors do so, which are designed to:

(a) secure any personal data Processed by the COMPANY against accidental or unlawful loss, access or disclosure;

(b) identify reasonably foreseeable and internal risks to security and unauthorised access to the personal data Processed by the Controller;

(c) minimise security risks, including through risk assessment and regular testing.

2. The COMPANY will use reasonable efforts to procure that its Subprocessors, conduct periodic reviews of the security of their network and the adequacy of their information security program as measured against industry security standards and its policies and procedures.

3. The COMPANY will use reasonable efforts to procure that its Subprocessors, periodically evaluate the security of their network and associated services to determine whether additional or different security measures are required to respond to new security risks or findings generated by the periodic reviews.