I.

NOTICE

I. Notice.

The “Website” refers to the website(s) at www.variant3d.io, and their subdomains, and related domains. This Website is owned or operated by Global Apparel Partners, Inc. DBA Variant3D and/or its affiliates and subsidiary companies (collectively the "COMPANY"). This privacy policy ("Privacy Policy") applies to information that you provide to COMPANY or is collected about you via this Website and/or by your use of services (collectively, the "Services") that may be provided by this Website or by the COMPANY via some other means, including as set forth below and as defined in the applicable Terms and Conditions (which may also be found under the link labeled “Terms” on the Website) or other terms.


This Privacy Policy is intended to provide you notice of COMPANY's information management practices, including the types of information gathered, how it is used and safeguarded, and the degree to which you may control the maintenance and sharing of your information. Your use of any COMPANY Service or Website constitutes acceptance of and agreement to this Privacy Policy and any other applicable terms. This Privacy Policy is part of and incorporated by reference into the Terms and Conditions for this Website. Certain terms used herein are defined in the Terms and Conditions.

II.

PERSONALLY IDENTIFIABLE INFORMATION THAT WE COLLECT; CUSTOMER DATA
In order to use the COMPANY’s Services, you will need to register and create, or otherwise accept, a user account ("User Account"). Note that when you log into a User Account, you are agreeing to be bound by this Privacy Policy and the Terms and Conditions, and are also “accepting” your User Account. There may or may not be a cost to create a User Account. You may be asked to choose a user name, screen name, or member name (each, a "User Name") and password. You may also be asked to provide certain personally identifiable information and other information about yourself, such as your first and last name, company name, billing and shipping address, telephone number, and e-mail address. The Website allows you to update certain information when you are logging in.


This Privacy Policy does not apply to any information you may disclose publicly in such Services. In some instances, you may choose to create a "Public Profile" that will be available to others on the Internet. Public Profiles are managed entirely by you, and you are solely responsible for your Public Profile's content and its "public" or "private" status. The COMPANY bears no responsibility for any action or policies of any third parties who collect any information that users may disclose in user forums or other public areas of this Website. You are also responsible for maintaining and updating the registration information in your User Account with current and complete information.


You can unsubscribe from receiving marketing e-mails from the Website by clicking the link contained within such e-mails sent to you. You cannot unsubscribe from receiving correspondence regarding non-marketing e-mails, including but not limited to correspondence with parties involved in a transaction with you, or emails with the COMPANY regarding your User Account and activities on or through the Website.


You should be aware that it is not always possible to completely remove or modify information in our databases. In addition, we may institute a policy in which User information is deleted after a certain amount of time, and therefore, your User information may no longer exist in the COMPANY's active database(s). Even if you choose to unsubscribe or otherwise modify your User Account settings, the COMPANY reserves the right to contact you regarding your account and your use of this Website and/or the Services.
To participate in some Services such as sweepstakes, contests and surveys ("Special Promotions"), or to make online purchases or subscriptions (such purchases or subscriptions herein referred to as "Purchases"), you may need to provide personally identifiable information, such as name, address, e-mail address, phone number, and date of birth. Your information may be collected by COMPANY or by a third party, such as a co-sponsor or a vendor involved in, or providing services in connection with, a Special Promotion, or an e-commerce partner in the case of a Purchase.

If you make a Purchase or enter a sweepstakes or other Special Promotion on one of our sites or through our Services, the COMPANY will collect your personally identifiable information, and you are deemed to consent to us providing your information to third parties who provide certain services such as processing of credit card transactions, customer service, promotion or sweepstakes administration, order fulfillment and/or prize delivery, as applicable. (As more fully described below in Section XII, these third parties are generally prohibited from using this information for their own marketing purposes and/or from sharing, selling, or otherwise distributing any personal data of our customers, unless you choose to opt in for such additional uses and/or disclosure by the third parties, under their respective privacy policies.). Also, by entering a sweepstakes or other Special Promotion, you are agreeing to the official rules that govern that sweepstakes or other Special Promotion, which may contain specific provisions applicable to you, including, except where prohibited by law, allowing the sponsor(s) of the promotion to use your name, voice or likeness in advertising or marketing associated with the promotion.

If you make a purchase or enter a promotion (such as a sweepstakes) in which the COMPANY is participating on a third party's website (or through some other means or medium), we will collect your information from the third party only if you opt-in to receive additional communications from us, or we are required to fulfill some function in relation to your activity (e.g., to send your order or deliver a prize).

If you submit to the Website a comment, photograph or other content to be published, online or offline (including on-air, in a DVD, or any other format), we may publish your name or other personally identifiable information in connection with publishing the content and you are hereby deemed to give us permission to do such.
As part of the registration process for some Services, you may be asked to provide information that does not personally identify you. For example, you may be asked to provide information concerning your personal preferences, purchasing habits, and the like. This information is generally optional but may be included in your User Account profile. COMPANY requests this information to understand you better and to also bring to your attention new services, programs, or offers that may be of interest to you.

In many cases, COMPANY will automatically collect certain non-personally identifiable information about your use of the Websites and Services. COMPANY might collect, among other things, information concerning the type of Internet browser or computer operating system you are using, the domain name of your Internet service provider, your "click path" through the COMPANY sites or "click-through" from an e-mail, the Website or advertisement that was linked to or from the COMPANY site when you visited, and your IP address. To do this, COMPANY may use cookies and other technology (see below). If you are using any Services of ours that are wireless, we may also automatically collect information such as the type of wireless device you are using, your mobile identification number (assigned by your telecommunications carrier) and telecommunications carrier. Your use of our Websites and Services, and information provided through these technologies, will be anonymous unless you provide us with personally identifiable information, have provided such information in the past, or have a User Account.
Information that is in a form that is anonymized, or is otherwise not capable of being associated with you or cannot identify you, is not considered personal data, and as such the COMPANY reserves the right to use and share such data in its discretion without the limitations set forth in this Privacy Policy. You may choose not to provide the COMPANY with personal data, but then you may not be able to fully take advantage of certain features of our Services and we may not be able to provide you with certain requested information, products and/or services.
This Website's pages or e-mail messages may contain cookies, web beacons (also known as clear gifs), or similar technologies as they become available. Cookies are information files that this Website may place on your computer to provide extended functionality. The COMPANY may use cookies for a number of purposes, such as tracking usage patterns on the Website, measuring the effectiveness of advertising, limiting multiple responses and registrations, facilitating your ability to navigate the Website, providing advertising to you about our products and services or those of third parties on the Website or other websites, and/or as part of a verification or screening process. Most browsers are initially set up to accept cookies. Most browsers will allow you to erase cookies from your computer hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. You should refer to your browser instructions, "Help" screen, or similar such resource to learn more about how to manage cookies and possibly reset your browser to refuse all cookies or to indicate when a cookie is being sent by indicating this in the preferences, options, or similar such menu in your browser. However, it is possible that some parts of this Website will not operate correctly if you disable cookies and you may not be able to take advantage of some of this Website's features. You should consult with your browser's provider/manufacturer if you have any questions regarding disabling cookies.

The COMPANY’s web pages may include advertisements for third parties and their products, and those third-party advertisements may include a cookie or web beacon served by the third party. The COMPANY does not control cookies in such third-party ads, and visitors are encouraged to check the privacy policies of advertisers and/or ad services to learn about their use of cookies and other technology. The COMPANY's Privacy Policy does not cover the use of information collected from you by third party ad servers. These companies may use information (not including your name, address, e-mail address or telephone number) about your visits to this and other Websites in order to provide advertisements on this site and other sites about goods and services that may be of interest to you.

A web beacon is a small graphic image that allows the party that set the web beacon to monitor and collect certain information about the viewer of the web page, web-based document or e-mail message, such as the type of browser requesting the web beacon, the IP address of the computer that the web beacon is sent to and the time the web beacon was viewed. Web beacons can be very small and invisible to the user, but, in general, any electronic image viewed as part of a web page or e-mail, including HTML based content, can act as a web beacon. The COMPANY may use web beacons to count visitors to the web pages on the Website or to monitor how our users navigate the Website, and the COMPANY may include web beacons in e-mail messages in order to count how many messages sent were actually opened, acted upon or forwarded.
a. Non-Personally Identifiable Information.
From time to time, COMPANY may use and share with third parties aggregate, non-personally identifiable User information to show general demographic and preference information among users of the COMPANY Web sites. For example, the COMPANY may produce and share with others “trend reports” using such aggregate, non-personally identifiable User information, generated based on information gathered on Users from order information (i.e. products purchased, amount spent, type of product, general addresses to be shipped to etc), retailer information related to purchases (i.e. type of retailer and their buying habits) and brand information (i.e. type of product a manufacturer or brand showcases).


When you visit or download information from this Website, our web servers may automatically collect website usage information. Website usage information is non-personally identifying information that describes how our visitors use the Website. It can include the number and frequency of visitors to each web page and the length of their stays, browser type, referrer data that identifies the web page visited prior and subsequent to visiting the Website, and IP addresses (see below for more information on IP addresses). COMPANY may use IP addresses for a number of purposes, such as system administration, to generally determine your computer's server location, to report aggregate information to our business partners or to audit use of the Website. We also may determine your screen resolution and the technology available in order to serve you the most appropriate version of a web page, e-mail or similar service.
b. Personally Identifiable Information.
COMPANY uses information about you to deliver the Services that you request, to keep you informed about changes affecting our Services or your account, to inform you of other Services or offers in which you might be interested, and to improve and enhance our sites and Services. If you provide COMPANY with personally identifiable information, we will take all reasonable and appropriate steps to protect it from unauthorized disclosure.


When you create a User Account or accept one, you are opting in to receive e-mail from us. You can always opt out of future marketing messages by following the directions in each message to "unsubscribe”. However, if you choose to opt out of marketing messages, we reserve the right to contact you regarding your account status, technical support, product information, changes to account terms, and any other matter that might affect our service to you and/or any products you purchased from us or registered with us, as applicable.


As stated in the Terms and Conditions, you will be deemed to have consented to the disclosure to, and use by, a subsequent owner or operator of a COMPANY Website or Service, of any information about you contained in the applicable COMPANY database, if COMPANY or one of its companies assigns its rights and obligations regarding any of your information at the time of a merger, acquisition, or sale of all or substantially all of COMPANY's or such COMPANY company's assets related to the applicable site or Service to a subsequent owner or operator. In the event of such a merger, acquisition, or sale, your continued use of the Website or any related Service signifies your agreement to be bound by the Terms and Conditions and Privacy Policy of the Website's or Service's subsequent owner or operator.


The COMPANY and other entities may work together in order to provide portions of the COMPANY Websites and some Services (e.g., to fulfill prizes won in a sweepstakes, or to provide other support for a Service). These companies will handle your personally identifiable information in accordance with this Privacy Policy.


As stated above in Section V, COMPANY may also work with third parties to provide some Services on our Websites. In connection with those Services, you are deemed to consent to us sharing your information with third parties who provide services such as processing of credit card transactions, customer service, promotion administration, order fulfillment and/or prize delivery, as applicable. Third parties who provide, or participate in, Services on COMPANY Websites are prohibited from using our customers' personally identifiable information for marketing purposes and/or from sharing, selling, or otherwise using such information, unless you choose to opt in to marketing, sharing, or other uses by the third parties. If you do not want your information to be used for marketing (or other purposes unrelated to the provision of COMPANY Services) by a third party who participates in a Service on one of our sites, do not opt in to such use by that third party when you register to participate in the Service.


Please note that whenever you opt in to receive future communications from a third party, your information will be subject to the third party's privacy policy. If you later decide that you do not want that third party to use your information, you will need to contact the third party directly, as we have no control over how third parties use information. You should always review the privacy policy of any party that collects your information to determine how that entity will handle your information. COMPANY will not share, sell, rent, or disclose any personally identifiable information that we have collected except as stated herein, or in the following instances: 1) we have been given your consent to disclose; 2) we have previously informed you of the disclosure, including by means of our Privacy Policy or on the Website, or through the Service where you provided your information; 3) we are required by law, legal process, or court order to disclose; 4) disclosure is necessary to identify, contact, or bring legal action against someone who may cause or be causing harm to, or interference with, COMPANY's rights or property, other COMPANY Website users, or anyone else; or 5) to respond to an inquiry, request or complaint that you have made. COMPANY may also use IP addresses in cooperation with Internet service providers to identify users if we deem it necessary to comply with law, to enforce compliance with this Privacy Policy or our Terms and Conditions, or to protect our sites, customers, or others.
d. Control Over Your Information; Special Notes Regarding the EU and Switzerland.
i) Modifying Account Information. If you have an User Account with us, you have the ability to modify certain information in your account (e.g., your contact information) through “profile,” “account,” “settings,” or “preferences” options provided on the Website. If you have any questions about modifying or updating any information in your account, please contact using the contact details as described in Section XVI below. Please note that COMPANY does not own or control the Customer Data uploaded to our Service by our customers, and cannot modify or delete Customer Data except at the request of our customer, or as permitted by our
Terms and Conditions.

ii) Email Communications. See Section IV.

iii) For Residents in the EU and Switzerland.
If you are located in the EU or Switzerland, you have the following rights in respect of your personal data that we hold:
a) Right of access. The right to obtain access to your personal data;
b) Right to rectification. The right to obtain rectification of your personal data without undue delay where that personal data is inaccurate or incomplete;
c) Right to erasure. The right to obtain the erasure of your personal data without undue delay in certain circumstances, such as where the personal data is no longer necessary in relation to the purposes for which it was collected or processed;
d) Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal data in certain circumstances, such as where the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of that personal data;
e) Right to portability. The right to portability allows you to move, copy or transfer personal data easily from one organization to another; and
F) Right to object. You have a right to object to processing based on legitimate interests and direct marketing.

If you wish to exercise one of these rights, please contact us using the contact details described in Section XVI below.

You also have the right to lodge a complaint to your local data protection authority. Further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
By providing any personally identifiable information to COMPANY, all users, including, without limitation, users in the member states of the European Union (“EU”), fully understand and unambiguously consent to this Privacy Policy and to the collection, storage, and processing of such information in the United States of America.

Regarding processing of your persona data in the EU, the purposes for which we may do so are:
i) The provision of personal data by you may be necessary for the performance of any contractual relationship we have with you;
ii) Where it is necessary for compliance with our legal obligations laid down by EU law;
iii) Where in our legitimate interests (provided these are not overridden by your interests and fundamental rights and freedoms – this includes our own legitimate interests and those of other entities and branches in our group of companies) such as:
a) to contact you and respond to your requests and enquiries;
b) for business administration, including statistical analysis;
c) to provide the Services and the Website to you;
d) for fraud prevention and detection; and
e) to comply with applicable laws, regulations or codes of practices.

We may also process your personal data on the basis of your freely given, specific, informed and unambiguous consent. You should be aware that you are entitled under the EU Data Protection Law to withdraw your consent where that has been given, at any time. If you do this and we have no alternative lawful reason to process your personal data, this may affect our ability to provide you with rights to use the Services and the Website.
Please note that information submitted to the Website via a "contact us," "help" or other similar e-mail address or form will not necessarily receive a response. We will not use the information provided to these e-mail addresses or forms for marketing purposes unrelated to your request.

A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes ("California customer") is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes. In general, if the business has made such a disclosure of personal information, upon receipt of a request by a California customer, the business is required to provide a list of all third parties to whom personal information was disclosed in the preceding calendar year, as well as a list of the categories of personal information that were disclosed.

However, under the law, a business is not required to provide the above-described lists if the business adopts and discloses to the public (in its privacy policy) a policy of not disclosing customer's personal information to third parties for their direct marketing purposes unless the customer first affirmatively agrees to the disclosure, as long as the business maintains and discloses this policy. Rather, the business may comply with the law by notifying the customer of his or her right to prevent disclosure of personal information and providing a cost free means to exercise that right.

As stated in our Privacy Policy, we do not share information with third parties for their direct marketing purposes unless you affirmatively agree to such disclosure, typically by opting in to receive information from a third party that is participating in a sweepstakes or other promotion on one of our sites. If you do ask us to share your information with a third party for its marketing purposes, we will only share information in connection with that specific promotion, as we do not share information with any third party on a continual basis. To prevent disclosure of your personal information for use in direct marketing by a third party, do not opt in to such use when you provide personally identifiable information on one of our sites. Please note that whenever you opt in to receive future communications from a third party, your information will be subject to the third party's privacy policy. If you later decide that you do not want that third party to use your information, you will need to contact the third party directly, as we have no control over how third parties use information. You should always review the privacy policy of any party that collects your information to determine how that entity will handle your information.

California customers may request further information about our compliance with this law by e-mailing Privacy@variant3d.io. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this e-mail address.
2.1 Unless otherwise set out below, each capitalised term in this DPA shall have the meaning set out in the Terms and Conditions and the following capitalised terms used in this DPA shall be defined as follows:
(a) “Customer Personal Data” means the personal data described in ANNEX 2 and any other personal data that the COMPANY processes on behalf of the Customer in connection with the COMPANY’s provision of the Services or Website;
(b) “Data Protection Laws” means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“GDPR“) and all applicable legislation protecting the fundamental rights and freedoms of persons and their right to privacy with regard to the Processing of Customer Personal Data;
(c) “European Economic Area” or “EEA” means the Member States of the European Union together with Iceland, Norway, and Liechtenstein;
(d) “Party” means each of the Customer and the COMPANY;
(e) “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Customer Personal Data;
(f) ”Standard Contractual Clauses” means the Standard Contractual Clauses (processors) approved approved by European Commission Decision C(2010)593 set out in ANNEX 1 to this DPA or any subsequent version thereof released by the European Commission (which will automatically apply), and which includes ANNEX 2 (Details of the Processing) and ANNEX 3 (Technical and Organisational Measures) to this DPA;
(g) “Subprocessor” means any Processor engaged by the COMPANY who agrees to receive from the COMPANY any Customer Personal Data;
(h) “Terms” shall refer to the
Terms and Conditions of the Website, of which the Privacy Policy and this DPA are incorporated into; and
(i) the terms “personal data“, “Controller“, “Processor“, “Data Subject“, “Process” and “Supervisory Authority” shall have the same meaning as set out in the GDPR.

3. DATA PROCESSING
3.1 Instructions for Data Processing. The COMPANY will only Process Customer Personal Data in accordance with (a) the Terms (including this DPA), to the extent necessary to provide the Service to the Customer, and (b) the Customer’s written instructions, unless Processing is required by European Union or Member State law to which the COMPANY is subject, in which case the COMPANY shall, to the extent permitted by applicable law, inform the Customer of that legal requirement before Processing that Customer Personal Data. The Terms (including this DPA) (subject to any changes to the Service agreed between the Parties) shall be the Customer’s complete and final instructions to the COMPANY in relation to the processing of Customer Personal Data.

3.2 Processing outside the scope of the Terms (including this DPA) will require prior written agreement between the Customer and the COMPANY on additional instructions for Processing.

3.3 Required consents. Where required by applicable Data Protection Laws, the Customer will be responsible for ensuring that all Data Subjects have given/will give all necessary consents for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms.

3.4 Privacy notices. Customer warrants and represents that
(a) it has provided all applicable notices to Data Subjects required for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms; or
(b) in respect of any Customer Personal Data collected by the COMPANY on behalf of the Customer, it has reviewed and confirmed the notices provided by the COMPANY to Data Subjects as accurate and sufficient for the lawful Processing of Customer Personal Data by the COMPANY in accordance with the Terms.

4. TRANSFER OF PERSONAL DATA
4.1 Authorised Subprocessors. The Customer agrees that COMPANY may use each of the subcontractors as a Subprocessor to Process Customer Personal Data.

4.2 The Customer agrees that the COMPANY may use subcontractors to fulfil its contractual obligations under the Terms. The COMPANY shall notify the Customer from time to time of the identity of any Subprocessors it engages. If the Customer (acting reasonably) does not approve of a new Subprocessor, then without prejudice to any right to terminate the Terms, the Customer may request that the COMPANY moves the Customer Personal Data to another Subprocessor and the COMPANY shall, within a reasonable time following receipt of such request, use all reasonable endeavours to ensure that the Subprocessor does not Process any of the Customer Personal Data.

4.3 Except as set out in Section 1 and 4.2 of this DPA, the COMPANY shall not permit, allow or otherwise facilitate Subprocessors to Process Customer Personal Data without the prior written consent of the Customer and unless the COMPANY enters into a written agreement with the Subprocessor which imposes the same obligations on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on the COMPANY under this DPA.

4.4 Liability of Subprocessors. The COMPANY shall at all times remain responsible for compliance with its obligations under the DPA and will be liable to the Customer for the acts and omissions of any Subprocessor approved by the Customer as if they were the acts and omissions of the COMPANY.

4.5 International Transfers of Personal Data. To the extent that the Processing of Customer Personal Data by the COMPANY involves the export of such Customer Personal Data to a country or territory outside the EEA, other than a country or territory ensuring an adequate level of protection for the rights and freedoms of Data Subjects in relation to the Processing of Personal Data as determined by the European Commission, such transfer shall be governed by the Standard Contractual Clauses. In the event of any conflict between any terms in the Standard Contractual Clauses, this DPA and the Terms, the Standard Contractual Clauses shall prevail.

5. DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS
5.1 COMPANY Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the COMPANY shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in ANNEX 3 of this DPA.

5.2 Upon request by the Customer, the COMPANY shall make available all information reasonably necessary to demonstrate compliance with this DPA.

5.3 Security Incident Notification. If the COMPANY or any Subprocessor becomes aware of a Security Incident, the COMPANY will (a) notify the Customer of the Security Incident without undue delay after becoming aware of the Security Incident, (b) investigate the Security Incident and provide such reasonable assistance to the Customer (and any law enforcement or regulatory official) as required to investigate the Security Incident, and (c) take steps to remedy any non-compliance with this DPA.

5.4 COMPANY Employees and Personnel. The COMPANY shall treat the Customer Personal Data as the confidential information of the Customer, and shall ensure that any employees or other personnel of the COMPANY have agreed in writing to protect the confidentiality and security of Customer Personal Data.

6. ACCESS REQUESTS AND DATA SUBJECT RIGHTS
6.1 Data Subject Requests. Except as required (or where prohibited) under applicable law, the COMPANY shall notify the Customer of any request received by the COMPANY or any Subprocessor from a Data Subject in respect of their personal data included in the Customer Personal Data, and shall not respond to the Data Subject.

6.2 The COMPANY shall provide the Customer with the ability to correct, delete, block, access, or copy the Customer Personal Data in accordance with the functionality of the Service.

6.3 Government Disclosure. The COMPANY shall notify the Customer of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any data protection supervisory authority) unless otherwise prohibited by law or a legally binding order of such body or agency.

7. Assistance
7.1 Where applicable, taking into account the nature of the Processing, and to the extent required under applicable Data Protection Laws, the COMPANY shall provide the Customer with any information or assistance reasonably requested by the Customer for the purpose of complying with any of the Customer’s obligations under applicable Data Protection Laws, including:

(a) using all reasonable endeavours to assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising Data Subject rights laid down in the GDPR; and

(b) providing reasonable assistance to the Customer with any data protection impact assessments and with any prior consultations to any Supervisory Authority of the Customer, in each case solely in relation to Processing of Customer Personal Data and taking into account the information available to the COMPANY.

8. Duration and TERMINATION
8.1 Deletion of data. Subject to Section 8.2 of this DPA below, the COMPANY shall, at the Customer’s election and within 90 (ninety) days of the date of termination of the Terms:

(a) delete, and use all reasonable efforts to procure the deletion of, Customer Personal Data Processed by us or any Subprocessors; or
(b) return a complete copy of all Customer Personal Data by secure file transfer in such a format as notified by the COMPANY to the Customer (and delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data Processed by the COMPANY or any Subprocessors). Where this Section 8.1(b) applies, the COMPANY shall not be required to provide a copy of the Customer Personal Data to the Customer).

8.2 The COMPANY and its Subprocessors may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that the COMPANY shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.

ANNEX 1

For the purposes of the Clauses:
(a) ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
(b) ‘the data exporter’ means the controller who transfers the personal data;
(c) ‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
(d) ‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
(e) ‘the applicable data protection law‘ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
(f) ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Annex 3 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
(g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Annex 3, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
(j) that it will ensure compliance with Clause 4(a) to (i).
(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in Annex 3 before processing the personal data transferred;
(d) that it will promptly notify the data exporter about:
(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
(ii) any accidental or unauthorised access, and
(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
(f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Annex 3 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
(h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
(i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;
(j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

This ANNEX 2 includes certain details of the processing of Customer Personal Data as required by Article 28(3) of the GDPR.

1. Subject matter and duration of the Processing of Customer Personal Data.

The subject matter of the Processing of Customer Personal Data is the use of and access to the Services and/or Website by the Customer in accordance with the Terms.

The duration of the Processing of Customer Personal Data is the term of the Terms, subject to Section 8.2 of this DPA.

2. The nature and purpose of the Processing of Customer Personal Data.

The nature and purpose of the Processing is the Processing of Customer Personal Data provided by the Customer to the COMPANY, or collected by the COMPANY on behalf of the Customer, for the purposes of providing the Services and/or Website to the Customer.

3. The types of Customer Personal Data to be Processed.

The types of Customer Personal Data to be Processed includes the following information relating to employees and other personnel of the Customer, authorised by the Customer to use the Services and/or Website on its behalf, and relating to employees and other personnel of the Customers’ customers: first name and last name; contact information (including email address); usage information, non-traditional identifiers of users, and any other Personal Data the Customer or its users submit to the COMPANY in the course of its use of the Services and/or Website.

4. The categories of Data Subject to whom the Customer Personal Data relates.

Employees and other personnel of the Customer, authorised by the Customer to use the Services on behalf of the Customer, and employees and other personnel of the Customers’ customers.

5. The obligations and rights of the Customer.

The obligations and rights of the Customer are as set out in the Terms (including this DPA).

KEEP IN TOUCH

FULL NAME
E-MAIL
THANK YOU!