Controller- to-Controller

Data Processing Addendum

This Addendum sets out the framework for the sharing of personal data by Contractor to Sapper and its affiliates.

1. Shared Personal Data. Each party acknowledges that Contractor will regularly disclose to Sapper and its affiliates personal data of data subjects including without limitation names, their geographical and email addresses, telephone numbers and job titles (the “Shared Personal Data”) collected by Contractor for the purpose of promoting Sapper’s products and services to the applicable data subjects by Sapper and its affiliates (“Agreed Purposes”).

2. Effect of non-compliance with Data Protection Legislation. Each party shall comply with all the obligations imposed on a controller under the Data Protection Legislation, and any material breach of the Data Protection Legislation by one party shall, if not remedied within 30 days of written notice from the other party, give grounds to the other party to terminate the Agreement with immediate effect.
“Data Protection Legislation” means all legislation and regulatory requirements in force from time to time relating to the use of personal data and the privacy of electronic communications, including, without limitation (i) the General Data Protection Regulation ((EU) 2016/679) and any other directly applicable European Union regulation relating to data protection and privacy as well as (ii) any local law data protection legislation from time to time in force.
Controller, data subject, personal data, processing and appropriate technical and organizational measures shall have the meaning set forth in the Data Protection Legislation in force at the time.
3. Warranties
Contractor warrants that it complies with the Data Protection Legislation when providing the services. Contractor especially warrants that it has all necessary notices and consents in place (and can prove that to Sapper upon request) to enable lawful transfer of the Shared Personal Data to Sapper and its affiliates for the Agreed Purposes; including without limitation that the data subject has been informed of and consented to
(a) the collection, processing and/or use of its data
(b) the purpose of the collection, processing and/or use of its data
(c) its right to object at no cost to the collection, processing and/or use of its data, as well as all other data subject rights it might have under the Data Protection Legislation
(d) its personal data may be exported to others countries, including outside European Union.
(e) being contacted by Sapper and its affiliates for marketing purposes.
Contractor warrants that it has the right to grant the licenses and other rights related to the use of personal data, especially without limitation to the extent the processing of personal data has been collected through social public networking platforms or others public sources.
4. Particular obligations relating to data sharing. Sapper and its affiliates agree that they shall:
(a) process the Shared Personal Data only for the Agreed Purposes;
(b) not disclose or allow access to the Shared Personal Data to anyone other than Sapper and its affiliates and/or third parties acting for or on behalf of Sapper and its Affiliates;
(c) ensure that it has in place appropriate technical and organizational measures, to protect against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data
5. Assistance. Contractor shall assist Sapper and its affiliates in complying with all applicable requirements of the
Data Protection Legislation. In particular, Contractor shall:
(a) promptly inform Sapper and its affiliates about the receipt of any data subject access request;
(b) provide Sapper and its affiliates with reasonable assistance in complying with any data subject access request;
(c) not disclose or release any Shared Personal Data in response to a data subject access request without first consulting Sapper and its affiliates wherever possible;
(d) assist Sapper and its affiliates, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
(e) notify Sapper and its affiliates without undue delay on becoming aware of any breach of the Data Protection Legislation;
(f) use compatible technology for the processing of Shared Personal Data to ensure that there is no lack of accuracy resulting from personal data transfers;
(g) maintain complete and accurate records and information to demonstrate its compliance with this Exhibit and allow for audits by Sapper and its affiliates or Sapper’s designated auditor; and
(h) provide Sapper and its affiliates with contact details of at least one employee as point of contact and responsible manager for all issues arising out of the Data Protection Legislation, including the raining of relevant staff, the procedures to be followed in the event of a data security breach, and the regular review of compliance with the Data Protection Legislation.
6. Indemnity. Contractor will indemnify, hold harmless and, at Sapper’s request, defend Sapper and Sapper’s affiliates, directors, officers, employees, agents and independent partners from and against all claims, liabilities, damages, losses and expenses, including but not limited to reasonable attorneys’ fees and costs of suit, arising out of or in connection with either (A) any breach of a warranty, (B) any negligent or willful act or omission of Contractor or Contractor’s employees or agents, including but not limited to the extent such act or omission causes or contributes to any violation or claimed violation of a third parties’ rights arising in whole or in part from the grant of rights to Sapper hereunder or Sapper’s exercise of any such rights. Contractor will maintain adequate insurance to protect itself from and indemnify Sapper against claims giving rise to indemnification pursuant to this Paragraph. No limitation of liability shall apply to this indemnity obligation.
Sapper shall have the exclusive right to control its defense and/or the settlement. In no event shall Contractor settle any claim, action or proceeding without Sapper’s prior written approval.