Data Processing Addendum

General Terms

1. Definitions and interpretation

1. The following definitions and rules of interpretation apply in this Data Processing Addendum:
   1. Adequate Territory: a third country or international organisation which is subject to adequacy regulations under the Data Protection Legislation.
   2. Appropriate Safeguards: a valid cross-border transfer mechanism under the Data Protection Legislation.
   3. Commissioner: the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).
   4. Controller, Processor, Data Subject, Personal Data, Personal Data Breach and Processing: have the meanings given to them in the Data Protection Legislation.
   5. Customer Personal Data: Personal Data that Customer provides to Rightbrain that Rightbrain Processes on behalf of Customer to provide the Services.
   6. Data Protection Legislation: all applicable data protection and privacy legislation in force from time to time in the UK, including without limitation the UK GDPR, the Data Protection Act 2018 (and regulations made thereunder) (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.
   7. Subprocessor: an organisation engaged by Rightbrain to Process Customer Personal Data.
   8. UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
2. This Data Processing Addendum is subject to the terms of the Agreement and is incorporated into the Agreement. Capitalised terms not defined in this Data Processing Addendum shall have the meanings given to them in the Agreement.
3. The Annexes form part of this Data Processing Addendum and will have effect as if set out in full in the body of this Data Processing Addendum. Any reference to this Data Processing Addendum includes the Annexes.
4. In the case of conflict or ambiguity between: 1. any provision contained in the body of this Data Processing Addendum and any provision contained in the Annexes, the provision in the body of this Data Processing Addendum will prevail; 2. the terms of any accompanying invoice or other documents annexed to this Data Processing Addendum and any provision contained in the Annexes, the provision contained in the Annexes will prevail; and 3. any of the provisions of this Data Processing Addendum and the provisions of the Agreement, the provisions of this Data Processing Addendum will prevail.

2. Customer Responsibilities

1. ANNEX A describes the subject matter, duration, nature and purpose of the Processing and the Personal Data categories and Data Subject types in respect of which Rightbrain Processes the Customer Personal Data. Customer agrees and acknowledges that it is responsible for the accuracy and completeness of ANNEX A.
2. Customer will not:
   1. provide Customer Personal Data to Rightbrain except through agreed mechanisms; or
   2. provide Customer Personal Data to Rightbrain other than as set out in ANNEX A.
3. Customer represents and warrants that for the purpose of the Data Protection Legislation:
   1. Customer is the Controller and Rightbrain is the Processor; and
   2. Customer will comply with its obligations under the applicable Data Protection Legislation, including but not limited to by providing any required notices and obtaining any required consents, rights or authorisations for the Processing of Customer Personal Data under this Data Processing Addendum and the Agreement, and for the written Processing instructions it gives to Rightbrain.
4. Without prejudice to Rightbrain’s security obligations under this Data Processing Addendum and the Agreement, Customer acknowledges that it, rather than Rightbrain, is responsible for certain configurations and implementation decisions and that it, and not Rightbrain, is responsible for implementing those configurations and decisions in a secure manner that complies with the Data Protection Legislation.
5. Where Customer is itself acting as a Processor on behalf of a third-party Controller in connection with its use of the Services ("Processor Customer"), Customer additionally represents, warrants and agrees that:
   1. it has obtained the authority of that Controller to engage Rightbrain as a Subprocessor of that Controller’s Personal Data, whether under a general authorisation or specific written consent as required by the Data Protection Legislation;
   2. it has entered into a data processing agreement with that Controller in accordance with the Data Protection Legislation;
   3. it will act as the sole intermediary between Rightbrain and the Controller for all data protection matters arising in connection with the Services, including responding to Data Subject rights requests, conducting or facilitating data protection impact assessments, and engaging with the Commissioner or other relevant regulator in respect of the Processing;
   4. in performing the obligations referred to in (iii), Customer will make full use of the platform’s capabilities to resolve such matters where practicable, escalating to Rightbrain only where specific assistance that cannot otherwise be obtained through the platform is required; and
   5. where Rightbrain notifies Customer of a Personal Data Breach, a change to the Subprocessor list under clause 4, or an amendment to this Data Processing Addendum, Customer will promptly pass that notification or amendment to the Controller in the manner and within the timescales required by Customer’s data processing agreement with the Controller and by the Data Protection Legislation.

3. Rightbrain’s obligations

1. Rightbrain agrees to:
   1. Process Customer Personal Data only i) on Customer’s behalf for the purpose of providing and supporting the Services, and ii) in compliance with the written instructions received from Customer, except where Rightbrain is required to Process Customer Personal Data by applicable law, in which case Rightbrain will (unless that law prohibits it on important grounds of public interest) inform Customer of that legal requirement before Processing;
   2. inform Customer promptly if, in Rightbrain’s opinion, an instruction of Customer violates the Data Protection Legislation;
   3. require that persons authorised by Rightbrain to Process the Customer Personal Data have committed themselves to confidentiality;
   4. implement appropriate technical and organisational measures against unauthorised or unlawful Processing, access, copying, modification, reproduction, display or distribution of the Customer Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Customer Personal Data;
   5. reasonably assist Customer, at Customer’s cost, in meeting Customer’s compliance obligations under the Data Protection Legislation, taking into account the nature of Rightbrain’s Processing and the information available to Rightbrain, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Commissioner or other relevant regulator under the Data Protection Legislation;
   6. make available to Customer, wherever possible, a summary of the results of a third party audit and/or certification reports relevant to Rightbrain’s compliance with this Data Processing Addendum, which the parties agree will be Customer’s primary means of verifying that compliance. Rightbrain will cooperate with an audit, inspection or other assessment carried out by or on behalf of Customer only where Customer objects, on reasonable grounds, that the reports made available under this clause are insufficient to demonstrate Rightbrain’s compliance, or where the Data Protection Legislation or a relevant regulator requires such an audit. Any such audit will be subject to appropriate confidentiality obligations, carried out at Customer’s cost, and conducted in a manner that does not unduly disrupt Rightbrain’s business; and
   7. notify Customer without undue delay on becoming aware of any Personal Data Breach.

4. Subprocessors

1. Customer hereby provides a general authorisation to Rightbrain’s engagement of the list of Subprocessors as set out in Annex B - Subprocessors as updated by Rightbrain from time to time.
2. Rightbrain will inform Customer of any intended changes concerning the addition or replacement of Subprocessors by providing no less than 30 days’ notice of such changes. Customer may, acting reasonably, object to such changes within 30 days of receipt of such notice. Where Customer has objected to the addition or replacement of a Subprocessor, Rightbrain may, at its sole discretion:
   1. cancel its plans to use such Subprocessor and/or offer an alternative Subprocessor using the process set out in this clause 4(b);
   2. take corrective steps agreed with Customer to ensure that the use of such Subprocessor is acceptable to Customer; or
   3. cease to provide, or require Customer not to use, the affected feature of the Services.
3. Where Customer’s reasonable objection is not resolved by any of the steps in clause 4(b)(i) to (iii) and the affected feature is material to Customer’s use of the Services, Customer may terminate the affected Services on written notice and Rightbrain will refund a pro-rata portion of any Fees pre-paid by Customer in respect of the unused remainder of the then-current Subscription Period for those Services.
4. Rightbrain’s agreements with Subprocessors will satisfy the requirements for such contracts imposed by the Data Protection Legislation. Subject to any limitation of liability set out in this Data Processing Addendum and the Agreement, Rightbrain will be liable to Customer for the acts and omissions of Subprocessors in their performance of their obligations under such contracts.
5. Where Subprocessors operate outside the UK, Customer authorises Rightbrain to transfer Customer Personal Data to such Subprocessors provided that such transfers are made to an Adequate Territory and/or subject to Appropriate Safeguards.

5. Term and termination

1. This Data Processing Addendum will remain in full force and effect so long as:
   1. the Agreement remains in effect; or
   2. Rightbrain retains any of the Customer Personal Data related to the Agreement in its possession or control.
2. Any provision of this Data Processing Addendum that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect the Customer Personal Data will remain in full force and effect.
3. If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Agreement obligations, the parties may agree to suspend the Processing of the Customer Personal Data until that Processing complies with the new requirements. If the parties are unable to bring the Customer Personal Data Processing into compliance with the Data Protection Legislation within 90 days either party may terminate the Agreement on not less than 30 working days’ written notice to the other party.
4. Within 90 days of termination of this Data Processing Addendum, Rightbrain will, at Customer’s choice, either delete all Customer Personal Data or, at Customer’s cost, return it to Customer. Where Customer has not notified its choice within that period, Rightbrain may delete the Customer Personal Data.

Annex A - Particulars of Processing

Annex B - Subprocessors