[{"id":694,"type":"TermsAndConditions","product":null,"target":"Clients","culture":null,"version":"1.5","publishDate":"2024-02-02T13:16:00.531818","content":[{"level":1,"header":"","content":"These general terms and conditions of service (the “General Terms and Conditions”) are entered into by and between the entity set forth in the Order Form to obtain access to the Services (the “Customer”) and AudienceProject A/S, Ryesgade 3F, 3, 2200, Copenhagen N, company registration number (CVR) 32552412 (“AudienceProject”), collectively referred to as the “Parties” or each a “Party”.\n\nThe agreement between Customer and AudienceProject (the “Agreement”) includes: (i) the order form, which contains details of the Customer's order (the “Order Form”); (ii) these General Terms and Conditions; and (iii) AudienceProject data processing agreement which defines each Party's obligations and responsibilities in relation to the personal data processed by AudienceProject (the “Data Processing Agreement”); as well as any annexes, exhibits, schedules or other documents attached to or expressly referred by any of the foregoing. \n\nAny inconsistencies in the Agreement shall be resolved in accordance with the following order of precedence: \n- Order Form, \n- Data Processing Agreement, \n- General Terms and Conditions. \n\nIf material changes are made to the Agreement the terms of section 14.2 shall apply. \n\nCustomer undertakes to read, and where applicable to comply with, all operating rules, policies and guidelines that are referred to herein or that may otherwise be published by AudienceProject at www.audienceproject.com (the “Website”) including: (i) AudienceProject acceptable use policy (the “Acceptable Use Policy”), (ii) AudienceProject security overview (the “Security Overview”), (iii) AudienceProject users privacy policy (the “Users Privacy Policy”), and (iv) AudienceProject clients privacy policy (the “Clients Privacy Policy”) (collectively the “Policies”). \n\nOccasional changes may occur to the Policies for valid reasons, such as improving existing functions or features or to ensure the continued compliance with any existing laws. If material changes are made to the Policies, AudienceProject will provide Customer with notice as appropriate under the circumstances."},{"level":1,"header":"1. Definitions","content":"1.1 *Account Data*: Personal data including identification and contact information that relates to individuals authorised by Customer to access Customer's account and billing information. \n1.2 *Confidential Information*: Information disclosed by one Party to the other Party under the Agreement that is identified as confidential or could reasonably be considered confidential under the circumstances in whatsoever form including but not limited to commercial, technical, or financial information.\n1.3 *Order Form*: Specifications and details of the given subscription to the services that Customer wishes to order. \n1.4 *Services*: All the features and functionalities, including websites, apps and user interfaces, as well as all content and software applications, associated with all technical solutions and services selected by Customer as specified in the Order Form and provided by AudienceProject.\n1.5 *Deliverables*: All the reports, studies and output data selected by Customer as specified in the Order Form and provided by AudienceProject."},{"level":1,"header":"2. Acceptance","content":"2.1 The Agreement becomes binding and effective for any use of the Services by Customer upon Customer's acceptance of the Order Form, when Customer electronically or physically signs the Order Form provided by AudienceProject.\n2.2 *The Term of the Agreement*\nThe Agreement becomes effective on the date that a valid Order Form is executed in accordance with section 2.1 (the “Effective Date”) and remains in force for the duration of the subscription specified in the Order Form (the “Trial Period”) and/or (the “Initial Term”) or until terminated in accordance with the provisions of the Agreement (the Trial Period, the Initial Term and any subsequent renewal of the Agreement shall be defined as the “Term”).\n2.3 *Trial Period*\n2.3.1 If the Parties agree on a Trial Period, the Agreement will automatically extend for the duration of the Initial Term unless one of the Parties notifies the other Party of its intent to terminate the Agreement no less than five (5) days prior to the end of the Trial Period.\n2.3.2 Customer's notification of termination of the Trial Period must be made to: support@audienceproject.com. Any such notice of termination of the Trial Period shall be deemed to be a termination of the Agreement for the purpose hereof.\n2.4 *Initial Term*\n2.4.1 If the Parties do not agree on a Trial Period, the Agreement becomes effective and remains in force for the duration of the Initial Term. \n2.4.2 Unless otherwise agreed between the Parties in the Order Form, the Initial Term shall be a fixed period of 12 months.\n2.5 *Automatic renewal*\n2.5.1 On the last day of the Initial Term and on each subsequent anniversary of that date, the Agreement will automatically be renewed by AudienceProject for an additional period of 12 months, in accordance with the terms referenced to in the applicable Order Form. AudienceProject undertakes to inform Customer of the Agreement renewal at least ninety (90) calendar days before the renewal date of the Agreement. In the event that one of the Parties does not want to renew the Agreement this Party shall notify the other Party of its intent not to renew the Agreement at least sixty (60) calendar days before the end of the then-current Term. If AudienceProject does not receive a non-renewal written notification from Customer within the above mentioned time frame the Agreement will be automatically renewed. \n2.5.2 Customer's notification of non-renewal must be made to: support@audienceproject.com. Any such non-renewal shall be deemed to be a termination of the Agreement for the purpose hereof.\n2.5.3 Upon termination of the Agreement, Customer will no longer have access to the Services."},{"level":1,"header":"3. Payment terms","content":"3.1 *Prices and Taxes* \n3.1.1 All fees are issued and paid in the currency specified in the Order Form. The price for Customers purchases of the Services are to be added any applicable VAT and any mandatory taxes. Such mandatory taxes will be informed by AudienceProject when signing up for the Services and Customer is obligated to pay any such VAT and taxes upon AudienceProject invoicing of the Services.\n3.1.2 Unless otherwise specified in the Order Form, in addition to the total price of the Services AudienceProject will charge a 2% service administration fee. This service administration fee shall be mentioned in the Order Form. \n3.1.3 Any special offer, promotional deal and/or discount shall only be valid during the Initial Term.\n3.1.4 The prices, features, and options of the Services depend on the subscription selected by Customer. AudienceProject reserves the right to change the prices, features, or options included in a particular subscription, provided that AudienceProject will provide Customer with notice and that such changes shall not take effect until Customer's next Term.\n3.1.5 AudienceProject will inform Customer of any substantial changes in AudienceProject's prices for the subsequent renewal term by written notice no later than ninety (90) calendar days prior to the expiration of the previous term.\n3.1.6 AudienceProject reserves the right to adjust the prices at the beginning of each calendar year to reflect the impact of inflation. The increase of the prices will not exceed the EU Consumer Price Index for the country where the majority of the Services are delivered, as stated by the statistical office of the European Union (Eurostat) and the percentage shall not exceed the percent change of the Consumer Price Index based on the latest reported numbers over a 12 months period. If the Services are delivered outside the European Union, the relevant country's corresponding index shall be applied.\n3.1.7 Customer will be billed through invoicing. Unless otherwise specified in the Order Form, payment of all fees is due within thirty (30) days of the date of invoices. In the event that Customer reasonably and in good faith disputes any invoice, Customer shall notify AudienceProject in writing within fourteen (14) business days of the date of receipt of the applicable invoice. \n3.1.8 In case of late payment, AudienceProject shall be entitled to charge interest on overdue undisputed fees at the applicable statutory rate. AudienceProject also reserves the right to recover any costs and reasonable legal fees AudienceProject incurs in recovering overdue payments, in accordance with the applicable regulations. In addition, AudienceProject may suspend access immediately to the Services and shall be under no obligation to provide the Services while the invoice remains unpaid."},{"level":1,"header":"4. Using the Services","content":"4.1 *Eligibility to Use*\nCustomer represents and warrants that Customer is of legal age (18 years of age or older or otherwise of legal age in Customer's resident jurisdiction) and has the legal capacity to agree to the Agreement. If Customer is agreeing to the Agreement on behalf of an organisation or entity, Customer represents and warrants that Customer/and or the specific actual used signee used for acceptance of the Agreement and/or the Order Form, is authorised to agree to the Agreement and/or Order Form on that organisation or entity's behalf and bind them to the Agreement and/or the Order Form.\n4.2 *Access to the Services*\n4.2.1 Subject to the Agreement, AudienceProject grants to Customer a limited, non-exclusive, fully paid-up, worldwide, revocable, non-assignable and non-sublicensable, license to access and use AudienceProject Services including AudienceProject SaaS platform for the Term of the Agreement. \n4.2.2 Subject to the Agreement, AudienceProject grants to Customer an exclusive, fully paid-up, worldwide, and perpetual license to use, copy, transfer and resell the Deliverables provided as part of the Services. \n4.2.3 AudienceProject reserves the right to verify that Customer uses the Services in compliance with the provisions of section 4.6. Customer shall provide AudienceProject with the appropriate information and/or documents upon AudienceProject's request.\n4.3 *Obligations*\n4.3.1 AudienceProject's obligations \nUpon acceptance of the Agreement, AudienceProject will:\n4.3.1.1 Provide the Services to Customer as described in the Agreement. \n4.3.1.2 Provide, support and maintain the Services in a competent manner by qualified trained personnel and in accordance with the best industry practice and the care, skill, and diligence normally exercised by professional persons providing similar services. \n4.3.1.3 Warrant that the Services do not infringe or misappropriate any third party's intellectual property rights. \n4.3.1.4 Make reasonable efforts to ensure that the Services will be online, usable and accessible and prevent any disruptions to the Services. If any disruptions were to occur, AudienceProject is committed to remedying the cause of the disruption as soon as possible and always makes reasonable efforts to promptly notify Customer.\n4.3.1.5 The following circumstances are excluded from section 4.3.1.4 (i) service work which is notified and agreed between the Parties outside of normal work time; (ii) force majeure conditions; or (iii) Customer's own circumstances that makes it impossible to use the Services or substantially complicates the provision of the Services.\n4.4 During the Term of the Agreement, AudienceProject will provide basic support services during the support hours (between 09:00 am. – 04:00 pm. on local standard business days) to maintain the service levels, provided that when required, Customer assists with investigating and ascertaining the cause of the fault and provide AudienceProject with all necessary information relevant to the fault. All notices shall be delivered to support@audienceproject.com.\n4.5 AudienceProject may also provide Customer with additional support Services as specified in the Order Form. \n4.6 Customer's obligations\n4.6.1 Upon acceptance of the Agreement, Customer will: (i) use the Services as specified in the Order Form; (ii) cooperate with AudienceProject by providing such information and materials as AudienceProject may reasonably require in order to supply the Services and ensure that such information is complete, up-to-date and accurate in all material respects; (iii) notify AudienceProject of any unauthorised use Customer might become aware of, and (iv) use the Services in compliance with the applicable laws and regulations including but not limited to the General Data Protection Regulation (EU) 2016/679  (“GDPR”).\n4.6.2 Regarding Customers located in the United Kingdom, Customers must use the Services in compliance with the MRC Cross Media Audience Measurement Standards as requested by BARB, when sending online video data to a third party software platform for fusion with BARB data. The Customers acknowledge that viewable impressions are the minimum required qualifying unit, with a threshold of 100% of pixels on screen for at least two continuous seconds. For further information, Customers can consult the MRC Cross Media Audience Measurement Standards available on the [Media Rating Council's website](https://mediaratingcouncil.org/). \n4.6.3 Subject to section 4.2, Customer must not (and must not allow any third party to) directly and indirectly: (i) rent, lease, copy, transfer, resell, sublicense, time-share, or otherwise provide access to the Services to a third party without AudienceProject prior written authorisation; (ii) modify or create a derivative work of the AudienceProject Services or any portion of it; (iii) reverse engineer, disassemble, decompile, translate, or otherwise seek to obtain or derive the source code, underlying ideas, algorithms, file formats, or non-public APIs to the AudienceProject Services, except to the extent expressly permitted by applicable law and then only with advance notice in writing to AudienceProject; (iv) break or circumvent any security measures of the AudienceProject Services, or configure the AudienceProject Services to avoid incurring fees or in way disrupt the integrity, performance or security of the Services; (v) misuse AudienceProject Services including modify or disable the technologies provided as part of the Services; (vi) exceed the usage limits specified in the Order Form without prior notification to AudienceProject and payment of the associated fees; (vii) use the Services in a way that would impose an unreasonable and disproportionately large load on AudienceProject infrastructure; (viii) access the Services for the purpose of building a competing product or service or copying its features or user interface; and (ix) use or permit the Services to be used for any illegal or misleading purpose, or any manner inconsistent with the Agreement."},{"level":1,"header":"5. Intellectual Property","content":"5.1 A Party's ownership of, or any right, title or interest in any intellectual property rights or an item which exists prior to the Effective Date will not be altered, transferred, or assigned by virtue of the Agreement.\n5.2 Customer agrees that AudienceProject retains all rights, title and interest, including all intellectual property rights (e.g. copyrights, patents, designs and trademarks) whether or not registered, in and to the Services, and all related or underlying documentation, technology, code, algorithms, know-how, anything delivered as part of the support of the Services, and any updates, modifications, or derivative works of any of the foregoing. All information related to AudienceProject's intellectual property rights and know-how shall be deemed to be Confidential Information and AudienceProject reserves any licenses not specifically granted in the Agreement. The Services are offered as an online, hosted product. Accordingly, Customer acknowledges and agrees that it has no right to obtain a copy of the software behind any of the Services and that AudienceProject has sole discretion to make updates, bug fixes, modifications, or improvements to the AudienceProject Services from time to time. \n5.3 Customer must not (and must not assist any third party to) register or attempt to register intellectual property rights (e.g. patents, designs, trademarks, logos, etc.) or trade names and domain names in relation to the Services provided by AudienceProject. Customer must notify AudienceProject of any infringement to AudienceProject’s intellectual property rights Customer might become aware of.\n5.4 AudienceProject may use Customer's name and logo on AudienceProject’s websites and as part of a general list of AudienceProject’s customers for use and reference in corporate, promotional, and marketing material with Customer's prior written approval."},{"level":1,"header":"6. Data responsibility","content":"6.1 *Ownership*\nCustomer owns all rights, titles and interest in and to all of the data provided by Customer, as well as specifically collected, produced or otherwise gathered by AudienceProject for Customer alone, and processed by AudienceProject on behalf of Customer to perform the Services and provide the Deliverables (\"Campaign/Media Source Data\"). Without prejudice to the foregoing, Customer grants AudienceProject a non-exclusive license to use the Campaign/Media Source Data as strictly necessary to achieve the purposes listed in the Data Processing Agreement. \n6.2 *Data provided by Customer* \nCustomer shall be responsible for the data that Customer provides in the Services. Customer warrants that Customer's collection of any data provided while using the Services complies with all applicable laws, including in particular all privacy and data protection laws (\"Data Protection Laws\"). Customer acknowledges that, in the context of the Services, Customer must not, directly or indirectly via its own customers, provide or give AudienceProject access to any personal data collected without data subjects' consent, when such consent is required by law. \n6.3 *Processing of personal data carried out by AudienceProject on behalf of Customer* \nThe processing of personal data carried out by AudienceProject as a processor, acting on behalf of and on the instructions of Customer, is governed by the provisions of the Data Processing Agreement. \n6.4 *Processing of personal data carried out by each Party on its own behalf* \nAs part of the performance of the Agreement and the administration of the commercial relationship between them, as well as to comply with specific obligations under applicable laws, each Party may be required to collect certain personal data relating to the employees, agents and/or legal representatives of the other Party, including the processing by AudienceProject of the Account Data. Such data will be collected and processed by each Party as independent data controllers and under its sole responsibility. In addition, AudienceProject will process Account Data as necessary to manage Customer's access to the Services, as well as ensure, detect, prevent, address security and/or technical incidents and investigate fraud, spam, wrongful or unlawful use of the Services. Customer acknowledges that the Services include certain features and functionalities that Customer may elect to use which may impact the security of the Account Data, such as, but not limited to, account security settings, management/deletion of customer users on Customer's account and API integration. Customer is responsible for properly configuring the Services, including all their features and functionalities, to maintain appropriate security of the Account Data."},{"level":1,"header":"7. Confidentiality","content":"7.1 Confidential Information which the Parties may obtain or possess concerning the other Party, shall be considered confidential and shall not be disclosed to third parties without the relevant Party's prior written consent. Any confidentiality obligations for the Parties pursuant to the Agreement shall survive the termination of the Agreement for a period of five (5) years.\n7.2 The Confidentiality obligation shall not apply to information, (i) which becomes publicly available through no fault of the receiving party, (ii) that a Party comes into possession of in good faith from a third party, (iii) that a Party is required to disclose under applicable law or to fulfil its obligations and exercise its rights under the Agreement.\n7.3 In the event that a Party is requested by law or a court order to disclose Confidential Information, this Party shall give prompt notice in writing to the other Party before making the disclosure, to the extent permitted by law."},{"level":1,"header":"8. Indemnification","content":"8.1 Subject to section 9, each Party (the \"Indemnifying Party\") will defend, indemnify, ad hold harmless the other Party, its officers, directors, employees, and suppliers (the \"Indemnified Party\"), from and against all damages, losses, and expenses of any kind (including reasonable attorney fees and costs) from any third party claim arising out of or related to: (i) the Indemnifying Party's infringement or misappropriation of a third party's intellectual property (including without limitation, patent, trademark, trade secret, and/or copyrights) rights; and (ii) the Indemnifying Party's violation of Data Protection Laws. \n8.2 The Indemnifying Party shall have the right to control the defense and settlement of any indemnified claim, provided that (i) the Indemnified Party shall have the right to participate in the defense and settlement of the claim with counsel of its own choosing and its own expense, subject to the Indemnifying Party's control thereof; and (ii) neither Party has the right to compromise or settle any claim in a manner which affects the other Party's rights, make admissions on the other Party's behalf or obligates the other Party to take or not take any action, including, without limitation, the payment of money, without such Party's prior written approval, which shall not be unreasonably withheld or delayed. \n8.3 AudienceProject will have no obligation or liability where a third party claim arises from any combination with, addition to, misuse or modification of the Services and/or a breach of the Agreement by Customer, including failure to collect consent from data subjects where such consent is required by Data Protection Laws."},{"level":1,"header":"9. Limitation of liability","content":"9.1 The use of the Services is the sole responsibility of Customer. The Services are supplied “as is” and may be modified, updated, interrupted, suspended, or discontinued at any time without notice or liability, to the extent that it is necessary to provide the Services to Customer and/or reasonable given the circumstances.\n9.2 Neither Party (or its affiliates, subcontractors, suppliers, vendors) shall be liable under, or otherwise in connection with these terms for (i) any indirect, exemplary, special, consequential, incidental or punitive damages; (ii) any loss or profits, costs, anticipated savings; (iii) any loss of, or damage to data, use, business, reputation, revenue or goodwill; and/or (iv) the failure of security measures and protections, whether in contract, tort or under any other theory of liability or otherwise, and whether or not such a Party has been advised of the possibility of such damages in advance, and even if a remedy fails of its essential purpose.\n9.3 To the extent permitted by law, in no event shall the total aggregate liability of a Party (or its affiliates, subcontractors, suppliers, vendors), under, or otherwise in connection with, the Agreement, exceed the total amount of fees paid by Customer to AudienceProject during the twelve (12) consecutive months preceding the event giving rise to such liability or, if the duration of the Agreement has been less than 12 months, such a shorter period, as applicable."},{"level":1,"header":"10.  Force Majeure","content":"Neither Party will be liable for any delay or failure to perform its obligation under the Agreement if the delay or failure is due to causes beyond its reasonable control, such as but not limited to war, riot, act of terrorism, sabotage or piracy, trade restriction, act of authority, compliance with any law or governmental order, epidemic, natural disaster or extreme natural event, explosion, fire, destruction or failure of equipment, prolonged break-down of telecommunication, information system or energy, general labour disturbance such as strike and lock-out."},{"level":1,"header":"11. Termination","content":"11.1 Either Party may terminate the Agreement, including any related Order Form, if the other Party: (i) fails to cure any material breach of the Agreement (including a failure to pay undisputed fees) within thirty (30) days after written notice detailing the breach; (ii) ceases operation without a successor; or (iii) if permitted by applicable law, seeks protection under any bankruptcy, receivership, trust deed, creditors´ arrangement, composition, or comparable proceeding, or if any of these proceedings are instituted against that Party (and not dismissed within sixty (60) days thereafter).\n11.2 *Effect of Termination*\nIn all cases, if the Term of the Agreement is terminated, (i) Customer will pay to AudienceProject any amounts that have accrued before, and remain unpaid as of the date of the termination or expiration, including those for the billing cycle in which termination occurs; (ii) if the Agreement is terminated by Customer in accordance with section 11.1 AudienceProject shall refund Customer on a pro-rata basis any fees paid in advance to AudienceProject for the corresponding non-performed Services; (iii) unless otherwise specified in section 4.2, licenses and use rights granted to Customer with respect to the Services and intellectual property will immediately terminate; (iv) AudienceProject's obligation to provide any further services to Customer under the Agreement will immediately terminate, except any such services that are expressly to be provided following expiration of termination of the Agreement; and (v) Customer will delete (or, at AudienceProject request, return) any and all copies of any AudienceProject code, documentation, password or access codes, and any other AudienceProject Confidential Information in Customer's possession."},{"level":1,"header":"12. Assignment","content":"The Parties are not entitled to transfer their rights or obligations under the Agreement to any third party without prior written consent from the other Party, being specified that such consent shall not be unreasonably withheld. AudienceProject shall be entitled to assign the Agreement to: (i) any company in its group of companies; or (ii) any entity that purchases its shares or assets as the result of a merger, takeover or similar event."},{"level":1,"header":"13. Severability","content":"Unless as otherwise stated in the Agreement, should any provision of the Agreement be held invalid or unenforceable for any reason or to any extent, such invalidity or enforceability shall not in any manner affect or render invalid or unenforceable the remaining provisions of the Agreement, and the application of that provision shall be enforced to the extent permitted by law."},{"level":1,"header":"14. Agreement and variation","content":"14.1 The Agreement constitutes the entire agreement between Customer and AudienceProject in relation to its subject matter. It replaces and extinguishes all prior agreements and understandings of any nature made by or on behalf of the Parties in relation to the same, whether oral or written.\n14.2 No variation of the Agreement shall be effective unless it is in writing and signed by the Parties."},{"level":1,"header":"15. Dispute resolution","content":"Most disputes can be resolved without resort to legal actions. If Customer has any dispute with AudienceProject, the Parties agree that before taking any formal action, including but not limited to any legal actions, Customer will contact AudienceProject at support@audienceproject.com. The Parties agree to use their reasonable efforts to settle any dispute, claim, question, or disagreement directly through amicable consultation, and good faith negotiations shall be a condition to either Party initiating legal actions of any kind."},{"level":1,"header":"16. Waiver","content":"AudienceProject failure to enforce or exercise any provision of the Agreement is not a waiver of that provision."},{"level":1,"header":"17. Choice of law and jurisdiction","content":"17.1 The Agreement is subject to the laws of Denmark.\n17.2 If any dispute arising out of or in connection with the Agreement and were to be litigated, such dispute shall be settled by the competent courts of Denmark."},{"level":1,"header":"18. Notices and contact","content":"18.1 Notices required to be given under the Agreement shall be in writing and can be delivered by email at support@audienceproject.com.\n18.2 The Customer can contact AudienceProject via email at support@audienceproject.com or at the following mailing address: \nAudienceProject A/S \nRyesgade 3F, 3 floor \n2200 Copenhagen \nDenmark\n\nLast updated: January 2024"}],"externalReleaseNotes":""},{"id":695,"type":"PrivacyPolicy","product":null,"target":"Clients","culture":null,"version":"1.2","publishDate":"2024-05-30T08:44:32.591596","content":[{"level":1,"header":"","content":"At AudienceProject we fully acknowledge that all information collected online should be protected. This Privacy Policy lays out the key elements of how we, as a data controller, collect, store, transfer, and use the data relating to the personnel, agents or other representatives of our clients."},{"level":1,"header":"Who are we?","content":"AudienceProject A/S (“AudienceProject”, “we”, “our”) is a company specialised in advertising campaign measurement services.\n\nWe are responsible for the personal data that you share with us. In accordance with applicable privacy and data protection regulations, when we process personal data related to your personnel, agents or other representatives for our own business purposes, for example to manage our commercial relationship, we act as a data controller."},{"level":1,"header":"How can this Privacy Policy change?","content":"We may change this Privacy Policy from time to time, including to comply with new regulations. All changes will be effective at the time we post them and the date of this Privacy Policy will be updated accordingly. We will ensure to clearly notify any material or substantive changes."},{"level":1,"header":"What is personal data?","content":"“Personal data” means any information or pieces of information that could identify you either directly (e.g. your name) or indirectly (e.g. through pseudonymised data such as a unique ID number). This means that personal data includes information like names, e-mails or contact details."},{"level":1,"header":"What categories of personal data do we collect from you?","content":"*Identification data*, including for example: your first and last names.\n\n*Information about your professional situation*, including for example: the company for which you work, your job title.\n\n*Business contact information*, including for example: your postal address, e-mail address, and phone number.\n\n*Account data*, including for example: your log in information and passwords to access our platform."},{"level":1,"header":"Why do we collect your personal data?","content":"*To manage the contractual relationship*: we process your personal data to negotiate, conclude and perform our contract with the company you work for (our client) (e.g. invoicing and payment, support, account creation and management, etc). The legal basis for this processing is contract performance.\n\n*For marketing purposes*: we use your personal data, for example your e-mail address, to send you newsletters and marketing communications - for example on new products and services you may be interested in. The legal basis for this processing is our legitimate interests to promote our company and its products and services.\n\n*To ensure the security, prevent fraud and fix errors*: we use your personal data, for example your log in information to access our platform, in order to ensure the security or debug your account and our platform. The legal basis for this processing is our legitimate interests to maintain the security and capabilities of the services we are providing and our IT infrastructure.\n\n*To enable you to exercise your rights*: we use your personal data to enable you to exercise your rights as a data subject in accordance with the section “Your rights” of this privacy policy. The legal basis for this processing is the compliance with our legal obligations as data controller.\n\n*To comply with our legal obligations*: we process your personal data if it is necessary to comply with our accounting and taxes rules as well as other legal obligations. The legal basis for this processing is the compliance with these legal obligations.\n\n*To defend ourselves against legal claims*: we process your data, including after the termination of your commercial agreement, if it is necessary to defend ourselves against potential or actual legal claims. The legal basis for this processing is our legitimate interests to establish, exercise or defends our rights."},{"level":1,"header":"Do we share your personal data with third parties?","content":"We may share personal data concerning you with the third parties listed below:\n\n*Our data processors*: We may employ third party companies and individuals to facilitate our services, to provide the services on our behalf, to perform services related to administration of the services (including, without limitation, maintenance, hosting and database management services, and administration).These third parties may have access to your personal data only to perform these tasks on our behalf and under our instructions. They are contractually and legally bound not to disclose or use it for any other purpose.\n\n*Public administrations and authorities, including enforcement agencies*: In certain cases, we may be compelled by law or a court order to share personal data concerning you to a public administration, authority or enforcement agency.\n\n*To our legal advisers, as well as to courts of law*: for the establishment, exercise or defence of legal rights and claims.\n\n*Mergers and acquisitions*: AudienceProject may sell, transfer or otherwise share some or all of its assets, including your data, in connection with a merger, acquisition, reorganisation or sale of assets or in the event of bankruptcy. You will have the opportunity to opt out of any such transfer if the new entity ́s planned processing of your information differs materially from that set forth in this Privacy Policy."},{"level":1,"header":"Where do we store your personal data?","content":"The data we collect from you is stored by AudienceProject or our trusted service providers.\n\nYour data may be transferred to, accessed from, and stored at a destination outside the European Economic Area (EEA). It may also be processed by staff members operating outside the EEA who work for us or for one of our service providers.\n\nAudienceProject transfers personal data outside of the EEA only in a secure and lawful way. We are entering into appropriate contracts (based on the template adopted by the EU Commission).\n\nFor further information, you can contact us by e-mail at the e-mail address specified in the Contact section of this Privacy Policy."},{"level":1,"header":"How long do we keep your personal data?","content":"As a principle, we make sure to keep your data only for as long as this data is needed to provide you with the services you have selected, fulfill our legitimate business needs and comply with our legal obligations.\n\nWe will retain your personal data for the duration of our commercial relationship. We then retain your personal data in our active databases for the sole purpose of contacting you for marketing (e.g., newsletters, webinars, events), unless you opt-out from these communications.\n\nAt the end of these retention periods in our active databases, we may archive all or part of your personal data in a secure way for the duration of the applicable statute of limitations, or to comply with legal retention obligations (e.g., tax and accounting obligations)."},{"level":1,"header":"Is your personal data secure?","content":"We are committed to keeping your personal data secure, and taking all reasonable precautions to do so. We contractually require that trusted third parties who handle your personal data for us do the same.\n\nWe always do our best to protect your personal data and once we have received your personal data, we use strict procedures and security features to try to prevent unauthorized access.\n\nFor any further information, please read AudienceProject [Security Overview](https://privacy.audienceproject.com/en-GB/for-clients/security-overview)."},{"level":1,"header":"Your rights","content":"AudienceProject respects your right to privacy. In accordance with the General Data Protection Regulation (“GDPR”), you have the following rights:\n\n*The right to be informed*: you have the right to obtain clear, transparent, and easily understandable information about how we use your personal data, and your rights. This is why we are providing you with the information in this privacy policy.\n\n*The right of access*: you have the right to access the personal data we hold about you (subject to certain restrictions). In exceptional circumstances, we may reject your request or charge a reasonable fee for providing such access but only where permitted by law (for example where the requests are manifestly unfounded or excessive).\n\n*The right to rectification*: you have the right to have your personal data rectified if the concerned data is incorrect or outdated and/or completed if it is incomplete.\n\n*The right to erasure (also called the “right to be forgotten”)*: In some cases, you have the right to have your personal data erased or deleted. However, it is not an absolute right, as we may have legal or legitimate grounds for retaining your personal data.\n\n*The right to withdraw consent at any time for personal data processing based on consent*: you can withdraw your consent to our processing of your personal data when such processing is based on consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.\n\n*The right to object to processing based on legitimate interests*: you can object at any time to our processing of your personal data when such processing is based on the legitimate interest. In some circumstances, we may have the right to continue processing your personal data if we have a compelling legal ground to do so or for the establishment, exercise or defence of legal claims. You also have the right to object to processing carried out for marketing purposes, which include profiling related to such marketing purposes.\n\n*The right to restriction*: you have the right to request restriction of our processing of your data. This means that our processing of your personal data is restricted, so we can store it, but not use nor process it further. It applies in limited circumstances set out in the GDPR.\n\n*The right of data portability*: you have the right to move, copy or transfer personal data from our database to another. This only applies to personal data that you have provided, where processing is based on a contract or your consent, and the processing is carried out by automated means.\n\n*The right to object to direct marketing*: you have the right to unsubscribe or opt out of our marketing communications at any time. The easiest way to do this is usually by clicking on the “unsubscribe” link in any e-mail or communication we may send you or to contact us by e-mail at privacy@audienceproject.com.\n\n*The right to file a complaint with a supervisory authority*: you have the right to contact the data protection authority of your country in order to file a complaint against data protection and privacy practices of AudienceProject. The contact details of all the EU national supervisory authorities are accessible on the European Data Protection Board website. Do not hesitate to contact us before filing any complaint with the competent data protection authority."},{"level":1,"header":"Contact","content":"If you have any questions or concerns about how we process and use your personal data, or would like to exercise any of your rights, please contact us via e-mail at privacy@audienceproject.com or by writing to us at:\n\nAudienceProject A/S\nLegal department\nRyesgade 3F, 3 floor\n2200 Copenhagen\nDenmark\n\nYou can also contact our Data Protection Officer at dpo@audienceproject.com.\n\nLast updated: May 2024"}],"externalReleaseNotes":"Dear Customer, \n\nWe have updated our clients privacy policy. \n\nWe have provided additional information in the following sections:\n• What categories of personal data do we collect from you  \n• Why do we collect your personal data and our legal basis for the data processing \n• How long do we keep your personal data \n• Your rights \n\nThis is for your information only and no action is required.\n\nBest regards, \nTeam AudienceProject "},{"id":705,"type":"DataProcessingAgreement","product":null,"target":"Clients","culture":null,"version":"1.4","publishDate":"2024-02-02T13:17:31.677326","content":[{"level":1,"header":"","content":"This Data Processing Agreement (“DPA”) is an integral part of the Agreement entered into by and between Customer and AudienceProject and supplements section 6.3 of the General Terms and Conditions. \n\nAny capitalised terms not defined in this DPA shall have the meaning stated in the General Terms and Conditions. Terms defined under the Data Protection Laws shall have the meaning attributed to them by said laws."},{"level":1,"header":"1. Definitions","content":"1.1*Processed Personal Data*: means the categories of personal data processed by AudienceProject on behalf of Customer in accordance with the Processing Instructions. \n1.2*Data Protection Laws*: means all applicable laws and regulations pertaining to the processing of Personal Data and the privacy of electronic communications, including where applicable: the EU GDPR, the UK GDPR, the danish Data Protection Act, and any other applicable national implementing laws, regulations and secondary legislation relating to the processing of the Personal Data and the privacy of electronic communications, as amended, replaced or updated from time to time. \n1.3*EU GDPR*: means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). \n1.4*IAB Europe Transparency & Consent Framework (TCF)*: means an accountability tool that relies on standardisation to facilitate compliance with certain provisions of the EU ePrivacy Directive and the GDPR. It applies principles and requirements derived from these two legislative instruments to the specific context of the online industry, taking account of relevant EU-level guidance from the European Data Protection Board (EDPB) and national level guidance from supervisory authorities. \n1.5*Processing Instructions*: has the meaning attributed to it in section 3.1 of the DPA. \n1.6*Security Incident*: means a breach of AudienceProject's security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Processed Personal Data.  \n1.7*UK GDPR*: means the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018. \n1.8*Processing Operations*: means the processing operations carried out by AudienceProject on behalf of Customer in accordance with the Processing Instructions."},{"level":1,"header":"2. General provisions","content":"2.1*Purpose of this DPA*\nThe purpose of this DPA is to define the obligations of the Parties with regard to the Processing Operations. \n2.2*Roles of the Parties* \nCustomer is the data controller of the Processing Operations or acts as a first-level processor on behalf of the data controller, and as such determines the purposes and means of the Processing Operations (directly or on behalf of the data controller). AudienceProject acts on behalf and under the instructions of Customer as a processor (where Customer is the data controller) or sub-processor (where Customer is a processor)."},{"level":1,"header":"3. Processing Instructions","content":"3.1*Provision of instructions by Customer*\nThe characteristics of the Processing Operations, which shall constitute Customer's instructions at the date hereof (the \"Processing Instructions\"), are detailed in the Annex. During the term of the Agreement, Customer undertakes to formulate and, if necessary, update in writing the Processing Instructions and more generally to document in writing any additional instructions relating to the processing of personal data expected of AudienceProject in performance of the Agreement, which shall also constitute Processing Instructions. AudienceProject cannot be held liable for non-compliance with any instruction that has not been documented in writing by Customer. \n3.2*Compliance by AudienceProject* \nAudienceProject will process personal data in accordance with the Processing Instructions and the other terms of this DPA, unless it is obliged to do otherwise by law. In such case, it will inform Customer of this obligation prior to its implementation unless the relevant law prohibits such information. \nTo facilitate and ensure compliance with Data Protection Laws, AudienceProject undertakes to participate in the IAB Europe Transparency & Consent Framework as a Vendor. \n3.3*Lawfulness of Processing Instructions*\nCustomer represents and warrants that it has ensured the lawfulness of the Processing Instructions and, more generally, of the characteristics of the processing operations covered by this DPA with regard to the Data Protection Laws. Without prejudice to the foregoing, if AudienceProject considers that a Processing Instruction constitutes a breach of the Data Protection Laws, it will inform Customer accordingly. However, AudienceProject shall not be obliged to carry out in-depth legal analyses of the Processing Instructions. The Parties may exchange positions, but the final decision will be taken by Customer under its own responsibility. \n3.4*Security and improvement of the Services* \nCustomer acknowledges and agrees that AudienceProject may process on its own behalf the Processed Personal Data: (i) to ensure, detect, prevent, address security and/or technical incidents and investigate fraud, spam, wrongful or unlawful use of the Services, and (ii) to develop and improve its products and services."},{"level":1,"header":"4. Confidentiality Obligations of AudienceProject Employees","content":"AudienceProject will ensure that the persons under its responsibility and control that are authorised to process personal data as part of the Processing Operations: (i) are aware of the confidential nature of the Processed Personal Data and are contractually bound to keep the Processed Personal Data confidential; as well as (ii) have received appropriate training on their responsibilities."},{"level":1,"header":"5. Technical and Organisational Security Measures","content":"5.1 AudienceProject has implemented and will maintain appropriate technical and organisational security measures as set forth in AudienceProject Security Overview (currently posted at https://privacy.audienceproject.com/en-GB/for-clients/security-overview).\n5.2 Organisational measures include, without limitation: (i) regular review and update of privacy and security policies and guidelines, (ii) provision of privacy and security awareness training for employees across the company, and (iii) close collaboration with AudienceProject Data Protection Officer. \n5.3 Technical measures include, without limitation and where relevant: (i) pseudonimization and encryption of personal data, (ii) measure to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services, (iii) measures to ensure the ability to restore the availability and access to personal data in a timely manner in the event of physical or technical incident, (iv) processes for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures, (v) measures for ensuring physical security of locations at which personal data are processed, (vi) measures to restrict access to AudienceProject's IT systems and records in accordance with least privilege principles based on employees roles and responsibilities, (vii) measures to ensure protection of IT systems, (viii) measures to ensure the protection of the data during transmission and storage, (ix) measures to monitor events logging and (x) measures to allow data portability and ensure data deletion. \n5.4 Contractual measures include, without limitation: (i) confidentiality agreement signed by the employees, and (ii) regular review and update of commercial and privacy related agreements. \n5.5 In the event that changes in legal and regulatory requirements and/or the positions and recommendations of the supervisory authorities with regard to technical and organisational measures would render AudienceProject's obligations described in this section more onerous, the Parties undertake to exchange in order to find an amicable solution with regard to the adjustments to be made, including with regard to AudienceProject's remuneration. \n5.6 Customer acknowledges that the Services include certain features and functionalities that Customer may elect to use which impact the security of the Processed Personal Data, such as, but not limited to, account security settings, management/deletion of customer users on Customer's account and API integration. Customer is responsible for properly configuring and using the Services, including all the features and functionalities made available by AudienceProject to maintain appropriate security."},{"level":1,"header":"6. Cooperation","content":"6.1 AudienceProject will reasonably assist Customer in carrying out data protection impact analyses and, where applicable, prior consultation with the competent data protection authority. \n6.2 AudienceProject will provide Customer, within a reasonable period of time and upon Customer's written request, with all the information in its possession that is necessary to demonstrate the compliance of the Processing Operations it carries out under this DPA. \n6.3 If AudienceProject is required to assign significant resources to the foregoing tasks, Customer will be charged at AudienceProject's then-current rates. In such case, AudienceProject will notify Customer in advance. \n6.4 AudienceProject will notify Customer of any request or complaint regarding the Processing Operations, which impacts Customer, unless such notification is not permitted under applicable law or a court order. \n6.5 AudienceProject confirms that it has appointed a Data Protection Officer. The appointed Data Protection Officer may be contacted by email at: dpo@audienceproject.com."},{"level":1,"header":"7. Audits","content":"7.1 Customer agrees to a mutually agreed-upon audit plan with AudienceProject that: (i) ensures the use of an independent third party (not a competitor to AudienceProject) at Customer’s sole cost; (ii) notifies AudienceProject via written notice in a timely fashion of any audit and in any case notifies AudienceProject no later than one month prior to the starting date of the audit; (iii) requests access only during Audience Project’s business hours; (iv) if significant resources are required, Customer accepts being invoiced at AudienceProject then-current rates for the assistance provided; (v) occurs no more than once per contractual year; (vi) limit the scope of any audit to the information and documentation strictly relevant and necessary for the purpose of the audit; (vii) excludes access to any information pertaining to other clients of AudienceProject; (viii) excludes access to any information whose confidential nature is protected by law, including without limitation: attorney-client communications and other privileged information, trade secrets, etc.; (ix) excludes access to any information that AudienceProject is precluded from sharing with Customer under a contractual duty of confidentiality signed with a third party. \n7.2 Prior to the audit, Customer and the auditor must sign a confidentiality agreement. In particular, the auditor undertakes to use the information communicated solely in the course of and for the purpose of carrying out the audit. \n7.3 AudienceProject shall, in accordance with the mutually agreed-upon plan, provide Customer with all the information necessary for the audit initiated by Customer, to the extent that such information is within AudienceProject's control and that AudienceProject is not precluded from disclosing it by applicable law. \n7.4 The audit report must be sent to AudienceProject within fifteen (15) business days of the end of the audit. AudienceProject may make any comments on the audit report within fifteen (15) business days, which will be included in the final report. The Parties will meet and discuss any measures to be implemented following the audit."},{"level":1,"header":"8. Security Incident","content":"8.1 AudienceProject will (i) notify Customer of a security Incident without undue delay after becoming aware of it; (ii) take appropriate measures, as far as possible and taking into account the seriousness of the incident, its duration, and the technical resources required, to remedy the Security Incident, including measures to mitigate any adverse effects resulting from the Security Incident. \n8.2 The notification to Customer will be accompanied or completed at a later date, as far as possible, by all useful information available to AudienceProject in order to enable Customer to assess the nature and consequences of the data breach, to notify the competent supervisory authority and, where applicable, the persons concerned. It is the sole responsibility of Customer (or the data controller on whose behalf it is acting) to notify, where appropriate, personal data breaches to the competent data protection authority and to the data subjects."},{"level":1,"header":"9. Sub-Processor(s)","content":"9.1 Customer generally authorises AudienceProject's use of sub-processors to carry out any and all part(s) of the Processing Operations, in accordance with this section. \n9.2 Where AudienceProject wishes to appoint a sub-processor under this DPA, AudienceProject will select such sub-processor with due diligence and will verify prior to engaging the sub-processor that it is capable of complying with equivalent, or more onerous obligations as that biding upon AudienceProject under this DPA, as relevant in relation to the processing operations assigned to that sub-processor. This shall include, without limitation, the obligation for AudienceProject to verify, prior to engaging the sub-processor, that it has taken and will take the appropriate technical and organisational measures to protect the Processed Personal Data. \n9.3 The list of sub-processors that are engaged by AudienceProject as of the effective date of the Agreement is presented on AudienceProject's website (currently posted at https://gdpr.audienceproject.com/sub-processors/). Before engaging a new sub-processor and updating the list aforementioned, AudienceProject shall inform Customer in writing. Customer shall have a period of five (5) business days following the notification of the change to raise any written and reasoned objections to the proposed change. In the event that Customer objects to the addition of a subsequent sub-processor that is essential for the provision by AudienceProject of the services requested by Customer, on the grounds of expertise, material capacity, market positioning and/or any other objective criteria communicated by AudienceProject to Customer, AudienceProject may not be held liable in the event of impossibility or failure in the provision of all or part of the services concerned. Furthermore, the Agreement will be terminated automatically with respect to those Services which cannot be provided by AudienceProject without the use of a new sub-processor."},{"level":1,"header":"10. Data Subject Requests","content":"It is the sole responsibility of Customer (or of the data controller on whose behalf Customer is acting) to answer requests of data subjects related to the Processing Operations. Without prejudice to the foregoing, AudienceProject will provide reasonable assistance, including by using appropriate technical and organisational measures and taking into account the nature of the Processing Operations, to enable Customer to respond to any request from data subjects seeking to exercise their rights under Data Protection Laws with respect to personal data. If a data subject makes a request directly to AudienceProject, AudienceProject will promptly forward such request to Customer provided that AudienceProject can identify that the request is from a data subject for whom Customer is responsible."},{"level":1,"header":"11. Deletion of Customer Data","content":"11.1*Deletion at the end of the Processing Operations*\nOn expiry of the processing periods specified in the Processing Instructions, AudienceProject will delete all personal data processed under this DPA or return them to Customer or any third party designated by Customer, depending on Customer's choice expressed in writing. Once these operations have been completed, AudienceProject will destroy any existing copies. The foregoing is without prejudice to the possibility for AudienceProject to retain Processed Personal Data as data controller for the limited purposes described in section 3.4, as well as to archive Processed Personal Data in order to comply with a legal obligation of retention/or for establishment, exercise or defence of legal claims, in this last case for the duration of the applicable statutes of limitations. \n11.2*Deletion of Customer Data prior to the termination of the Agreement* \nIn the event that Customer requires AudienceProject to delete Processed Personal Data prior to the processing periods specified in the Processing Instructions, AudienceProject will use reasonable endeavours to facilitate such deletion, insofar as this is possible taking into account the nature and functionality of the Services. AudienceProject may charge a fee for any data deletion request under this section 11.2. In such a case, AudienceProject will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such data deletion. The foregoing is without prejudice to the possibility for AudienceProject to retain Processed Personal Data as described in the previous subsection."},{"level":1,"header":"12. Restricted Transfers","content":"The following conditions must be met prior to any transfer by AudienceProject of personal data processed on behalf of Customer to a country outside the European Union that has not been the subject of a partial or total adequacy decision by the European Commission: \n- Obtain Customer's written authorisation. On the date the Agreement is signed, Customer authorises the transfers  of personal data to AudienceProject's sub-processor(s) currently listed at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/).\n- Where data exporter is located in the EU: Implement one of the appropriate safeguards referred to in Article 46 of the GDPR; \n- Where necessary, implement additional technical and/or organisational measures to ensure that the rights of persons whose personal data is transferred to a third country are effectively protected to a level substantially equivalent to that guaranteed within the European Union, taking into account the risks identified with regard to possible access by the public authorities of the third country concerned following analysis of the relevant elements of that country's legal system."},{"level":1,"header":"13. Amendment","content":"No variation of this DPA shall be effective unless it is in writing and signed by the Parties."},{"level":1,"header":"Annex - Processing Instructions","content":""},{"level":2,"header":"Subject-matter","content":"Provide the Services."},{"level":2,"header":"Nature","content":"Processing operations including the collection, recording, organisation, storage, retrieval, consultation, use, communication by transmission, dissemination, reconciliation or interconnection, and erasure of personal data."},{"level":2,"header":"Purposes","content":"Enable AudienceProject to perform the Services specified in the Agreement and comply with its legal obligations, which may include the following purposes depending on the Services selected in the Order Form: \n\n- Select basic ads, \n- Create a personalised ads profile, \n- Select personalised ads, \n- Create a personalised content profile, \n- Select personalised content, \n- Measure ad performance, \n- Measure content performance, \n- Apply market research to generate audience insights, \n- Ensure security, prevent fraud, and debug, \n- Technically deliver ads or content, \n- Process and combine AudienceProject panelists data with Customer data to deliver market reports and studies, \n- Enable end-users to exercise their rights."},{"level":2,"header":"Categories of Data Subjects","content":"End-users exposed to ad campaigns measured by AudienceProject on behalf of Customer."},{"level":2,"header":"Categories of Personal Data","content":"Information on the browsing and the device used by the end-user, including: \n- IP address and approximate general locations derived from the IP address, \n- Date and time stamps, \n- Device type, \n- Browser type, \n- Operating systems, \n- Referring pages, \n- Device identification ID and/or advertising ID, \n- Local storage objects and event/clickstream data, \n- Transparency consent string."},{"level":2,"header":"Sensitive Data or Special Categories of Data","content":"Customer will not and will not assist or permit any third party to, collect or pass information to AudienceProject that is deemed ‘sensitive’ as outlined in the EU GDPR or any other applicable data protection law or regulation.\n\nSensitive data usually includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health, sex life, or sexual orientation.\n\nGenerally, the collection and processing of sensitive data are prohibited unless a project-specific addendum has been created and approved by both Parties."},{"level":2,"header":"Duration of Processing","content":"The shorter term between (i) 5 years from data collection; and (ii) 30 days after the termination of the Agreement, without prejudice to the storage by AudienceProject of data in its back-up systems up to 180 days."},{"level":2,"header":"Sub-processor(s)","content":"List of sub-processor(s): [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/).\n\nLast updated: January 2024"}],"externalReleaseNotes":""},{"id":2249,"type":"AcceptableUsePolicy","product":null,"target":"Clients","culture":null,"version":"1.1","publishDate":"2024-05-30T11:44:23.539398","content":[{"level":1,"header":"","content":"This Acceptable Use Policy (“*AUP*”) applies to all clients, users, and panelists (“*you*”) accessing, using or taking part in AudienceProject services.\n\nBy accessing, using or taking part in AudienceProject services, you agree to be bound by the terms of this AUP. \n\nThe term “services” refers to all websites owned or operated by AudienceProject, and any related websites, sub-domains and pages, as well as any cloud services operated by AudienceProject.\n\nAudienceProject (“*we*”, “*our*”, \"*us*\") may change this AUP from time to time. All changes will be effective at the time we post them and the date of this AUP will be updated accordingly. \n\nTo keep the services running safely and smoothly, we need our clients, users and panelists to agree not to misuse them.\n\nSpecially, *you agree not to*:\n\n* compromise the integrity of our systems. This includes probe, scan, or test the vulnerability of any system or network used with the services;\n* tamper with, reverse-engineer or hack the services, circumvent any security or authentication measures of the services or attempt to gain unauthorized access to the services (or any portion thereof) or related systems, networks or data;\n* modify, disable or compromise the integrity, security or performance of the services or related systems, network or data;\n* overwhelm or attempt to overwhelm our infrastructure by imposing an unreasonably large load on our systems that consume extraordinary resources, for example by going far beyond the use parameters for any given service as described in its corresponding documentation or exceeding its limits;\n* use our services for any illegal purposes, or in violation of any laws (including without limitation privacy and data protection laws);\n* use the services for the collection, storage or processing of any personal data unless you have received prior consent of the natural person whose personal data is being used or can rely on another valid legal basis, and provided you remain fully responsible for such processing operations;\n* share or otherwise disclose personal data to which you may have access through our services to any third party, unless such disclosure is permitted under a contract or the law, you have implemented adequate measures to ensure the confidentiality and security of the disclosed personal data, and you remain fully responsible for such disclosure;\n* use our services in breach of our legal rights or the legal rights of others, including without limitation, third parties intellectual property rights;\n* misrepresent yourself or disguise the origin of any data, content or other information you submit (including by “spoofing”, “phishing”, manipulating headers or other identifiers, impersonating anyone else, or falsely implying any sponsorship or association with AudienceProject or any third party) or access the services via another user’s account without its permission;\n* use the services to generate or send unsolicited communications or advertising without the valid consent of the recipient, or to generate or send any other kind of spam;\n* use our services or take part in our panels if you are under 18 years old;\n* we reserve the right to refuse the use of email extensions such as gmail.com or hotmail.com and limit accepted domains to corporate email addresses.\n\n\nWithout affecting any other remedies available to us, AudienceProject may permanently or temporarily terminate or suspend a user’s account or access to the services without notice or liability if AudienceProject (in its sole discretion) determines that a client, a user or a panelist has violated this Acceptable Use Policy.\n\nLast updated: May 2024"}],"externalReleaseNotes":"Dear User, \n\nWe have updated our Acceptable User Policy. \n\nWe have clarified the wording of this policy and made changes to reinforce the security of our services. \n\nThis is for your information only and no action is required. \n\nBest regards, \nTeam AudienceProject "},{"id":32416,"type":"SecurityOverview","product":null,"target":"Clients","culture":null,"version":"1.1","publishDate":"2024-07-03T12:50:53.265542","content":[{"level":1,"header":"","content":"This AudienceProject Security Overview (“Security Overview”) is incorporated into AudienceProject Data Processing Agreement. Any capitalized term used but not defined in this Security Overview will have the meaning given to it in either the Agreement or the Data Processing Agreement."},{"level":1,"header":"1. Purpose","content":"This Security Overview describes AudienceProjects security program, security certifications, and technical and organizational security controls to protect (a) Customer Data from unauthorized use, access, disclosure, or theft and (b) the Services. As security threats shift and evolve, AudienceProject continues to update its security program and strategy to help protect Customer Data and the Services.\n\nAs such, AudienceProject reserves the right to update this Security Overview from time to time, provided however, any update will not materially reduce the overall protections set forth in this Security Overview. This Security Overview does not apply to any Beta Offerings."},{"level":1,"header":"2. Security organization and program","content":"AudienceProject maintains a risk-based assessment security program. The framework for AudienceProject's security program includes technical, organizational, legal, physical, and human resource safeguards and controls designed to protect the Services and the confidentiality, integrity, and availability of Customer Data.\n\nAudienceProject’s security program is intended to be appropriate to the nature of the Services and the size and complexity of AudienceProject's business operations. AudienceProject has a separate and dedicated Security and Privacy Team that manages AudienceProject's security program.\n\nAudienceProject's Information Security Management System includes programs covering: Data security and information protection, Asset Management, Governance, Access Control, Protective Technology, Recovery and Response planning, and Privacy.\n\nSecurity is managed at the highest levels of the company. AudienceProject’s DPO and a cross-functional privacy & IT security team meets every month to discuss, coordinate, review, and approve policies and standards."},{"level":1,"header":"3. Confidentiality","content":"AudienceProject has controls in place to maintain the confidentiality of Customer Data in accordance with the Agreement. AudienceProject seeks the highest level of confidentiality in agreements with AudienceProject employees within the confines of local employment law."},{"level":1,"header":"4. People security","content":"Standard security training and awareness programs are in place for high-risk teams that handle data directly or that handle infrastructure containing data. Additional training programs are activated if an employee is assigned to a high-risk project with special security requirements. Case-by-case, we develop special training material in such circumstances that match the requirements of the project.\n\nAt least once a year, all AudienceProject employees must complete a security and privacy questionnaire which covers AudienceProject security policies, privacy principles and phishing."},{"level":1,"header":"5. Third party vendor management","content":""},{"level":2,"header":"5.1 Vendor assessment","content":"AudienceProject may use third party vendors to provide the Services. AudienceProject carries out a security risk-based assessment of prospective vendors before working with them to validate that they meet AudienceProjects security and privacy requirements. AudienceProject ensures that Customer Data is returned and/or deleted at the end of a vendor relationship."},{"level":2,"header":"5.2 Vendor agreements","content":"AudienceProject enters into written agreements with all of its vendors which comply with applicable Data Protection Laws, including article 28 of the GDPR."},{"level":1,"header":"6. Architecture and data segregation","content":""},{"level":2,"header":"6.1 Services","content":"The cloud communication platform for the Services is hosted by Amazon Web Services (“AWS”). The AWS data center infrastructure used in providing the Services is located in both the United States and Europe. AudienceProject IT systems security leverage AWS security measures, which therefore form part of  AudienceProject overall security framework. Additional information about security provided by AWS is available at [amazon.com](https://aws.amazon.com/architecture/security-identity-compliance/). AudienceProject separates Customer Data using logical identifiers which tag Customer Data with a unique customer identifier that is assigned to Customer to clearly identify ownership. The AudienceProject APIs are designed and built to identify and allow access only to and from these identifiers. These controls prevent other customers from having access to Customer Data."},{"level":2,"header":"6.2 Security by Design","content":"AudienceProject follows security by design principles when it designs the Services. AudienceProject also applies the CIS security framework to perform numerous security-related activities for the Services. These activities include, but are not limited to, the performance of (a) internal security reviews before new Services are deployed; (b) penetration tests performed on Services at least once a year; and (c) continuous automated security scanning of Services used to detect any potential security threats and vulnerabilities."},{"level":1,"header":"7. Access controls","content":""},{"level":2,"header":"7.1 Provisioning access","content":"To minimize the risk of data exposure, AudienceProject follows the principles of least privilege through a team-based-access-control model when provisioning system access. AudienceProject personnel are authorized to access Customer Data based on their job function, role and responsibilities. Access rights to production environments are reviewed at least semi-annually. An employee’s access to Customer Data is promptly removed upon termination of their employment. In order to access the production environment, an authorized user must have a unique username and password, multi-factor authentication and be connected to AudienceProjects Virtual Private Network (VPN). Before an engineer is granted access to the production environment, access must be approved by the Technology team lead and the engineer is required to have completed internal training for such access, including training on the relevant team’s systems. AudienceProject logs high risk actions and changes in the production environment. AudienceProject leverages automation to identify any deviation from internal technical standards that could indicate anomalous/unauthorized activity to raise an alert within minutes of a configuration change."},{"level":2,"header":"7.2 Technical infrastructure","content":"In addition to AWS CIS foundations Benchmark (Identity and Access Management) AudienceProject has enforced a Bastion Account Principle to separate environments, services and users in combination with temporary allocation of 2FA."},{"level":2,"header":"7.3 Physical security","content":""},{"level":2,"header":"7.3.1 AWS data centers","content":"AWS data centers that host the Services are strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication (2FA) to access data centers. All visitors and contractors must have been granted a third-party access authorisation, are required to present identification and are signed in and continually escorted by authorized staff. These facilities are designed to withstand adverse weather and other reasonably predictable natural conditions. Each data center has redundant electrical power systems that are available twenty-four (24) hours a day. Data centers are equipped with back-up power supply to ensure power is available to maintain operation in the event of an electrical failure for critical and essential loads in the facility.\n\nFor more information about AWS data centers physical security, please refer to Amazon Data Centers Controls portal currently posted at [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)."},{"level":2,"header":"7.3.2 AudienceProject premises","content":"AudienceProject headquarters has badge access requirements that log employees entering and leaving premises, as well as CCTV coverage for access in/out of the premises. All visitors are required to digitally log in/out of the premises."},{"level":2,"header":"7.4 Password controls","content":""},{"level":2,"header":"7.4.1 Password controls for employees","content":"AudienceProject requires that all passwords and access credentials are kept confidential and not shared among personnel. \n\nAudienceProject's policy for employee password management has the following requirements; (a) Complex passcode, (b) Alphanumeric Value, (c) Minimum length, (d) Maximum passcode Age, (e) Passcode History, (f) Maximum Auto-lock, (g) Maximum grace period for Computer lock, (h) Maximum number of failed attempts in additional to 2FA on main Internal Enterprise Services."},{"level":2,"header":"7.4.2 Password controls for customers","content":"For Customer Services, SSO and 2FA is available and managed by the Customers administrator on their account."},{"level":1,"header":"8. Security certifications","content":"AudienceProject's platform is designed on top of the AWS Cloud platform, which comes with robust controls in place and a comprehensive set of certifications for AWS to maintain security and compliance in the cloud. Through certified services, AudienceProject can maintain a high standard of security and compliance across our platform. Our unified Single Sign-on Service is based on AWS Cognito, which governs access to client's accounts as well as employee access. Through the use of AWS Cognito, we meet multiple security and compliance requirements, including those for highly regulated organizations such as healthcare companies and merchants. Single Sign-On is HIPAA eligible and PCI DSS, SOC, ISO/IEC 27001, ISO/EIC 27017, ISO/EIC 27018, and ISO 9001 compliant.\n\nFor a complete list of current certifications connected with the various services in use across the AudienceProject platform, please refer to the AWS Compliance Programs portal currently posted at [https://aws.amazon.com/compliance/programs/#Certifications.2FAttestations.3A.](https://aws.amazon.com/compliance/programs/#Certifications.2FAttestations.3A)\n\nWe maintain current SOC certificates from AWS covering the infrastructure where all data is stored and processed."},{"level":1,"header":"9. Change management","content":"AudienceProject has a formal change management process it follows to administer changes to the production environment for the Services, including any changes to its underlying software, applications, and systems. Each change is carefully reviewed and evaluated in a test environment before being deployed into the production environment for the Services. All changes are documented using a formal, auditable, system of record. A rigorous assessment is carried out for all high-risk changes to evaluate their impact on the overall security of the Services. Deployment approval for high-risk changes is required from the correct organizational stakeholders. Plans and procedures are also implemented in the event a deployed change needs to be rolled back to preserve the security of the Services."},{"level":1,"header":"10. Encryption & Pseudonymisation","content":"AudienceProject operates through Amazon Web Services and uses encryption in transit and encryption at rest for all relevant Amazon Web Services services and various pseudonymization techniques."},{"level":2,"header":"10.1 Encryption","content":"AudienceProject applies AWS Key Management Service (KMS) with the following settings:\n\n* Usage of Customer Master Keys (CMKs): This means AudienceProject fully manages the encryption keys,\n\n* Usage of symmetric encryption keys: Data encrypted with these keys (AES-256-GCM) is considered to be quantum-resistant.\n\nTheoretical future large-scale quantum computing attacks on ciphertexts created under 256-bit AES-GCM keys reduce the effective security of the key to 128 bits. But, this security level is sufficient to make brute force attacks on AWS KMS ciphertexts infeasible."},{"level":2,"header":"10.2  Pseudonymization","content":"This technique is applied on various levels throughout our infrastructure, including but not limited to: using 128-bit randomly generated alphanumeric values for identifying users, SHA-256 hashing of PII information (e.g. email addresses etc.), obfuscation of IP addresses by removing the last several bits or tokenization and encryption of data by default."},{"level":1,"header":"11. Vulnerability management","content":""},{"level":2,"header":"11.1 Vulnerability scans","content":"AudienceProject maintains controls and policies to mitigate the risk of security vulnerabilities in a measurable time frame that balances risk and the business/operational requirements. AudienceProject uses a third-party tool to conduct vulnerability scans regularly to assess vulnerabilities in AudienceProjects cloud infrastructure and corporate systems. AudienceProject exclusively uses AWS services to quickly and efficiently scale its services. Almost all AWS services are based on the Software-as-a-Service (SaaS) model, which means that AudienceProject does need to manage the environment in which their services operate. Besides that, the Serverless Architecture paradigm is applied whenever possible. This alleviates the need for patch management. All source code is reviewed and scanned automatically to detect security vulnerabilities. Third-party libraries are monitored for known security flaws. All infrastructure is continuously monitored for CIS compliance."},{"level":2,"header":"11.2 Penetration testing","content":"AudienceProject performs penetration tests to conduct application-level penetration tests. Security threats and vulnerabilities that are detected are prioritized, triaged, and remediated promptly."},{"level":1,"header":"12. Security and privacy incident management","content":""},{"level":2,"header":"12.1 Incident management","content":"AudienceProject maintains security incident management policies and procedures as outlined in a Data Breach and Information Security Incident Policy. AudienceProject’s Security Incident Response Team (SIRT) assesses all relevant privacy and security events and incidents according to a 6-step process (Detection, Analysis & Priority, Contain, Eradicate, Recover, Post-incident Activities) and record the event/incident in a security log."},{"level":2,"header":"12.2 Incident response","content":"SIRT will, according to the communication protocol as outlined in the Data Breach and Information Security Incident Policy, notify relevant parties. To the extent required by applicable law and in accordance with the Agreement and the Data Processing Agreement, AudienceProject shall use reasonable efforts to provide notice to customers, and, where AudienceProject is the data controller, data protection authorities and data subjects (if necessary depending on the incident) about a Security or Privacy Incident or Data Breach."},{"level":1,"header":"13. Resilience and service continuity","content":"The Services use a variety of tools and mechanisms to achieve high availability and resiliency. For the Services, AudienceProject’s infrastructure spans multiple fault-independent AWS availability zones physically separated from one another. AudienceProject uses Serverless Architecture wherever possible. This means that high availability and resilience are managed by AWS. For critical Services,  AudienceProject’s infrastructure is able to detect and route around issues experienced by APIs and endpoints in real time. AudienceProject also leverages tools that monitor server performance, data, and traffic load capacity within each availability zone. If suboptimal server performance or overloaded capacity is detected on a server within an availability zone, these tools increase the capacity or shift traffic to relieve any suboptimal server performance or capacity overload. AudienceProject is also immediately notified in the event of any suboptimal server performance or overloaded capacity."},{"level":1,"header":"14. Backup and recovery","content":"AudienceProject performs regular backups of Customer Data, which is hosted on AWS’s data center infrastructure. Customer Data that is backed up is retained redundantly across multiple availability zones and encrypted in transit and at rest using Advanced Encryption Standard (AES-256). AudienceProject has a Disaster Recovery plan for every critical and public oriented service. Applications are built stateless and can easily be recreated in different AWS regions if required. Stateful components are replicated or backed up to a backup location in different AV zones. AudienceProject has default retention periods for server (7 days) and database backup (30 days) while critical services can have retention periods expanding beyond the defaults."},{"level":2,"header":"14.1 Disaster recovery / high availability strategy for our environment","content":"AudienceProject has a disaster recovery plan for every critical and public-oriented service which is reviewed on a regular basis.\n\nMost AWS services already provide high availability, and AudienceProject tries to utilize such services as much as possible.\n\nAll our applications are built stateless by using Cloud-formation templates and can be easily recreated in different AWS regions. Stateful components like critical data in S3 buckets or Databases are replicated or backed up to a backup location in a different AV zone;\n\n* Our default retention period for server backups is seven days\n* Our default retention period for database backups is 35 days\n* Special retention periods can be defined by individual agreements/contracts on a client-basis\n\nCritical services might have custom retention periods assigned that expand beyond the default retention periods."},{"level":2,"header":"14.2 Offsite storage policy and procedures","content":"AudienceProject keeps encrypted backup copies of all data ingested in the ecosystem through the AWS S3 service and AWS Glacier. The nature of the AudienceProject processing pipeline allows for the recovery of any kind of aggregated data through the reprocessing of raw data. Moreover, automated backup processes are also in place for aggregated data."},{"level":2,"header":"14.3 Backups of customer systems and data","content":"Backup media and restoration procedures are tested at least annually. Backup and replication errors are reviewed and resolved as required.\n\nApplication data is stored on resilient storage that's replicated across data centers. In addition to platform-wide resiliency, we also have a comprehensive backup program for our platform offerings. Our backups are within the AWS S3 and Glacier Services, and we rely on the AWS SOC2 certification for validation.\n\nAll custom services that require high availability are designed and built in such a way that data and services are replicated across different AWS AV zones. As a general design principle, we utilize database replication, S3 bucket replication, and versioning, EC2 snapshotting and other similar techniques made available in AWS. Critical data is backed up to off-site backup servers across sour different AV zones."},{"level":1,"header":"15. Data minimization","content":"A key principle of data protection is 'data minimization, i.e., if data is not collected, the risk of its future misuse is automatically reduced.\n\nAs a rule of thumb, we adhere to data minimization principles first and foremost. Only data points that serve a specific purpose should be collected and processed. Anonymization and pseudonymization are deployed throughout systems whenever possible. We prefer to use a) hashed whenever possible,but also b) Cohort aggregation is increasingly used as well for data minimization or anonymization purposes."},{"level":1,"header":"16. Data retention","content":""},{"level":2,"header":"16.1 Data deletion","content":"Being a SaaS platform service, AudienceProject Customers can determine as data controllers what Customer Data they route through the AudienceProject Services and how the Services are configured. If a Customer is unable to delete Customer Data via the self-service functionality of the Services, then AudienceProject can delete Customer Data upon the Customer's written request, within the timeframe specified in the Agreement or Customer’s specific written instruction."},{"level":2,"header":"16.2 Data storage","content":"AudienceProject utilizes AWS S3 buckets which are configured with a so-called S3 Lifecycle configuration. A Lifecycle configuration is a set of rules that define actions that AWS S3 applies to a group of objects. Including backup retention times and eventual deletion / decommissioning of data."},{"level":2,"header":"16.3 Decommissioning of data-assets","content":"AudienceProject assets hosted on AWS are centrally managed through an inventory management system that stores and tracks owner, location, status, maintenance, and descriptive information. Following procurement, assets are scanned and tracked, and assets undergoing maintenance are checked and monitored for ownership, status, and resolution. Media storage devices used to store customer data are classified as Critical and treated accordingly as high impact throughout their life-cycles. Standards are defined on how to install, service, and eventually destroy the devices when they are no longer useful. When a storage device has reached the end of its useful life, media are decommissioned using techniques detailed in NIST 800-88. Media that stored customer data is not removed from hosting control until it has been securely decommissioned."},{"level":1,"header":"17. Data quality","content":"AudienceProject has a wide range of procedures to ensure that records containing personal data are accurate, adequate, and not excessive.\n\nSeveral measures are in place across different services."},{"level":2,"header":"17.1 Automated checks","content":"AudienceProject has deployed a series of automatic checks that operate in real-time without human intervention. Extensive inactivity checks are deployed on the user profile level, allowing our systems to automatically identify and ultimately delete unused or invalid user profiles. Mail responses from both end-users and mail servers are automatically analyzed, and appropriate action is taken if e-mails are flagged for spam or discontinued."},{"level":2,"header":"17.2 Data quality reviews","content":"AudienceProject conducts regular data quality reviews of records containing personal data to ensure they are accurate, adequate, and not excessive. Our employees are made aware of data quality issues following data quality checks or audits to prevent a recurrence. Records containing personal data (whether active or archived) are 'weeded' periodically to reduce inaccuracies and excessive retention risks."},{"level":2,"header":"17.3 Coding practices","content":"Our coding practices also have a three-fold approach for ensuring data quality. These measures include: (i) unit testing to ensure the quality of logic used to make API calls, (ii) volume testing to ensure the code is able to scale, and (iii) daily end-to-end testing to ensure that the input values match expected values. AudienceProject applies these measures across the board, both to ensure the quality of data used with the services."},{"level":2,"header":"17.4 Customer self-service functionalities","content":"Our SaaS approach allows our customers to review and update their information directly through either a self-service user interface or our comprehensive suite of API."},{"level":1,"header":"18. System and event logging","content":""},{"level":2,"header":"18.1 CIS Foundation Benchmark","content":"Logging of system events is enabled and configured according to the CIS standards outlined in CIS Foundations Benchmark Framework. A more detailed overview of logging compliance can be found at [https://www.cisecurity.org/benchmark/amazonwebservices/](https://www.cisecurity.org/cis-benchmarks)."},{"level":2,"header":"18.2 AWS CloudTrail","content":"AudienceProject utilizes AWS CloudTrail for logging. CloudTrail automatically records and stores event logs for actions made within our systems and accounts. CloudTrail logs a range of API activity events. This means that each time the API of one of our services is invoked, CloudTrail stores this information. As soon as we start using a new AWS service, its events are also automatically captured by CloudTrail. AWS documents the complete list of which events are captured for each individual service in [amazon.com](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html)."},{"level":2,"header":"18.3 AWS GuardDuty","content":"We also deploy the audit and logging policies provided by AWS GuardDuty. AWS GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior to help us protect our network accounts and workloads. It monitors for activity such as unusual API calls or potentially unauthorized deployments that indicate a possible account compromise.\n\nGuardDuty also detects potentially compromised instances or reconnaissance by attackers. GuardDuty identifies suspected attackers through integrated threat intelligence feeds and uses machine learning to detect account and workload activity anomalies. When a potential threat is detected, the service delivers a detailed security alert to our GuardDuty console."},{"level":1,"header":"19. System configuration","content":"AudienceProject applies Secure Software Development Lifecycle (Secure SDLC) standards to perform numerous security-related activities for the Services across different phases of the product creation lifecycle from requirements gathering and product design all the way through product deployment. These activities include, but are not limited to, the performance of (a) internal security reviews before new Services are deployed; (b) penetration testing; and (c) threat models for new Services to detect any potential security threats and vulnerabilities.\n\nAudienceProject adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems.\n\nAudienceProject utilizes AWS CloudFormation to simplify the provisioning and management of servers and services hosted on AWS. CloudFormation allows us to create standardized templates for the service or application architectures for quick and reliable provisioning of the services or applications (stacks) with default system configuration profiles embedded.\n\nAudienceProject utilizes a wide range of automated security configuration scans that scan our system security configurations in real-time according to CIS/AWS and internally defined configuration standards. AudienceProject adheres to the security configuration standards outlined in the CIS framework. Policies defining minimum baseline configuration standards and configuration change processes for information systems and security infrastructure is part of the CIS framework. Security scores are automatically updated and reported daily. Combined, the different security frameworks deployed cover more than a thousand daily security configuration checks."},{"level":1,"header":"20. Data subject rights","content":"AudienceProject Customers are responsible for responding to requests from their end-users who wish to exercise their rights under applicable Data Protection Laws. AudienceProject has built-in self-service functionality to the Services that allow Customers to delete and suppress certain Customer Data.\n\nIn addition, in accordance with AudienceProject Data Processing Agreement, we will provide assistance to Customers as may reasonably be required to comply with Customer's obligations under applicable Data Protection Laws to respond to requests from individuals to exercise their rights under applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability, and objection).\n\nAudienceProject is offering a wide range of data portability and data management tools, including:\n\n* Import and export tools. Businesses and organizations may access, delete and export their Campaign-Reports, Usability-reports, raw survey-answers in various formats (supports export in SAV, XLS, CSV), etc.\n* Data deletion tools, campaigns, surveys, custom segments, ideas, users, and user information can be modified and/or deleted.\n* User deletion tools. Customer administrators have full access to modify, invite and delete users and associated user information.\n* Privacy Portal to facilitate and process data subjects’ requests.\n* API functionality to programmatically access, modify, and export data and results."},{"level":1,"header":"21. Accountability","content":"As a European-based company, GDPR compliance is embedded from the highest management level and throughout our organization. We document and keep evidence of the steps and measures we take to comply with the GDPR.\n\nWe have put the appropriate technical and organizational measures in place, including for example:"},{"level":2,"header":"21.1 Organizational measures","content":"* Reviewing  and updating security and guidelines regularly (e.g., records of processing activities, data processing agreement, data breach and security incident policy, business continuity management and disaster recovery plan, etc).\n* Providing privacy and security training for employees across the company (e.g., workshops, guidelines, and questionnaires). \n* Recording and, where necessary, reporting personal data breaches.\n* Appointing an external Data Protection Officer (DPO)."},{"level":2,"header":"21.2 Physical and technical measures","content":"* Restricting access to our premises.\n* Restricting access to our IT systems and records based on employee’s position and work duties (least privilege principle). \n* Protecting our IT systems with the appropriate VPN, antivirus apps and firewalls.\n* Using hashing and encryption on various levels throughout our infrastructure."},{"level":2,"header":"21.3 Contractual measures","content":"* Signing data protection and confidentiality agreements with our employees.\n* Putting written contracts in place with organizations that process personal data on our behalf (e.g. Data Processing Agreement, SCCs, NDAs, etc).\n* Adhering to relevant codes of conduct and signing up to certification schemes like the IAB TCF consent framework (when possible).\n\nWe review and update our accountability measures at appropriate intervals. Additionally, AudienceProject conducts audits to ensure compliance with our privacy and security standards on an ongoing basis.\n\n\nLast updated: July 2024"}],"externalReleaseNotes":"Dear users, \n\nWe have updated our Security Overview. \n\nWe have provided additional information in the following sections: \n- Security organisation and program, \n- Confidentiality, \n- AWS data centers, \n- Security and privacy incident management, \n- Data subject rights, \n- Accountability. \n\nThis update will not materially reduce the overall protections set forth in the previous version of our Security Overview. \n\nThis is for your information only and no action is required. \n\nBest regards, \nTeam AudienceProject"},{"id":34071,"type":"StandardContractualClauses","product":null,"target":"Clients","culture":null,"version":"1.0","publishDate":"2022-10-27T07:41:31.442238","content":[{"level":1,"header":"Part 1 - Personal data protected by the EU GDPR","content":""},{"level":1,"header":"Module 2: Controller to Processor transfers","content":""},{"level":2,"header":"SECTION I","content":""},{"level":2,"header":"Clause 1","content":"*Purpose and scope*\n\n(a)\tThe purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.\n(b)\tThe Parties:\n\n(i)\tthe natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and\n(ii)\tthe entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)\nhave agreed to these standard contractual clauses (hereinafter: “Clauses”). \n\n(c)\tThese Clauses apply with respect to the transfer of personal data as specified in Annex I.B. \n(d)\tThe Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses."},{"level":2,"header":"Clause 2","content":"*Effect and invariability of the Clauses*\n\n(a)\tThese Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects. \n(b)\tThese Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679."},{"level":2,"header":"Clause 3","content":"*Third-party beneficiaries*\n\n(a)\tData subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:\n\n(i)\tClause 1, Clause 2, Clause 3, Clause 6, Clause 7;\n(ii)\tClause 8 - Clause 8.1(b), 8.9(a), (c), (d) and (e); \n(iii)\tClause 9 - Clause 9(a), (c), (d) and (e); \n(iv)\tClause 12 - Clause 12(a), (d) and (f);\n(v)\tClause 13;(vi)\tClause 15.1(c), (d) and (e);\n(vii)\tClause 16(e);\n(viii)\tClause 18 - Clause 18(a) and (b);\n\n(b)\tParagraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679."},{"level":2,"header":"Clause 4","content":"*Interpretation*\n\n(a)\tWhere these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.\n(b)\tThese Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.\n(c)\tThese Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679."},{"level":2,"header":"Clause 5","content":"*Hierarchy*\n\nIn the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail."},{"level":2,"header":"Clause 6","content":"*Description of the transfer(s)*\n\nThe details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B."},{"level":2,"header":"Clause 7 - Optional","content":"*Docking clause*\n\n(a)\tAn entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.  \n(b)\tOnce it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.\n(c)\tThe acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party."},{"level":2,"header":"SECTION II – OBLIGATIONS OF THE PARTIES","content":""},{"level":2,"header":"Clause 8","content":"*Data protection safeguards*\n\nThe data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses. \n\n*8.1\tInstructions*\n\n(a)\tThe data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.\n(b)\tThe data importer shall immediately inform the data exporter if it is unable to follow those instructions. 8.2\tPurpose limitationThe data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter. \n\n*8.3\tTransparency*\n\nOn request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.  \n\n*8.4\tAccuracy*\nIf the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.\n\n*8.5\tDuration of processing and erasure or return of data*\n\nProcessing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a). \n\n*8.6\tSecurity of processing*\n\n(a)\tThe data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security. \n(b)\tThe data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. \n(c)\tIn the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. \n(d)\tThe data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.\n\n*8.7\tSensitive data*\n\nWhere the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.\n\n*8.8\tOnward transfers*\n\nThe data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if: \n\n(i)\tthe onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer; \n(ii)\tthe third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;\n(iii)\tthe onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or\n(iv)\tthe onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.\n\n*8.9\tDocumentation and compliance*\n\n(a)\tThe data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses. \n(b)\tThe Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.\n(c)\tThe data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.   \n(d)\tThe data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice. \n(e)\tThe Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request."},{"level":2,"header":"Clause 9","content":"*Use of sub-processors*\n\n(a)\tThe data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. \n(b)\tWhere the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.\n(c)\tThe data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.\n(d)\tThe data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract. \n(e)\tThe data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data."},{"level":2,"header":"Clause 10","content":"*Data subject rights*\n\n(a)\tThe data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.\n(b)\tThe data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required. \n(c)\tIn fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter."},{"level":2,"header":"Clause 11","content":"*Redress*\n\n(a)\tThe data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject. \n(b)\tIn case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.   \n(c)\tWhere the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to: \n\n(i)\tlodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;\n(ii)\trefer the dispute to the competent courts within the meaning of Clause 18.\n\n(d)\tThe Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679. \n(e)\tThe data importer shall abide by a decision that is binding under the applicable EU or Member State law.\n(f)\tThe data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws."},{"level":2,"header":"Clause 12","content":"*Liability*\n\n(a)\tEach Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses. \n(b)\tThe data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses. \n(c)\tNotwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.\n(d)\tThe Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.\n(e)\tWhere more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.\n(f)\tThe Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.\n(g)\tThe data importer may not invoke the conduct of a sub-processor to avoid its own liability."},{"level":2,"header":"Clause 13","content":"*Supervision*\n\n(a)\tWhere the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority. Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority. \n(b)\tThe data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken."},{"level":2,"header":"SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES","content":""},{"level":2,"header":"Clause 14","content":"*Local laws and practices affecting compliance with the Clauses*\n\n(a)\tThe Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.\n(b)\tThe Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:\n\n(i)\tthe specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred; \n(ii)\tthe laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards; \n(iii)\tany relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.\n\n(c)\tThe data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.\n(d)\tThe Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.\n(e)\tThe data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).\n(f)\tFollowing a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply."},{"level":2,"header":"Clause 15","content":"*Obligations of the data importer in case of access by public authorities*\n\n*15.1\tNotification*\n\n(a)\tThe data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it: \n\n(i)\treceives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or\n(ii)\tbecomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.\n\n(b)\tIf the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter. \n(c)\tWhere permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).\n(d)\tThe data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request. (e)\tParagraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14\n(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.\n\n*15.2\tReview of legality and data minimisation*\n\n(a)\tThe data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).\n(b)\tThe data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. \n(c)\tThe data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request."},{"level":2,"header":"SECTION IV – FINAL PROVISIONS","content":""},{"level":2,"header":"Clause 16","content":"*Non-compliance with the Clauses and termination*\n\n(a)\tThe data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason. \n(b)\tIn the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).\n(c)\tThe data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:\n\n(i)\tthe data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension; \n(ii)\tthe data importer is in substantial or persistent breach of these Clauses; or\n(iii)\tthe data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. \n\n(d)\tPersonal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law. \n(e)\tEither Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679."},{"level":2,"header":"Clause 17","content":"*Governing law*\n\nThese Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Denmark."},{"level":2,"header":"Clause 18","content":"*Choice of forum and jurisdiction*\n\n(a)\tAny dispute arising from these Clauses shall be resolved by the courts of an EU Member State.\n(b)\tThe Parties agree that those shall be the courts of Denmark.\n(c)\tA data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence. \n(d)\tThe Parties agree to submit themselves to the jurisdiction of such courts."},{"level":2,"header":"Module 2: Controller to Processor transfers Appendix","content":""},{"level":2,"header":"ANNEX I","content":""},{"level":2,"header":"A. LIST OF PARTIES","content":"Data exporter(s): \n\n*Name*: The entity identified as the Customer in the DPA or the Agreement.  \n*Address*: The address for the Customer as specified in the DPA or the Agreement. \n*Contact person’s name, position and contact details*: The contact details associated with the Customer, as specified in the DPA or the Agreement. \n*Activities relevant to the data transferred under these Clauses*: Use of the Services (Audience Measurement). \n*Signature and date*: By entering into the Agreement and DPA, and using the Services, the Customer (data exporter) will be deemed to have accepted and signed these Standard Contractual Clauses and their respective Annexes. \nThe date shall be the effective date of the Agreement. \n*Role (controller/processor)*: Controller \n\nData importer(s): \n\n*Name*: AudienceProject as identified in the DPA or the Agreement. \n*Address*: Ryesgade 3F, 3. Third floor, 2200 Copenhagen, Denmark \n*Contact person’s name, position and contact details*: The contact details for AudienceProject specified in the DPA or the Agreement. \n*Activities relevant to the data transferred under these Clauses*: Provision of the Services selected by the Customer as set out in the Agreement. \n*Signature and date*: By entering into the Agreement and DPA, and providing the Services, AudienceProject (data importer) will be deemed to have accepted and signed these Standard Contractual Clauses and their respective Annexes. \nThe date shall be the effective date of the Agreement. \n*Role (controller/processor)*: Processor"},{"level":2,"header":"B. DESCRIPTION OF TRANSFER","content":"*Categories of data subjects whose personal data is transferred:*\n\nThe categories of data subjects are described in Exhibit A “Details of processing” section “Categories of Data Subjects” of the DPA. \n\n*Categories of personal data transferred:*\n\nThe categories of personal data are described in Exhibit A “Details of processing” section “Categories of Personal Data” of the DPA. \nSensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.\nThe Parties do not intend for Sensitive Data to be transferred.  \n\n*The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):*\n\nPersonal data is transferred on a continuous basis in accordance with the Customer´s use of the Services and submission of personal data thereto. \n\n*Nature of the processing:*\n\nThe nature of the processing is described in Exhibit A “Details of processing” section “Nature and Purpose of the Processing” of the DPA. \n\n*Purpose(s) of the data transfer and further processing:*\n\nThe purposes of the processing is described in Exhibit A “Details of processing” section “Nature and Purpose of the Processing” of the DPA. \n\n*The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:*\n\nThe period for which the personal data will be retained is described in Exhibit A “Details of processing” section “Duration of processing” of the DPA. \n\n*For transfers to sub-processors, also specify subject matter, nature and duration of the processing:*\n\nAudienceProject sub-processors list is available at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/). \nThe duration of the processing by sub-processors is the duration of the Agreement. \nAudienceProject commercial relationship with sub-processors is subject to the strictest regulations in terms of security and data protection. AudienceProject has taken security measures to ensure personal data protection, including encryption and pseudonymization of the personal data transferred. \nFor further details, transfers to sub-processors are described in the section “Sub-Processors” of the DPA."},{"level":2,"header":"C. COMPETENT SUPERVISORY AUTHORITY","content":"Where the EU GDPR applies, the competent supervisory authority is the Danish Data Protection Agency (“Datatilsynet”). \n\nWhere the UK GDPR applies, the competent supervisory authority is the UK Information Commissioner´s Office (“ICO”). \n\nWhere the FDPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (“FDPIC”)"},{"level":2,"header":"ANNEX II","content":""},{"level":2,"header":"TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA","content":"Audienceproject implements technical and organizational measures to ensure an appropriate level of security in particular measures of pseudonymization and encryption of personal data, measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services, and measures for the protection of data during transmission and storage. \n\nThe technical and organizational measures that AudienceProject implements, including for transfers to sub-processors, are described in Exhibit B “Technical and Organisational Security Measures” of the DPA."},{"level":2,"header":"ANNEX III","content":""},{"level":2,"header":"LIST OF SUB-PROCESSORS","content":"AudienceProject sub-processors list is available at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/)."},{"level":1,"header":"Module 1: Controller to Controller transfers","content":""},{"level":2,"header":"SECTION I","content":""},{"level":2,"header":"Clause 1","content":"*Purpose and scope*\n\n(a)\tThe purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.\n(b)\tThe Parties:\n\n(i)\tthe natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and\n(ii)\tthe entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)have agreed to these standard contractual clauses (hereinafter: “Clauses”). \n\n(c)\tThese Clauses apply with respect to the transfer of personal data as specified in Annex I.B. \n(d)\tThe Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses."},{"level":2,"header":"Clause 2","content":"*Effect and invariability of the Clauses*\n\n(a)\tThese Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects. \n(b)\tThese Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679."},{"level":2,"header":"Clause 3","content":"*Third-party beneficiaries*\n\n(a)\tData subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:\n\n(i)\tClause 1, Clause 2, Clause 3, Clause 6, Clause 7;\n(ii)\tClause 8 - Clause 8.5 (e) and Clause 8.9(b); \n(iii)\tClause 9 – N/A; \n(iv)\tClause 12 - Clause 12(a) and (d); \n(v)\tClause 13;\n(vi)\tClause 15.1(c), (d) and (e);\n(vii)\tClause 16(e);\n(viii)\tClause 18 - Clause 18(a) and (b); \n\n(b)\tParagraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679."},{"level":2,"header":"Clause 4","content":"*Interpretation*\n\n(a)\tWhere these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.\n(b)\tThese Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.\n(c)\tThese Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679."},{"level":2,"header":"Clause 5","content":"*Hierarchy*\n\nIn the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail."},{"level":2,"header":"Clause 6","content":"*Description of the transfer(s)*\n\nThe details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B."},{"level":2,"header":"Clause 7 - Optional","content":"*Docking clause*\n\n(a)\tAn entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.  \n(b)\tOnce it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.\n(c)\tThe acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party."},{"level":2,"header":"SECTION II – OBLIGATIONS OF THE PARTIES","content":""},{"level":2,"header":"Clause 8","content":"*Data protection safeguards*\n\nThe data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses. \n\n*8.1\tPurpose limitation*\n\nThe data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose: \n\n(i)\twhere it has obtained the data subject’s prior consent; \n(ii)\twhere necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or \n(iii)\twhere necessary in order to protect the vital interests of the data subject or of another natural person.\n\n*8.2\tTransparency*\n\n(a)\tIn order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:\n\n(i)\tof its identity and contact details;\n(ii)\tof the categories of personal data processed;\n(iii)\tof the right to obtain a copy of these Clauses;\n(iv)\twhere it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.\n\n(b)\tParagraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.\n(c)\tOn request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.\n(d)\tParagraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.  \n\n*8.3\tAccuracy and data minimisation*\n\n(a)\tEach Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.\n(b)\tIf one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.\n(c)\tThe data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing. \n\n*8.4\tStorage limitation*\n\nThe data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation of the data and all back-ups at the end of the retention period.  \n\n*8.5\tSecurity of processing*\n\n(a)\tThe data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. \n(b)\tThe Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.\n(c)\tThe data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.\n(d)\tIn the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.\n(e)\tIn case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay. \n(f)\tIn case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach. \n(g)\tThe data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.\n\n*8.6\tSensitive data*\n\nWhere the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter “sensitive data”), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.\n\n*8.7\tOnward transfers*\n\nThe data importer shall not disclose the personal data to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if: \n\n(i)\tit is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer; \n(ii)\tthe third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;\n(iii)\tthe third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;\n(iv)\tit is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings;\n(v)\tit is necessary in order to protect the vital interests of the data subject or of another natural person; or\n(vi)\twhere none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.\n\nAny onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.\n\n*8.8\tProcessing under the authority of the data importer*\n\nThe data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions. \n\n*8.9\tDocumentation and compliance*\n\n(a)\tEach Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.\n(b)\tThe data importer shall make such documentation available to the competent supervisory authority on request."},{"level":2,"header":"Clause 9","content":"*Use of sub-processors*\nN/A."},{"level":2,"header":"Clause 10","content":"*Data subject rights*\n\n(a)\tThe data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.\n(b)\tIn particular, upon request by the data subject the data importer shall, free of charge:\n\n(i)\tprovide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i); \n(ii)\trectify inaccurate or incomplete data concerning the data subject; \n(iii)\terase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based. \n\n(c)\tWhere the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it. \n(d)\tThe data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter “automated decision”), which would produce legal effects concerning the data subject or similarly significantly affect him / her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:\n\n(i)\tinform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and\n\n(ii)\timplement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being. \n\n(e)\tWhere requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.\n(f)\tThe data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.\n(g)\tIf the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress."},{"level":2,"header":"Clause 11","content":"*Redress*\n\n(a)\tThe data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject. \n(b)\tIn case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.   \n(c)\tWhere the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to: \n\n(i)\tlodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;\n(ii)\trefer the dispute to the competent courts within the meaning of Clause 18.\n\n(d)\tThe Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679. \n(e)\tThe data importer shall abide by a decision that is binding under the applicable EU or Member State law.\n(f)\tThe data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws."},{"level":2,"header":"Clause 12","content":"*Liability*\n\n(a)\tEach Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses. \n(b)\tEach Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.\n(c)\tWhere more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.\n(d)\tThe Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.\n(e)\tThe data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability."},{"level":2,"header":"Clause 13","content":"*Supervision*\n\n(a)\tWhere the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.\n\nWhere the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority. \n\nWhere the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority. \n\n(b)\tThe data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken."},{"level":2,"header":"SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES","content":""},{"level":2,"header":"Clause 14","content":"*Local laws and practices affecting compliance with the Clauses*\n\n(a)\tThe Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.\n(b)\tThe Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:\n\n(i)\tthe specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred; \n(ii)\tthe laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards; \n(iii)\tany relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.\n\n(c)\tThe data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.\n(d)\tThe Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.\n(e)\tThe data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). \n(f)\tFollowing a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply."},{"level":2,"header":"Clause 15","content":"*Obligations of the data importer in case of access by public authorities*\n\n*15.1\tNotification*\n\n(a)\tThe data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it: \n\n(i)\treceives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or\n(ii)\tbecomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.\n\n(b)\tIf the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter. \n(c)\tWhere permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). \n(d)\tThe data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request. (e)\tParagraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14\n(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.\n\n*15.2\tReview of legality and data minimisation*\n\n(a)\tThe data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).\n(b)\tThe data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. [For Module Three: The data exporter shall make the assessment available to the controller.] \n(c)\tThe data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request."},{"level":2,"header":"SECTION IV – FINAL PROVISIONS","content":""},{"level":2,"header":"Clause 16","content":"*Non-compliance with the Clauses and termination*\n\n(a)\tThe data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason. \n(b)\tIn the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).\n(c)\tThe data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:\n\n(i)\tthe data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension; \n(ii)\tthe data importer is in substantial or persistent breach of these Clauses; or\n(iii)\tthe data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. \n\n(d)\tPersonal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law. \n(e)\tEither Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679."},{"level":2,"header":"Clause 17","content":"*Governing law*\n\nThese Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Denmark."},{"level":2,"header":"Clause 18","content":"*Choice of forum and jurisdiction*\n\n(a)\tAny dispute arising from these Clauses shall be resolved by the courts of an EU Member State.\n(b)\tThe Parties agree that those shall be the courts of Denmark. \n(c)\tA data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence. \n(d)\tThe Parties agree to submit themselves to the jurisdiction of such courts."},{"level":1,"header":"Module 1: Controller to Controller transfers Appendix","content":""},{"level":2,"header":"ANNEX I","content":""},{"level":2,"header":"A. LIST OF PARTIES","content":"Data exporter(s): \n\n*Name*: The entity identified as the Customer in the DPA or the Agreement.  \n\n*Address*: The address for the Customer as specified in the DPA or the Agreement.\n\n*Contact person’s name, position and contact details*: The contact details associated with the Customer, as specified in the DPA or the Agreement.\n\n*Activities relevant to the data transferred under these Clauses*: Use of the Services (Audience Measurement). \n\n*Signature and date*: By entering into the Agreement and DPA, and using the Services, the Customer (data exporter) will be deemed to have accepted and signed these Standard Contractual Clauses and their respective Annexes.\n\n*Role (controller/processor)*: Controller  \n\nData importer(s): \n\n*Name*: AudienceProject as identified in the DPA or the Agreement. \n\n*Address*: Ryesgade 3F, 3. Third floor, 2200 Copenhagen, Denmark \n\n*Contact person’s name, position and contact details*: The contact details for AudienceProject specified in the DPA or the Agreement.\n\n*Activities relevant to the data transferred under these Clauses*: Provision of the Services selected by the Customer as set out in the Agreement.  \n\n*Signature and date*: By entering into the Agreement and DPA, and providing the Services, AudienceProject (data importer) will be deemed to have accepted and signed these Standard Contractual Clauses and their respective Annexes. \n\n*Role (controller/processor)*: Controller"},{"level":2,"header":"B. DESCRIPTION OF TRANSFER","content":"*Categories of data subjects whose personal data is transferred:*\nThe categories of data subjects are described in Exhibit A “Details of processing” section “Categories of Data Subjects” of the DPA. \n\n*Categories of personal data transferred:*\nThe categories of personal data are described in Exhibit A “Details of processing” section “Categories of Personal Data” of the DPA. \nSensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.\nThe Parties do not intend for Sensitive Data to be transferred.  \n\n*The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):*\nPersonal data is transferred on a continuous basis in accordance with the Customer´s use of the Services and submission of personal data thereto. \n\n*Nature of the processing:*\nThe nature of the processing is described in Exhibit A “Details of processing” section “Nature and Purpose of the Processing” of the DPA. \n\n*Purpose(s) of the data transfer and further processing:*\nThe purposes of the processing is described in Exhibit A “Details of processing” section “Nature and Purpose of the Processing” of the DPA. \n\n*The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:* \nThe period for which the personal data will be retained is described in Exhibit A “Details of processing” section “Duration of processing” of the DPA.  \n\n*For transfers to (sub-)processors, also specify subject matter, nature and duration of the processing:* \nAudienceProject sub-processors list is available at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/). \nThe duration of the processing by sub-processors is the duration of the Agreement. \nAudienceProject commercial relationship with sub-processors is subject to the strictest regulations in terms of security and data protection. AudienceProject has taken security measures to ensure personal data protection, including encryption and pseudonymization of the personal data transferred. \nFor further details, transfers to sub-processors are described in the section “Sub-Processors” of the DPA."},{"level":2,"header":"C. COMPETENT SUPERVISORY AUTHORITY","content":"Where the EU GDPR applies, the competent supervisory authority is the Danish Data Protection Agency (“Datatilsynet”). \n\nWhere the UK GDPR applies, the competent supervisory authority is the UK Information Commissioner´s Office (“ICO”). \n\nWhere the FDPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (“FDPIC”)."},{"level":2,"header":"ANNEX II","content":""},{"level":2,"header":"TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA","content":"AudienceProject implements technical and organizational measures to ensure an appropriate level of security in particular measures of pseudonymization and encryption of personal data, measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services, and measures for the protection of data during transmission and storage. \n\nThe technical and organizational measures that AudienceProject implements, including for transfers to sub-processors, are described in Exhibit B “Technical and Organisational Security Measures” of the DPA."},{"level":2,"header":"ANNEX III – LIST OF SUB-PROCESSORS","content":"AudienceProject sub-processors list is available at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/)."},{"level":1,"header":"Module 3: Processor to Processor transfers","content":"In this Module the data exporter refers to AudienceProject and the data importer refers to the Sub-processsors named in the Sub-processor list available at [https://gdpr.audienceproject.com/sub-processors/](https://gdpr.audienceproject.com/sub-processors/). \n\nPersonal data is processed by each data importer on a continuous basis to the extent necessary to provide the Services in accordance with the Agreement and the data exporter´s instruction and for the duration of the Agreement and subject to applicable law. \n\nAudienceProject uses Amazon Web Services (AWS) for hosting and Cloud infrastructure purposes.  \n\nAudienceProject commercial relationship with AWS is subject to the strictest regulations in terms of security and data protection. AudienceProject has taken security measures to ensure personal data protection, including encryption and pseudonymization of the personal data transferred. \n\nAudienceProject has accepted a Data Processing Addendum with AWS, which includes standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, offering the sufficient safeguards required by such law. The AWS GDPR Data Processing Addendum and the concerned standard contractual clauses are available on AWS website."},{"level":1,"header":"Part 2 - Personal Data protected by the UK GDPR","content":""},{"level":2,"header":"I. Information (tables)","content":""},{"level":2,"header":"1. Parties","content":"*Start date:* The start date of this Data Addendum shall be the effective date of the DPA or the Agreement. \n\n*The Parties:*\n\n*Exporter (who sends the Restricted Transfer):*\n\n*Full legal name and/or trading name:* The entity identified as the Customer in the DPA or the Agreement.  \n\n*Main address (if a company registered address):* The address for the Customer as specified in in the DPA or the Agreement. \n\n*Official registration number (if any) (company number or similar identifier):* The registration number for the Customer as specified in in the DPA or the Agreement.\n\n*Full name, job title and contact details including email:* The contact details associated with the Customer, as specified in the DPA or the Agreement.\n\n*Importer (who receives the Restricted Transfer):* \n\n*Full legal name and/or trading name:* AudienceProject as identified in the DPA or the Agreement.\n\n*Main address (if a company registered address):* Ryesgade 3F, 3. Third floor, 2200 Copenhagen, Denmark\n\n*Official registration number (if any) (company number or similar identifier):* 32552412\n\n*Full name, job title and contact details including email:* The contact details for AudienceProject specified in the DPA or the Agreement."},{"level":2,"header":"2. Selected SCCs, Modules and Selected Clauses","content":"Addendum EU SCCs: the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:\n\n*Information related to Module 1:* Module in operation, Clause 7 (Docking Clause) applicable if relevant, Clause 11 (not applicable), Clause 9 (General Authorisation) applicable, Clause 9a (Time period) 30 days.\n\n*Information related to Module 2:* Module in operation, Clause 7 (Docking Clause) applicable if relevant, Clause 11 (not applicable), Clause 9 (General Authorisation) applicable, Clause 9a (Time period) 30 days."},{"level":2,"header":"3. Appendix Information","content":"“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:\n\nAnnex 1A: List of Parties: \nFor Module 2 see above mentioned EU SCCs Module 2 Annex I A\nFor Module 1 see above mentioned EU SCCs Module 1 Annex I A \n\nAnnex 1B: Description of Transfer: \nFor Module 2 see above mentioned EU SCCs Modules 2 Annex I B \nFor Module 1 see above mentioned EU SCCs Module 1 Annex I B\n\nAnnex II: \nTechnical and organisational measures including technical and organisational measures to ensure the security of the data: \nFor Module 2 see above mentioned EU SCCs Modules 2 Annex II\nFor Module 1 see above mentioned EU SCCs Module 1 Annex II\n\nAnnex III: List of Sub processors: \nFor Module 2 see above mentioned EU SCCs Module 2 Annex III"},{"level":2,"header":"4. Ending this Addendum when the Approved Addendum Changes","content":"Ending this Addendum when the Approved Addendum changes:\n\nWhich Parties may end this Addendum as set out in Section 19: Importer and Exporter after mutual agreement."},{"level":2,"header":"II. Mandatory Clauses","content":""},{"level":2,"header":"Entering into this Addendum","content":"1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.\n\n2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs."},{"level":2,"header":"Interpretation of this Addendum","content":"3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:\n\n*Addendum*: This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.\n\n*Addendum EU SCCs:* The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.\n\n*Appendix Information:* As set out in Table ‎3.\n\n*Appropriate Safeguards:* The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.\n\n*Approved Addendum:* The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.\n\n*Approved EU SCCs:* The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.\n\n*ICO*: The Information Commissioner.\n\n*Restricted Transfer:* A transfer which is covered by Chapter V of the UK GDPR.\n\n*UK*: The United Kingdom of Great Britain and Northern Ireland.\n\n*UK Data Protection Laws:* All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.\n\n*UK GDPR:* As defined in section 3 of the Data Protection Act 2018.\n\n4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards. \n\n5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.\n\n6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.\n\n7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies. \n\n8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into."},{"level":2,"header":"Hierarchy","content":"9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.\n\n10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.\n\n11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs."},{"level":2,"header":"Incorporation of and changes to the EU SCCs","content":"12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:\n\na. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers; \nb. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and\nc. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.\n\n13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.\n\n14. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.\n\n15. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made: \n\na. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;\nb. In Clause 2, delete the words:\n“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;\nc. Clause 6 (Description of the transfer(s)) is replaced with:\n“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;\nd. Clause 8.7(i) of Module 1 is replaced with:\n“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;\ne. Clause 8.8(i) of Modules 2 and 3 is replaced with:\n“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”\nf. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;\ng. References to Regulation (EU) 2018/1725 are removed;\nh. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;\ni. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;\nj. Clause 13(a) and Part C of Annex I are not used; \nk. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;\nl. In Clause 16(e), subsection (i) is replaced with:\n“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;\nm. Clause 17 is replaced with:\n“These Clauses are governed by the laws of England and Wales.”;\nn. Clause 18 is replaced with:\n“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and\no. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11."},{"level":2,"header":"Amendments to this Addendum","content":"16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.\n17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.\n18. From time to time, the ICO may issue a revised Approved Addendum which: \n\na. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or\nb. reflects changes to UK Data Protection Laws;\n\nThe revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified. \n\n19. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in: \n\na. its direct costs of performing its obligations under the Addendum; and/or \nb. its risk under the Addendum, \n\nand in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.\n\n20. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms."}],"externalReleaseNotes":null}]