Previous Data Processing Addendum

Version Date: August 1, 2022

This Has Been Updated. Click Here to View It.

THIS DATA PROCESSING ADDENDUM (“DPA”) is entered into as of the Addendum Effective Date by and between: (1) Metadata, Inc., a Delaware corporation with its principal business address 1754 Technology Drive, Suite 212, San Jose, CA 95110, United States (“Metadata”); and (2) the entity or other person who is a counterparty to the Agreement (as defined below) into which this DPA is incorporated and forms a part (“Customer”), together the “Parties” and each a “Party”.

I. RECITALS

i. Metadata and Customer have executed an Agreement pursuant to which Metadata will provide Customer with the Company Services.

ii. As part of Metadata’s provision of the Company Services:

  1. Metadata may receive Customer Personal Data from Customer, and provide Metadata Personal Data to Customer; and
  2. Customer may receive Metadata Personal Data from Metadata, and provide Customer Personal Data to Metadata.

iii. The Parties agree to comply with the provisions of this DPA with respect to the Processing of Customer Personal Data and Metadata Personal Data.

1. INTERPRETATION

  1. In this DPA the following terms shall have the meanings set out in this Section 1, unless expressly stated otherwise:
    1. “Addendum Effective Date” means the effective date of the Agreement.
    2. “Agreement” means the Terms of Use entered into by and between the Parties.
    3. “Applicable Data Protection Laws” means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Customer Personal Data under the Agreement, including, without limitation, GDPR and the CCPA (as and where applicable).
    4. “CCPA” means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder.
    5. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
    6. “Customer Personal Data” means any Personal Data contained within Customer Data that is Processed by Metadata or its Sub-Processor on behalf of Customer to perform the Company Services under the Agreement. For the avoidance of doubt, Customer Personal Data does not include business contact information regarding Customer’s employees, contractors or other business representatives.
    7. “Data Subject Request” means the exercise by a Data Subject of its rights in accordance with Applicable Data Protection Laws in respect of Personal Data and the Processing thereof.
    8. “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
    9. “Data Transfer Mechanism(s)” means the EU SCCs and/or the UK Transfer Addendum as applicable to the relevant Restricted Transfer.
    10. “EEA” means the European Economic Area.
    11. “EU SCCs” means the standard contractual clauses approved by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as populated in accordance with Attachment 2 to Annex 1 (European Annex).
    12. “GDPR” means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UK GDPR”), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment, to or of the foregoing. References to “Articles” and “Chapters” of, and other relevant defined terms in, the GDPR shall be construed accordingly.
    13. “Metadata Personal Data” means any Personal Data contained within Supplementary Data.
    14. “Mandatory Clauses” means the mandatory clauses of the UK Transfer Addendum, as shown in Part Four of the document presently published at https://ico.org.uk/media/for-organisations/documents/4019538/international-data-transfer-agreement.pdf.
    15. “Personal Data” means “personal data,” “personal information,” “personally identifiable information” or similar term defined in Applicable Data Protection Laws.
    16. “Personal Data Breach” means a breach of security leading to the accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure of, or access to, Personal Data in a Party’s possession, custody or control. For clarity, Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).
    17. “Personnel” means a person’s employees, agents, consultants or contractors.
    18. “Process” and inflection thereof means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
    19. “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
    20. “Restricted Transfer” means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an “EU Restricted Transfer”); and (ii) in the context of the UK, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a “UK Restricted Transfer”), which would be prohibited without a legal basis under Chapter V of the GDPR.
    21. “Sub-Processor” means any third party appointed by or on behalf of Metadata to Process Customer Personal Data.
    22. “Sub-Processor List” has the meaning given to it in Section 8.
    23. “Supervisory Authority”: (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; and (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office (the “ICO”).
    24. “UK Transfer Addendum” means the template addendum B1.0 issued by the ICO under s119A(1) of the Data Protection Act 2018, in force from 21 March 2022, as set out in Attachment 3 to Annex 1 (European Annex).
  2. In this DPA:
    1. unless otherwise defined in this DPA, all capitalised terms in this DPA shall have the meaning given to them in the Agreement.

2. SCOPE OF THIS DATA PROCESSING ADDENDUM

  1. The front-end of this DPA applies to:
    1. Metadata’s Processing of Customer Personal Data under the Agreement; and/or
    2. Metadata’s transmission of Metadata Personal Data to Customer.
  2. Annex 1 (European Annex) to this DPA applies only if and to the extent Metadata’s Processing of Customer Personal Data under the Agreement is subject to the GDPR.
  3. Annex 2 (California Annex) to this DPA applies only if and to the extent Metadata’s Processing of Customer Personal Data or Metadata’s transmission of Metadata Personal Data to Customer under the Agreement is subject to the CCPA, whether because Customer is a “business” (as defined in the CCPA) or Metadata is “business,” respectively.

3. PROCESSING OF PERSONAL DATA

Metadata as a Processor

3.1 Subject to Sections 3.3 to 3.4, Metadata shall not Process Customer Personal Data other than on Customer’s instructions or as required by applicable laws. 

3.2 Customer instructs Metadata to Process Customer Personal Data as necessary to provide the Company Services to Customer under and in accordance with the Agreement.

Metadata as a Controller

3.3 The Parties acknowledge and agree that Metadata may provide Client with Metadata Personal Data as part of Metadata’s provision of the Company Services.

3.4 The Parties acknowledge and agree that, in respect of any Processing of Metadata Personal Data pursuant to Section 3.3, each Party:

  1. Processes Metadata Personal Data for its own purposes and each acts as an independent Controller;
  2. shall Process Metadata Personal Data in compliance with its respective obligations under Applicable Data Protection Laws (if and as applicable in the context);
  3. shall Process Metadata Personal Data in accordance with its publicly available privacy policy as updated from time to time; 
  4. shall use Metadata Personal Data for the sole purpose of business-to-business marketing activities; and
  5. shall apply technical and organisational safeguards to Metadata Personal Data that are no less protective than the Security Measures.

4. METADATA PERSONNEL

Metadata shall take commercially reasonable steps to ascertain the reliability of any Metadata Personnel who Process Customer Personal Data, and shall enter into written confidentiality agreements with all Metadata Personnel who Process Customer Personal Data that are not subject to professional or statutory obligations of confidentiality.

5. SECURITY

5.1 Metadata shall implement and maintain technical and organisational measures in relation to Customer Personal Data designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access as described in Annex 3 (Security Measures) (the “Security Measures”).  

5.2 Metadata may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

6. DATA SUBJECT RIGHTS

6.1 Metadata, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests. If Metadata receives a Data Subject Request in respect of Customer Personal Data, Customer will be responsible for responding to any such request.

6.2 Metadata shall:

  1. promptly notify Customer if it receives a Data Subject Request in respect of Customer Personal Data; and
  2. not respond to any such Data Subject Request, other than to advise the Data Subject to submit the request to Customer, except on the written instructions of Customer or as required by Applicable Data Protection Laws.

6.3 Operational clarifications (if and as the EU SCCs apply in accordance with Paragraph 4.2 of Annex 1):

  1. When complying with its transparency obligations under Clause 8.3 of the EU SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Metadata’s and its licensors’ trade secrets, business secrets, confidential information and/or other commercially sensitive information.
  2. Where applicable, for the purposes of Clause 10(a) of Module Three of the EU SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Metadata to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer.
  3. For the purposes of Clause 15.1(a) of the EU SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required.
  4. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Metadata (at Metadata’s then-current professional services rates) in Metadata’s cooperation and assistance provided to Customer under this Section 6, and shall on demand reimburse Metadata any such costs incurred by Metadata.

7. PERSONAL DATA BREACH

Breach notification and assistance 

7.1 Metadata shall notify Customer without undue delay upon Metadata’s discovery of a Personal Data Breach affecting Customer Personal Data. Metadata shall provide Customer with information (insofar as such information is within Metadata’s possession and knowledge and does not otherwise compromise the security of any Personal Data Processed by Metadata) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. Metadata’s notification of or response to a Personal Data Breach shall not be construed as Metadata’s acknowledgement of any fault or liability with respect to the Personal Data Breach.

7.2 Metadata shall reasonably co-operate with Customer and take such commercially reasonable steps as may be directed by Customer to assist in the investigation of any such Personal Data Breach.

7.3 Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breaches.

7.4 Operational clarifications: 

  1. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Metadata (at Metadata’s then-current professional services rates) in Metadata’s cooperation and assistance provided to Customer under Section 7.2, and shall on demand reimburse Metadata any such costs incurred by Metadata.

Notification to Metadata

7.5 If Customer determines that a Personal Data Breach (whether related to Customer Personal Data or Metadata Personal Data) must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Metadata, where permitted by applicable laws, Customer agrees to: 

  1. notify Metadata in advance; and 
  2. in good faith, consult with Metadata and consider any clarifications or corrections Metadata may reasonably recommend or request to any such notification, which: (i) relate to Metadata’s involvement in or relevance to such Personal Data Breach; and (ii) are consistent with applicable laws.

8. SUB-PROCESSORS

With respect to all Customer Personal Data except Customer Personal Data subject to Annex 1, Metadata may use Sub-Processors to Process such Customer Personal Data provided such Sub-Processors agree (i) to comply with Applicable Data Protection Laws, (ii) to take reasonable steps designed to protect and secure Customer Personal Data, and (iii) not to Process Customer Personal Data other than on behalf of Metadata. Metadata shall remain liable for any breach of this DPA caused by a Sub-Processor. A list of Sub-Processors engaged by Metadata as at the date of this DPA (as those Sub-Processors are shown, together with their respective functions and locations), is contained in the Sub-Processor list shown at https://metadata.io/subprocessors (the “Sub-Processor List”).

Metadata’s obligations with respect to Sub-Processors that Process Customer Personal Data subject to the GDPR are addressed in Annex 1.

9. RETURN AND DELETION

9.1 Subject to Paragraph 9.2 and 9.3, upon the date of cessation of any Company Services involving the Processing of Customer Personal Data (the “Cessation Date”), Metadata shall promptly cease all Processing of Customer Personal Data for any purpose other than for storage or as otherwise permitted or required under this DPA or the Agreement.

Subject to Paragraph 9.4, to the extent technically possible in the circumstances (as determined in Metadata’s sole discretion), on written request to Metadata (to be made no later than fourteen (14) days after the Cessation Date (“Post-cessation Storage Period”)), Metadata shall within fourteen (14) days of such request:

  1. return a complete copy of all Customer Personal Data within Metadata’s possession to Customer by secure file transfer, promptly following which Metadata shall delete or irreversibly anonymise all other copies of such Customer Personal Data; or 
  2. either (at its option) delete or irreversibly anonymise all Customer Personal Data within Metadata’s possession.

9.3 In the event that during the Post-cessation Storage Period, Customer does not instruct Metadata in writing to either delete or return Customer Personal Data pursuant to Paragraph 9.2, Metadata shall promptly after the expiry of the Post-cessation Storage Period either (at its option) delete; or irreversibly render anonymous, all Customer Personal Data then within Metadata possession to the fullest extent technically possible in the circumstances.

9.4 Metadata may retain Customer Personal Data where permitted or required by applicable law, for such period as may be required by such applicable law, provided that Metadata shall:

  1. maintain the confidentiality of all such Customer Personal Data, subject to applicable law; and 
  2. Process the Customer Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention. 

9.5 Operational clarification: Certification of deletion of Customer Personal Data, including as described in Clauses 8.5 and 16(d) of the EU SCCs (if and as applicable), shall be provided only upon Customer’s written request.

10. AUDIT RIGHTS

10.1 Metadata shall make available to Customer on request, such information as Metadata (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this DPA in relation to its Processing of Customer Personal Data. 

10.2 Subject to Paragraphs 10.3 to 10.8, in the event that Customer (acting reasonably) is able to provide documentary evidence that the information made available by Metadata pursuant to Paragraph 10.1 is not sufficient in the circumstances to demonstrate Metadata’s compliance with this DPA, Metadata shall allow for and contribute to audits  by Customer or an auditor mandated by Customer in relation to the Processing of Customer Personal Data by Metadata.

10.3 Customer shall give Metadata reasonable notice of any audit or inspection to be conducted under Paragraph 10.2 (which shall in no event be less than fourteen (14) days’ notice) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Metadata’s equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of Metadata’s other customers or the availability of Metadata’s services to such other customers).

10.4 Prior to conducting any audit, Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Metadata will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Metadata security, privacy, employment or other relevant policies). Metadata will work cooperatively with Customer to agree on a final audit plan.  

10.5 If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer’s audit request (“Audit Report”) and Metadata has confirmed in writing that there are no known material changes in the controls audited and covered by such Audit Report(s), Customer agrees to accept provision of such Audit Report(s) in lieu of requesting an audit of such controls or measures.  

10.3 Metadata need not give access to its Personnel, equipment, data or other resources for the purposes of such an audit or inspection:

  1. where an Audit Report is provided in lieu of such controls or measures in accordance with Paragraph 5.5;
  2. to any individual unless they produce reasonable evidence of their identity;
  3. to any auditor whom Metadata has not approved in advance (acting reasonably);
  4. to any individual who has not entered into a non-disclosure agreement with Metadata on terms acceptable to Metadata;
  5. outside normal business hours at those premises; or
  6. on more than one occasion in any calendar year during the term of the Agreement, except for any audits or inspections which Customer is required to carry out under Applicable Data Protection Law or by a Supervisory Authority or other governmental authority.

10.7 Nothing in this DPA shall require Metadata to furnish more information about its Sub-Processors in connection with such audits than such Sub-Processors make generally available to their customers.

10.8 Operational clarifications:

  1. Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Metadata (at Metadata’s then-current professional services rates) in Metadata’s provision of any cooperation and assistance provided to Customer under this Paragraph 10 (excluding any costs incurred in the procurement, preparation or delivery of Audit Reports to Customer pursuant to Paragraph 10.5), and shall on demand reimburse Metadata any such costs incurred by Metadata.
  2. The audits described in Clauses 8.9(c) and 8.9(d) of the EU SCCs (if and as applicable) shall be subject to any relevant terms and conditions detailed in this Paragraph 5.

11. CUSTOMER’S RESPONSIBILITIES

11.1 Customer agrees that, without limiting Metadata’s obligations under Section 5 (Security), Customer is solely responsible for its use of the Company Services, including (a) making appropriate use of the Company Services to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Company Services; (c) securing Customer’s systems and devices that Metadata uses to provide the Company Services; and (d) backing up Customer Personal Data.

11.2 Customer shall ensure:

  1. that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Metadata of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)); and
  2. that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Metadata of Customer Personal Data.

11.3 Customer agrees that the Service, the Security Measures, and Metadata’s commitments under this DPA are adequate to meet Customer’s needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Customer Personal Data.

11.4 Customer shall not provide or otherwise make available to Metadata any Customer Personal Data that contains any (a) Social Security numbers or other government-issued identification numbers; (b) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (c) health insurance information; (d) biometric information; (e) passwords to any online accounts; (f) credentials to any financial accounts; (g) tax return data; (h) any payment card information subject to the Payment Card Industry Data Security Standard; (i) Personal Data of children under 13 years of age; or (j) any other information that falls within any special categories of personal data (as defined in GDPR) and/or data relating to criminal convictions and offences or related security measures (together, “Restricted Data”).

12. LIABILITY

The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this DPA and the Data Transfer Mechanism(s) (if and as they apply) will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement; provided that, nothing in this Section 9 will affect any person’s liability to Data Subjects under the third-party beneficiary provisions of the Data Transfer Mechanism(s) (if and as they apply).

13. INCORPORATION AND PRECEDENCE

13.1 This DPA shall be incorporated into and form part of the Agreement with effect from the Addendum Effective Date.

13.2 In the event of any conflict or inconsistency between:

  1. this DPA and the Agreement, this DPA shall prevail; or
  2. any Data Transfer Mechanism(s) entered into pursuant to Paragraph 4 of Annex 1 (European Annex) and this DPA and/or the Agreement, the Data Transfer Mechanism(s) shall prevail in respect of the Restricted Transfer to which they apply.

Annex 1

European Annex

1.PROCESSING OF CUSTOMER PERSONAL DATA

1.1 The Parties acknowledge and agree that the details of:

  1. Metadata’s Processing of Customer Personal Data; and
  2. Metadata’s transmission of Metadata Personal Data to Customer,

under this DPA are as set out in Attachment 1 to Annex 1 (European Annex) to the DPA.

1.2 Where Metadata receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Metadata shall inform Customer.

1.3 Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Customer Personal Data by or on behalf of Metadata pursuant to or in connection with the Agreement shall be in strict compliance with the GDPR and all other applicable laws.

2. SUBPROCESSING

2.1 Customer generally authorises Metadata to appoint Sub-Processors in accordance with this Paragraph 2.

2.2 Metadata may continue to use those Sub-Processors identified in the Sub-Processor List located here. 

2.3 Metadata shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor, by providing Customer with an updated copy of the Sub-Processor List via a ‘mailshot’ or similar bulk distribution mechanism sent via email to Customer’s contact point as set out in Attachment 1 to Annex 1 (European Annex). If, within fourteen (14) days of receipt of that notice, Customer notifies Metadata in writing of any objections (on reasonable grounds) to the proposed appointment:

  1. Metadata shall use reasonable efforts to make available a commercially reasonable change in the provision of the Company Services, which avoids the use of that proposed Sub-Processor; and
  2. Where such a change cannot be made within fourteen (14) days from Metadata’s receipt of Customer’s notice and/or no commercially reasonable change is available, then either Party may by written notice to the other Party with immediate effect terminate the Agreement, either in whole or to the extent that it relates to the Company Services which require the use of the proposed Sub-Processor, as its sole and exclusive remedy. Upon termination in accordance with this Paragraph 2.3(b), Customer shall pay any unpaid fees covering the Company Services rendered.

2.4 If Customer does not object to Metadata’s appointment of a Sub-Processor during the objection period referred to in Paragraph 2.3, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor.

2.5 With respect to each Sub-Processor, Metadata shall maintain a written contract between Metadata and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Metadata shall remain liable for any breach of this DPA caused by a Sub-Processor. 

2.6 Operational clarifications:

  1. The terms and conditions of this Paragraph 2 apply in relation to Metadata’s appointment and use of Sub-Processors under the EU SCCs (if and as they apply).
  2. Any approval by Customer of Metadata’s appointment of a Sub-Processor that is given expressly or deemed given pursuant to this Paragraph 2 constitutes Customer’s documented instructions to effect disclosures and onward transfers to any relevant Sub-Processors if and as required under Clause 8.8 of the EU SCCs (if and as they apply).

3. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

3.1 Metadata, taking into account the nature of the Processing and the information available to Metadata, shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments and prior consultations with Supervisory Authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Metadata.

3.2 Operational clarification: Except to the extent prohibited by applicable law, Customer shall be fully responsible for all time spent by Metadata (at Metadata’s then-current professional services rates) in Metadata’s provision of any cooperation and assistance provided to Customer under Paragraph 3.1, and shall on demand reimburse Metadata any such costs incurred by Metadata.

4. RESTRICTED TRANSFERS 

4.1 The Parties acknowledge that:

  1. Customer’s transmission of Customer Personal Data to Metadata; and
  2. Metadata’s transmission of Metadata Personal Data to Customer,

    may each involve a Restricted Transfer. The relevant Data Transfer Mechanism(s) that may be entered into under Paragraph 4.2 and/or 4.4 shall apply and have effect only if and to the extent permitted and required under the EU GDPR and/or UK GDPR (if and as applicable) to establish a valid basis under Chapter V of the EU GDPR and/or UK GDPR in respect of the relevant Restricted Transfer.


    EU Restricted Transfers

4.2 To the extent that any Processing of Personal Data under this DPA involves an EU Restricted Transfer, the Parties shall comply with their respective obligations set out in the EU SCCs, which shall apply to the relevant EU Restricted Transfer in the following manner:

  1. Module One of the EU SCCs applies to any EU Restricted Transfer of Metadata Personal Data from Metadata as ‘data exporter’ to Customer as ‘data importer’; and
  2. Module Two of the EU SCCs applies to any EU Restricted Transfer of Customer Personal Data from Customer as ‘data exporter’ to Metadata as ‘data importer’.

4.3 Any EU SCCs applicable in accordance with Paragraph 4.2 shall be deemed:

  1. populated in accordance with Attachment 2 to Annex 1 (European Annex); and
  2. entered into by the Parties and incorporated by reference into this DPA.

UK Restricted Transfers

4.4 To the extent that any Processing of Personal Data under this DPA involves a UK Restricted Transfer:

  1. the relevant EU SCCs entered into in accordance with Paragraph 4.2 of this Annex 1 shall apply to that UK Restricted Transfer as varied by the UK Transfer Addendum; and
  2. the Parties agree that the manner of the presentation of the information included in the UK Transfer Addendum shall not operate or be construed so as to reduce the Appropriate Safeguards (as defined in the Mandatory Clauses).

Adoption of new transfer mechanism

4.5 Metadata may on notice vary this DPA and replace any Data Transfer Mechanism(s) with:

  1. any new or replacement set(s) of standard contractual clauses; or
  2. any other another transfer mechanism,

    that enables the lawful transfer of Personal Data under this DPA in compliance with Chapter V of the GDPR.

    Provision of full-form Data Transfer Mechanism(s)

4.6 In respect of any given Restricted Transfer, if requested of either Party (“Requesting Party”) by a Supervisory Authority or Data Subject, on specific written request (made to the contact details set out in Attachment 1 to this Annex 1 (European Annex)), the other Party shall provide Requesting Party with an executed version of the relevant Data Transfer Mechanism(s) responsive to the request made of Requesting Party for countersignature by Requesting Party, onward provision to the relevant requestor and/or storage to evidence Requesting Party’s compliance with Applicable Data Protection Laws.

Attachment 1 TO 
EUROPEAN ANNEX

Data Processing Details

Note:

This Attachment 1 to Annex 1 (European Annex) to the DPA includes certain details of the Processing of Personal Data as required by Article 28(3) GDPR and to populate the appendices and/or tables to the Data Transfer Mechanism(s) (if and as they apply).

PART 1: DETAILS OF THE PARTIES

METADATA DETAILS

Name: Metadata, Inc., a Delaware corporation
Address: As set out in the pre-amble to the DPA
Contact Details for Data Protection:
Role: Chief Information Security Officer
Metadata Activities: Metadata leverages artificial intelligence to offer services for business-to-business marketers to automate their paid campaigns
Role:  As determined in accordance with Paragraph 4.2 of Annex 1:
  • Where Module One applies: Controller / ‘data exporter’
  • Where Module Two applies: Processor / ‘data importer’

CUSTOMER DETAILS

Name:The entity or other person who is a counterparty to the Agreement
Address:As set out in the Agreement
Contact Details for Data Protection:Customer’s contact details are Customer’s contact details submitted by
Customer and associated with Customer’s account for the Company
Services – unless otherwise notified to Metadata via email
Customer Activities:Customer’s activities relevant to this DPA are the use and receipt of
the Company Services under and in accordance with, and for the
purposes anticipated and permitted in, the Agreement as part of its
ongoing business operations
Role: As determined in accordance with Paragraph 4.2 of Annex 1:
  • Where Module One applies: Controller / ‘data importer’
  • Where Module Two applies: Controller / ‘data exporter’

PART 2: DETAILS OF CUSTOMER PERSONAL DATA

Categories of Data Subjects:Any individuals whose Personal Data is comprised within data submitted
to the Company Services by or on behalf of Customer under the
Agreement, which will be as determined by Customer in its sole
discretion through its use of the Company Services – but may include
Customer’s and its affiliates’:
  • “Staff”, namely:
    • employees and non-employee workers;
    • students, interns, apprentices and volunteers;
    • directors and officers;
    • advisers, consultants, independent contractors, agents and
      autonomous, temporary or casual workers.
  • Customers, clients, (sub-)licensees, users and end-users, website
    visitors and marketing prospects.

Where any of the above is a business or organisation, it includes
their Staff. Each category includes current, past and prospective Data
Subjects.

Categories of Personal Data:Any Personal Data comprised within data submitted to the Company
Services by or on behalf of Customer under the Agreement, which will
be as determined by Customer in its sole discretion through its use of
the Company Services – but may include:
  • first name;
  • last name;
  • title;
  • company email address;
  • social media information;
  • company phone number; and/or
  • company name.
Sensitive Categories of Data, and associated additional
restrictions/safeguards:</b >

Categories of sensitive data:

None – as noted in Section 8.4 of the
DPA, Customer agrees that Restricted Data, which includes ‘sensitive
data’ (as defined in Clause 8.7 of the EU SCCs), must not be
submitted to the Company Services.

Additional safeguards for sensitive data:

N/A

Frequency of transfer:Ongoing – as initiated by Customer in and through its use, or use on
its behalf, of the Company Services.
Nature of the Processing:Processing operations required in order to provide the Company
Services in accordance with the Agreement.
Purpose of the Processing:Customer Personal Data will be processed: (i) as necessary to provide
the Company Services as initiated by Customer in its use thereof, and
(ii) to comply with any other reasonable instructions provided by
Customer in accordance with the terms of this DPA.
Duration of Processing / Retention Period:For the period determined in accordance with the Agreement and DPA,
including Paragraph 4 of Annex 1 (European Annex) to the DPA.
Transfers to (sub-)processors:Transfers to Sub-Processors are as, and for the purposes, described
from time to time in the Sub-Processor List (as may be updated from
time to time in accordance with Paragraph 2 of Annex 1 (European
Annex) to the DPA).

PART 3: DETAILS OF METADATA PERSONAL DATA

Categories of Data Subjects:Any individuals whose Personal Data is comprised within Metadata
Personal Data – but may include marketing prospects.
Categories of Personal Data:Any Personal Data comprised within Metadata Personal Data – but may
include:
  • first name;
  • last name;
  • social media information;
  • company email address;
  • personal email address; 
  • phone number.
  • country;
  • city
  • zip code;
  • job title;
  • seniority;
  • department; and
  • industry.
Sensitive Categories of Data, and associated additional
restrictions/safeguards:</b >

Categories of sensitive data:

None.

Additional safeguards for sensitive data:

N/A

Frequency of transfer:Ongoing – as initiated by Customer in and through its use, or use on
its behalf, of the Company Services.
Nature of the Processing:Processing operations required in order to provide the Company
Services in accordance with the Agreement.
Purpose of the Processing:Metadata Personal Data will be processed as necessary to provide the
Company Services as initiated by Customer in its use thereof.
Duration of Processing / Retention Period:For the period determined in accordance with the Agreement and DPA,
including Paragraph 4 of Annex 1 (European Annex) to the DPA.
Transfers to (sub-)processors:See Sub-Processor List.

Attachment 2 TO 
EUROPEAN ANNEX

POPULATION OF EU SCCs

Notes:

  • The EU SCCs populated in accordance with this Attachment 2 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraph 4.2 of Annex 1 (European Annex) to the DPA).
  • Capitalized terms used in this Attachment 2 have the meanings given to them in the DPA.

1. SIGNATURE OF THE EU SCCs:

1.1 Where applicable in accordance with Paragraphs 6.1 and 6.2 of Annex 1 (European Annex) to the DPA: 

  1. each of the Parties is hereby deemed to have signed the EU SCCs at the relevant signature block in Annex I to the Appendix to the EU SCCs; and 
  2. those EU SCCs are entered into by and between the Parties with effect from (i) the Addendum Effective Date; or (ii) the date of the first EU Restricted Transfer to which they apply in accordance with Paragraphs 6.1 and 6.2 of Annex 1 (European Annex) to the DPA, whichever is the later.

2. POPULATION OF THE BODY OF THE EU SCCs

2.1 For each Module of the EU SCCs, the following applies as and where applicable to that Module and the Clauses thereof:

  1. The optional ‘Docking Clause’ in Clause 7 is not used and the body of that Clause 7 is left intentionally blank.
  2. In Clause 9: 
    (i) OPTION 2: GENERAL WRITTEN AUTHORISATION applies, and the minimum time period for advance notice of the addition or replacement of Sub-Processors shall be the advance notice period set out in Paragraph 2.3 of Annex 1 (European Annex) to the DPA; and
    (ii) OPTION 1: SPECIFIC PRIOR AUTHORISATION is not used and that optional language is deleted; as is, therefore, Annex III to the Appendix to the EU SCCs. 
  3. In Clause 11, the optional language is not used and is deleted. 
  4. In Clause 13, all square brackets are removed and all text therein is retained. 
  5. In Clause 17: 
    (i) OPTION 1 applies, and the Parties agree that the EU SCCs shall governed by the law of Ireland; and
    (ii) OPTION 2 is not used and that optional language is deleted. 
  6. For the purposes of Clause 18, the Parties agree that any dispute arising from the EU SCCs shall be resolved by the courts of Ireland, and Clause 18(b) is populated accordingly.    

2.2 In this Paragraph 2, references to “Clauses” are references to the Clauses of the EU SCCs.

3. POPULATION OF ANNEXES TO THE APPENDIX TO THE EU SCCs

3.1 Annex I to the Appendix to the EU SCCs is populated with the corresponding information detailed in Attachment 1 to Annex 1 (European Annex) to the DPA, with:

  1. Customer being ‘data exporter’ and Metadata being ‘data importer’ with respect to Restricted Transfers involving Customer Personal Data; and/or
  2. Metadata being ‘data exporter’ and Customer being ‘data importer’ with respect to Restricted Transfers involving Metadata Personal Data.

3.2 Part C of Annex I to the Appendix to the EU SCCs is populated as below:

The competent supervisory authority shall be determined as follows:

  • Where the data exporter is established in an EU Member State: the competent supervisory authority shall be the supervisory authority of that EU Member State in which the data exporter is established.
  • Where the data exporter is not established in an EU Member State, Article 3(2) of the GDPR applies and the data exporter has appointed an EU representative under Article 27 of the GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State in which the data exporter’s EU representative relevant to the processing hereunder is based (from time-to-time).
  • Where the data exporter is not established in an EU Member State, Article 3(2) of the GDPR applies, but the data exporter has not appointed an EU representative under Article 27 of the GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State notified in writing to the data importer’s contact point for data protection identified in Attachment 1 to Annex 1 (European Annex) to the DPA, which must be an EU Member State in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

3.3 Annex II to the Appendix to the EU SCCs is populated as below:

Please refer to Section 5 of the DPA and Annex 3 (Security Measures) to the DPA.

In the event that Customer receives a Data Subject Request under the EU GDPR and requires assistance from Metadata, Customer should email Metadata’s contact point for data protection identified in Attachment 1 to Annex 1 (European Annex) to the DPA. 

Attachment 3 TO 
EUROPEAN ANNEX

UK TRANSFER ADDENDUM

Notes:

  • The UK Transfer Addendum set out in this Attachment 3 is incorporated into and forms an effective part of the DPA (if and where applicable in accordance with Paragraph 4.4 of Annex 1 of the DPA).
  • Unless otherwise defined in this Attachment 3, capitalized terms used in this Attachment 3 have the meanings given to them in the DPA.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

VERSION B1.0, in force 21 March 2022

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1: Parties

All relevant information and details are as set out in Attachment 1 to Annex 1 of the DPA and it is noted that the UK Addendum is deemed to have been signed by the Parties pursuant to and in accordance with Paragraph 4.4 of Annex 1 of the DPA with effect from the Addendum Effective Date.

Table 2: Selected SCCs, Modules and Selected Clauses

The version of the Approved EU SCCs which this UK Addendum is appended to, detailed below, including the Appendix Information:

Date: Addendum Effective Date
Reference (if any): the EU SCCs
Other identifier (if any): n/a

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this UK Addendum is set out in:

Annex 1A: List of Parties: Part 1 of Attachment 1 to Annex 1 of the DPA
Annex 1B: Description of Transfer: Part 2 and/or Part 3 of Attachment 1 to Annex 1 of the DPA (as applicable)
Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: Annex 3 of the DPA
Annex III: List of Sub processors (Modules 2 and 3 only): n/a

Table 4: Ending this Addendum when the Approved Addendum Changes

Which Parties may end this Addendum as set out in Section 19: Either Party

Part 2: Mandatory Clauses

The Mandatory Clauses are incorporated by reference and form a binding and effective part of this UK Transfer Addendum.

Annex 2

California Annex

For purposes of this California Annex, the terms, “business,” “commercial purpose,” “personal information,” “sell” and “service provider” shall have the respective meanings given thereto in the CCPA.

Customer Personal Data

  1. It is the Parties’ intent that with respect to any Customer Personal Data that constitutes personal information, Metadata is a service provider. Metadata shall not (a) sell any such personal information; (b) retain, use or disclose any such personal information for any purpose other than for the specific purpose of providing the Company Services, including retaining, using, or disclosing such personal information for a commercial purpose other than the provision of the Company Services; or (c) retain, use or disclose such personal information outside of the direct business relationship between Metadata and Customer. Metadata hereby certifies that it understands its obligations under this Annex 2 and will comply with them.
  2. The Parties acknowledge that Metadata’s retention, use and disclosure of Customer Personal Data that constitutes personal information authorised by Customer’s instructions stated in the DPA are integral to the Company Services and the business relationship between the Parties. The exchange of Customer Personal Data does not form part of the consideration exchanged between the Parties in respect of the Agreement or any other business dealings.

 Metadata Personal Data

  1. With respect to any Metadata Personal Data that constitutes personal information, Customer represents and warrants that (a) Customer shall not sell any such personal information and (b) Customer shall comply with the CCPA, including that Customer shall comply with all Data Subject Requests, whether received directly from Data Subjects or indirectly through Metadata.

Annex 3

Security Measures

As from the Addendum Effective Date, Metadata will implement and maintain the Security Measures as set out in this Annex 3.

  1. Organizational management and dedicated staff responsible for the development, implementation and maintenance of Metadata’s information security program.
  2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Metadata’s organization, monitoring and maintaining compliance with Metadata’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
  3. Data security controls which include at a minimum logical segregation of data, restricted (e.g., role-based) access and monitoring, and utilisation of commercially available and industry standard encryption technologies for Customer Personal Data.
  4. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.
  5. Password controls designed to manage and control password strength, expiration and usage.
  6. System audit or event logging and related monitoring procedures to proactively record user access and system activity.
  7. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Metadata’s possession.
  8. Procedures and tracking mechanisms designed to test, approve, and monitor all material changes to Metadata’s technology and information assets.
  9. Incident management procedures designed to allow Metadata to investigate, respond to, mitigate, and notify of events related to Metadata’s technology and information assets.
  10. Vulnerability assessment and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code.
  11. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disaster.