{"id":13884,"date":"2023-01-31T14:47:10","date_gmt":"2023-01-31T14:47:10","guid":{"rendered":"https:\/\/piano.io\/?page_id=13884"},"modified":"2023-02-02T09:17:50","modified_gmt":"2023-02-02T09:17:50","slug":"piano-master-services-agreement-terms-and-conditions-archive-january-2023","status":"publish","type":"page","link":"https:\/\/piano.io\/es\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/","title":{"rendered":"PIANO MASTER SERVICES AGREEMENT<br>TERMS AND CONDITIONS (Archive January 2023)"},"content":{"rendered":"\n<p><style>\n    strong {<br \/>\n        font-weight: bold!important;<br \/>\n    }<br \/>\n    ul li, ol li {<br \/>\n        font-size: 10pt!important;<br \/>\n        line-height: 2!important;<br \/>\n    }<br \/>\n    .pn-generic-template-page { line-height: 1.4!important;}<\/p>\n<\/style><\/p>\n<h5><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>DEFINITIONS<\/strong><\/span><\/h5>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">\u201c<strong>Affiliate<\/strong>\u201d means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. \u201cControl\u201d, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">\u201c<strong>Client Data<\/strong>\u201d means all electronic data or information submitted by Client to the Services, whether that data or information is submitted by Client, Authorized Users, or general public users of the Network. Client shall be responsible for (a) Client\u2019s and Users\u2019 use of the Services, and (b) the appropriateness and legality of all Client Data.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">\u201c<strong>Network<\/strong>\u201d means the network of websites or web services operated by Client, and Authorized Users, and used in connection with the Services, including but not limited to the Client\u2019s own website, or web services, and third-party web sites or web services that directly or indirectly are using the Services.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>1.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SERVICES.&nbsp;<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) <u>Services<\/u>.&nbsp; Piano agrees to provide Client with content monetization services on a hosted basis, using Piano\u2019s software as a service platform as it may be revised from time to time (&#8220;<strong>Software<\/strong>&#8220;) including any customizations of the Software, reporting services, training, support, and\/or consulting services (collectively, the \u201c<strong>Services<\/strong>\u201d) in accordance with this Agreement and as described in any executed software schedule (\u201c<strong>Software Schedule<\/strong>\u201d) or executed Statements of Work to this Agreement (\u201c<strong>SOW<\/strong>\u201d) in the form attached hereto. SOWs, Software Schedules, Order Forms, and any other attachments or exhibits to this Agreement are collectively referred to in this Agreement as \u201cSchedules,\u201d and are all hereby incorporated into this Agreement.&nbsp; Each Schedule is subject to the terms and conditions of this Agreement, unless otherwise expressly stated therein, and shall include any terms and conditions that are specific to the Services identified therein.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Schedules<\/u>. To the extent applicable, each Schedule may include: (i) a description of the Software and Services; (ii) Client\u2019s websites and\/or mobile applications for which the Services will be provided (\u201c<strong>Websites<\/strong>\u201d): (iii) a description of the parties\u2019 respective responsibilities; (iv) fees and payment terms; and (v) names and contact information of Piano and Client contacts.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>Deliverables<\/u>. The term \u201c<strong>Deliverables<\/strong>\u201d means all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts which are created by Piano specifically for Client during the Term of this Agreement and described in a Schedule, along with any unique documentation created for Client related to any of the foregoing. During the course of Piano\u2019s performance of Services under any Schedule, Client may request changes in the Software or Services (including the addition of other Websites). Piano will incorporate such changes, provided the parties mutually agree to the changes and execute a change order or new Schedule, signed by both parties, setting forth the amended scope of work and any changes in Websites, Software, Services, scheduled completion dates or applicable fees.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Acceptance of Deliverables for Consulting Services.<\/u> Services may be performed on either a time-and-materials basis or a fixed-cost basis, as specified in the applicable Software Schedule or SOW. Services performed on a time-and-materials basis shall be deemed accepted upon performance. If a Software Schedule or SOW specifies Deliverables provided on a fixed-cost basis, such Deliverables shall be subject to Client\u2019s review and acceptance, which shall not be unreasonably withheld, delayed or conditioned and may only be withheld for material verifiable non-conformity to the specifications set forth in the applicable Software Schedule or SOW and this Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>2.<\/strong>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <strong>CLIENT OBLIGATIONS<\/strong>. In addition to obligations set forth elsewhere in this Agreement, Client shall have the following obligations hereunder.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) <u>General<\/u>. Client agrees (i) to make available, at Client\u2019s expense, any and all Client personnel reasonably necessary to provide information required by Piano to complete any of the Deliverables or provide the Services, and (ii) to the extent specified in a Schedule, to request and facilitate, at Client\u2019s expense, the participation, as necessary, of any third-party vendors, solution providers, or other resources acceptable to Client, if any.&nbsp; Client further agrees to allow Piano reasonable access to Client\u2019s relevant information and materials as requested by Piano to enable Piano to provide the Deliverables and the Services, and access to Client\u2019s systems, software and databases as reasonably requested to enable Piano to provide the Services and the Deliverables.&nbsp; Client acknowledges and agrees that Piano\u2019s ability to provide the Services and the Deliverables in accordance with the terms of this Agreement is dependent upon and subject to Client\u2019s timely performance of its obligations under this Agreement and each Schedule. Client acknowledges further that Piano acts as a mere technological carrier and is not responsible for the content of Client Data or for evaluating the appropriateness of the Client Data in relation to the environment where such data are disclosed or published.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Notification<\/u>. Client shall immediately provide written notification to Piano of (i) any use of the Software or Services through any of Client&#8217;s Websites or facilities by anyone other than Client\u2019s employees, authorized agents, or other individuals Client has authorized to access and use the Software or Services on Client\u2019s behalf (\u201c<strong>Authorized Users<\/strong>\u201d), or (ii) the actual or suspected disclosure, whether deliberate or accidental, of any usernames, passwords, URLs, or other access to information required for use of the Software or Services, to anyone other than Authorized Users who have a need to know such information.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>Translation<\/u>. Client, at Client&#8217;s sole discretion, may use Piano Software to present various email messages, alerts, interfaces and messages to Client\u2019s online users. Piano provides translations of its administrative dashboard and End-User Communications for Client\u2019s benefit in English, German, French, Spanish, and Portuguese, but makes no warranty regarding the accuracy or suitability of those translations. If deemed necessary by Client, Client shall be responsible for editing and\/or translating any End-User Communications at Client\u2019s sole expense.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Legal Compliance<\/u>. Client shall be responsible for ensuring that its use of the Software and Services is in compliance with all applicable laws, rules and regulations of the countries in which Client\u2019s users are located (\u201c<strong>Applicable Law<\/strong>\u201d). In the event that, as part of this Agreement, either party collects personal data (as defined in EU Regulation No. 2016\/679, the General Data Protection Regulation (the \u201c<strong>GDPR<\/strong>\u201d)) from&nbsp;data subjects located in the European Economic Area pursuant to this Agreement, the Data Processing Agreement (\u201c<strong>DPA<\/strong>\u201d) pursuant to GDPR Article 28 and attached hereto as Exhibit B shall apply. Client will also ensure that its use of the Service is in compliance with Applicable Laws, to the extent such laws differ from the laws of the U.S. or the GDPR.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) <u>Taxes<\/u>. If applicable, Client will collect applicable sales tax, VAT, or other tax (&#8220;<strong>Tax<\/strong>&#8220;) from each subscriber making a purchase through the Service on Client&#8217;s Websites where required by applicable laws and remit any Tax due to the appropriate tax jurisdiction(s), file all applicable documents, retain copies of any relevant documents in determining Tax calculations, and handle and address any inquiry by any jurisdiction regarding Tax on the purchase.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>3.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FEES AND PAYMENT TERMS.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) Fees shall be as set forth in the applicable Schedule. Unless otherwise stated in a Schedule, Client will pay all undisputed amounts within thirty (30) days of the date of the applicable invoice. If Client disputes any invoiced amount in good faith, Client will notify Piano in detail in writing as to the nature of the disputed charges and the reason for Client\u2019s disagreement prior to the due date of the applicable invoice or Client\u2019s right to dispute such invoice shall be waived and Client will pay all undisputed charges on the applicable invoice by their due date. Piano will respond by providing documentation in reasonable detail for the disputed charges. The parties will make all reasonable attempts to resolve the dispute in good faith and as amicably as possible within thirty (30) days.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) Client shall pay Piano all fees that are owed under this Agreement even if Client has not received payment from the transactions utilizing the Software and\/or the Services. Except as otherwise specified in this Agreement or in any Schedule, (i) fees are payable based on Software or Services purchased and not actual usage, (ii) payment obligations are non-cancelable and, except as expressly provided herein, fees paid are non-refundable, and (iii) the agreed fee amount cannot be decreased during the relevant term stated in a Schedule.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) If fees owed to Piano are based on revenue share, Piano will issue to Client a report generated by Piano from Client\u2019s traffic and click-through data that include total numbers for a given time period and any aggregated calculations on revenue or conversion data (a \u201c<strong>Royalty Report<\/strong>\u201d) on a monthly basis. Client shall have five (5) business days after receipt of such Royalty Report to dispute any amounts owed to Piano. If Client fails to dispute a Royalty Report within such time period, Client is deemed to have agreed to the amount owed to Piano and Client\u2019s right to dispute that invoice shall be waived.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) All payments due to either party hereunder shall be net of any bank or wire fees, delivered or mailed to the address listed for notices herein or wired to an account specified in writing by the party to which payment is due. Except as expressly stated in a Schedule, there will be no other fees owed (including to any third parties for any third-party components that may be included within the Software) by Client hereunder. All fees shall be payable in USD.&nbsp; Payments to Client, if applicable, shall be submitted to the address\/account indicated in the Schedule. Payments to Piano shall be submitted to the account \/ address set forth on the relevant invoice.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) Client shall be deemed in default of this Agreement if any undisputed invoiced amounts remain unpaid&nbsp;thirty (30) days after the invoice due date.&nbsp; Late payments by Client will be subject to late fees at the rate of one and one-half percent (1.5%) per month, or, if lower, the maximum rate allowed by law, determined and compounded daily from the invoice due date until such invoice is paid in full.&nbsp; If Client is in default of this Agreement, Piano may, without limiting its other rights and remedies under this Agreement and\/or applicable laws, accelerate Client\u2019s unpaid fee obligations under this Agreement including all Schedules and suspend the provision of the Software and\/or Services, without penalty or liability to Piano, upon notice to Client. Suspension of the Software and\/or Services shall not release Client of its payment obligations under this Agreement. If Client is in default of its payment obligations, Client shall be liable for any and all reasonable costs incurred by Piano in order to collect the overdue amounts.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(f) Fees charged to Client hereunder do not include any local, state, federal or foreign taxes, levies or duties of any nature, including value-added, sales use or withholding taxes (&#8220;<strong>Taxes<\/strong>&#8220;). Client is responsible for paying all Taxes, excluding only taxes based on Piano&#8217;s income. If Piano has the legal obligation to pay or collect Taxes for which Client is responsible under this Section, the appropriate amount shall be invoiced to and paid by Client unless Client provides Piano with a valid tax exemption certificate authorized by the appropriate taxing authority. Client will pay any additional taxes as are necessary to ensure that the net amounts received by Piano, after all such taxes are paid, are equal to the amounts that Piano would have been entitled to in accordance with this Agreement as if the taxes did not exist.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(g) Piano reserves the right to increase the fee for a renewal of any Schedule (a \u201c<strong>Renewal<\/strong>\u201d) in accordance with industry standards, on an annual basis by giving Client ninety (90) days written notice prior to the expiration of such Schedule. If Client objects to the increase and Piano and Client, negotiating in good faith, cannot mutually agree on a fee amount for a Renewal, then Client may terminate such Schedule by giving Piano sixty (60) days written notice prior to the expiration of the term of such Schedule. Any such termination shall be effective on expiration of the then current Schedule term. Client acknowledges that expiration of any discount or incentive programs which Client has previously received does not constitute a fee increase.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>4.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OWNERSHIP OF INTELLECTUAL PROPERTY.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) <u>Piano Intellectual Property<\/u>.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(i)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <u>Pre-Existing Piano Intellectual Property<\/u>. The parties agree that Piano shall exclusively own and retain all \u201c<strong>Piano IP<\/strong>\u201d, defined as follows: (A) the Software, and all modifications thereto and future versions thereof; (B) all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts, any of which existed prior to the Effective Date of this Agreement, whether created by or for Piano (\u201c<strong>Pre-Existing Materials<\/strong>\u201d), including but not limited to the proprietary technology offered at Piano.io (and other sites operated by Piano) and other applications; (C) Piano\u2019s business, templates, documents, materials, technology, software, source code, website(s), modifications, updates and enhancements; (D) any and all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts that are developed by Piano (except Deliverables); and (E) all copyrights, trademarks, service marks, trade secrets, patents, patent applications, moral rights, contractual rights of non-disclosure or any other intellectual property or proprietary rights, however arising, throughout the world (collectively \u201c<strong>Intellectual Property Rights<\/strong>\u201d) with respect to any and all of the foregoing as set out in subsections (A) &#8211; (D).<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(ii)&nbsp;&nbsp;&nbsp;&nbsp; <u>Feedback<\/u>.&nbsp; In addition, the parties acknowledge that Piano may continue to modify its Software and Services, and that Client may make requests or suggestions to Piano for changes or additions to the Software or Services (\u201c<strong>Feedback<\/strong>\u201d).&nbsp; The parties agree that any modifications or enhancements to the Software or Services, regardless of whether they are derived from or related to Feedback shall also be Piano IP unless stated otherwise in a separate SOW between the parties.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(iii)&nbsp;&nbsp;&nbsp; <u>Assignment of Intellectual Property Ownership<\/u>. To the extent Piano is not automatically deemed to be the author, inventor or owner of any Piano IP, Client agrees to assign and hereby assigns, all right, title and interest it may have in any Piano IP to Piano and agrees to execute all documents necessary to effectuate Piano\u2019s full ownership in and to all Piano IP.&nbsp; Client appoints Piano its attorney in fact to execute such documents.&nbsp; This appointment is coupled with an interest and is therefore irrevocable.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Data Rights<\/u>.&nbsp; The following data rights shall be applicable to this Agreement:<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(i)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u201c<strong>Personal Data<\/strong>\u201d consists of any personal information relating to an identified or an identifiable end-user within the meaning of Article 4(1) of the GDPR, such as name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, offer conversion and\/or interaction data, referring site, or other information relating to such natural person collected through the Service whether via cookies or other tracking technologies, the Service\u2019s functionality, or otherwise. Personal Data will be owned by Client.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(ii)&nbsp;&nbsp;&nbsp;&nbsp; \u201c<strong>Non-Personal Data<\/strong>\u201d consists of information other than Personal Data, whether collected via cookies or other tracking technologies, the Service\u2019s functionality, or otherwise, on an anonymous basis in cases without means reasonably likely used by the parties to identify a natural person to whom such data relates. Non-Personal Data will be owned by Client, subject to the exceptions described below.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">For the purposes of enriching the Service, Client hereby grants Piano a royalty-free license during the Term to access, reproduce, display, and create reports or other derivative works including on the basis of the Personal Data and\/or Non-Personal Data, in an anonymized format only (\u201cReports\u201d) and to distribute such Reports during the Term to third parties only when the Reports contain aggregated anonymous data in accordance with Article 89 of the GDPR. Any such Reports created by Piano shall also be provided to Client.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(iii)&nbsp;&nbsp;&nbsp; Piano shall adhere to the&nbsp;DPA attached&nbsp;as Exhibit B hereto and made a part hereof. If and to the extent of an express and direct conflict between the terms of this Section 4(b) and the&nbsp;DPA in Exhibit B, the terms of this Section 4(b) shall apply.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>Client Intellectual Property<\/u>.&nbsp; Client exclusively owns and retains all right, title, and interest in and to (i) its business, technology, trademarks, and websites and all other Intellectual Property Rights in materials that are developed and owned by Client; (ii) any and all works of authorship, programs, data, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts that Client develops independently of any collaboration with Piano, and that are not derived from or that do not directly relate to the Services, Pre-Existing Materials or any other Piano IP, and that relate to Client\u2019s Websites, properties or data; and (iii) any and all content or data delivered into or stored into the Software by Client (or its users), subject to the data rights described in Section 4(b) above or in any Schedule (collectively, \u201c<strong>Client Materials<\/strong>\u201d).&nbsp; Client exclusively owns and retains all Intellectual Property Rights, title, and interest in and to each of the Client Materials, subject to the rights and licenses granted in this Agreement or a Schedule.&nbsp; Client grants to Piano a non-exclusive, fully-paid license to use, reproduce, and prepare derivative works of the Client Materials for purposes of performing the Services and creating Deliverables for the Term of this Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Deliverables<\/u>.&nbsp; Client shall own the entire right, title and interest in any Deliverables. Piano agrees to assign and hereby assigns, all right, title and interest it may have in any Deliverables to Client. Piano agrees to execute all documents necessary to effect Client&#8217;s full ownership in and to all Deliverables. For purposes of clarity, the Client Deliverables do not include Piano IP or any Open Source Software.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>5.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CLIENT RIGHTS.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano grants Client a non-exclusive, non-transferable (except as set forth herein), limited license to use the Piano IP in accordance with the terms of this Agreement and each Schedule, and only for the purpose of utilizing the Services and any Deliverables. Except as otherwise expressly provided in this Agreement, no other license or right shall be deemed granted or implied with respect to the Piano IP.&nbsp; Except as otherwise expressly allowed in this Agreement, Client shall not (i) use, distribute, sell, sublicense or disclose any of the Piano IP without written authorization of Piano; or (ii) reproduce, modify, prepare derivatives of, reverse assemble, reverse compile or otherwise reverse engineer the Piano IP.&nbsp; Nothing herein will be construed as granting Client, by implication, estoppel or otherwise, any license or other right to any Intellectual Property Rights of Piano or its licensors except for the rights and license expressly granted herein. Piano and its licensors retain all rights not so granted.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>6.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CONFIDENTIALITY.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) As used herein, the term \u201c<strong>Confidential Information<\/strong>\u201d shall mean all non-public information disclosed either before or after the execution of this Agreement, whether written or oral, that is designated as confidential or that, given the nature of the information or the circumstances surrounding its disclosure, reasonably should be considered as confidential. Confidential Information shall include Piano IP, Client Materials, Personal Data, the terms of this Agreement (including Schedules), and other information deemed proprietary or confidential by the party disclosing the Confidential Information (the \u201c<strong>Disclosing Party<\/strong>\u201d), and all record-bearing media containing or disclosing such information. For the avoidance of doubt, Piano\u2019s Confidential Information shall include the Piano IP and Client\u2019s Confidential Information shall include Client Materials, Personal Data and Non-Personal Data.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) A party receiving Confidential Information (the \u201c<strong>Receiving Party<\/strong>\u201d) shall not directly or indirectly, at any time, without the prior written consent of Disclosing Party, use or disclose Confidential Information or any part thereof other than necessary for the performance of that party\u2019s obligations under this Agreement. Receiving Party agrees to and shall take all necessary steps to protect the confidentiality of Confidential Information.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) The term Confidential Information does not include information which: (i) has been or becomes published and publicly available or is now, or in the future, in the public domain without breach of this Agreement or breach of a similar agreement by a third party; (ii) prior to disclosure hereunder, is properly within the legitimate possession of Receiving Party which can be verified by independent evidence; (iii) subsequent to disclosure hereunder, is lawfully received from a third party having rights therein without restriction of third party\u2019s or Receiving Party\u2019s rights to disseminate the information and without notice of any restriction against its further disclosure; (iv) is independently developed by Receiving Party without use of or reference to such Confidential Information which can be verified by independent evidence; or (v) is disclosed pursuant to a requirement of a governmental entity or the disclosure of which is required by law, subject to Section 6(d) below.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) If Receiving Party is requested by a court, governmental entity or other third party to disclose any Confidential Information, it will promptly notify Disclosing Party (to the extent permitted) to permit Disclosing Party to seek a protective order or take other appropriate action.&nbsp; Receiving Party will also reasonably cooperate (at Disclosing Party\u2019s sole cost and expense) in Disclosing Party\u2019s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be afforded Confidential Information and shall only disclose the part of Confidential Information as is required by law to be disclosed and Receiving Party will use its reasonable efforts to obtain confidential treatment therefor.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) Confidential Information shall not, without the prior written consent of Disclosing Party, be disclosed to any person or entity other than employees or agents of Receiving Party who need to know Confidential Information and, in those instances, only to the extent justifiable by that need.&nbsp; Receiving Party shall ensure that all such entities and personnel comply with the terms of this Agreement.&nbsp; Receiving Party shall be responsible for any breach of this Agreement by its employees and\/or agents and by any other person to whom Receiving Party has disclosed Confidential Information. &nbsp;The foregoing will not be deemed to prevent Piano from disclosing anonymized Non-Personal Data when aggregated with similar information it has received from its other customers, such that the Non-Personal Data is not traceable to Client.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(f) Receiving Party shall notify Disclosing Party as soon as reasonably possible, and cooperate with Disclosing Party, upon Receiving Party\u2019s discovery of any loss or compromise of Confidential Information.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(g) Except as otherwise expressly set forth herein, Receiving Party acknowledges that Confidential Information is the exclusive property of and belongs solely to Disclosing Party and shall not claim otherwise for any purpose.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(h) Receiving Party agrees to return to Disclosing Party, destroy and\/or permanently delete, at Disclosing Party&#8217;s discretion, and confirm in writing the destruction, permanent deletion and\/or return, all written, tangible or otherwise accessible material in any form (including electronic media such as computer diskettes, CD-ROM, electronic copies or any material resident in the hard or external drive of any computer) containing or reflecting any Confidential Information (including all copies, summaries, excerpts, extracts or other reproductions) promptly following Disclosing Party\u2019s request, provided, however, that subject to its ongoing obligation to maintain the confidentiality of such materials, Receiving Party may retain one copy of the Confidential Information for Receiving Party\u2019s legal files for compliance and regulatory purposes and need not purge electronic archives and backups made in the ordinary course of business.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(i) In addition to any other rights and remedies available to Disclosing Party hereunder or at law, Receiving Party acknowledges and agrees that due to the nature of Confidential Information its confidentiality obligations to Disclosing Party hereunder are of a unique character and agrees that any breach of such obligations may result in irreparable and continuing damage to Disclosing Party for which there may be no adequate remedy in damages.&nbsp; Notwithstanding anything to the contrary in this Agreement, Disclosing Party&nbsp;may seek injunctive relief, without the necessity of posting a bond or other security, even if otherwise normally required, and\/or a decree for specific performance, and such further relief as may be proper from a court with competent jurisdiction.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>7.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TERM AND TERMINATION.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) <u>Term<\/u>. Unless earlier terminated in accordance with the rights set forth in this Agreement, the term of each Schedule shall be as set forth in such Schedule (\u201cTerm\u201d).&nbsp; This Agreement shall commence as of the Effective Date and remain in effect until all Schedules containing a specific Term have been terminated. The termination of any Schedule shall not automatically cause the termination of any other Schedule or of this Agreement, except as otherwise set forth in Section 7.(b) nor shall it relieve either party of any claims which the other party may have against it relating to this Agreement or impact the obligations of the parties under any other Schedule not terminated.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Termination<\/u>. Either party may terminate this Agreement or any Schedule upon written notice of termination if the other party: (1) defaults in the performance of any material requirement or obligation created by this Agreement, or breaches any material provision of this Agreement, which default or breach is not cured within thirty (30) days following the defaulting party\u2019s receipt of written notice of default or breach; (2) ceases doing business in the normal course; (3) is the subject of any state or federal proceeding (whether voluntary or involuntary) relating to its bankruptcy, insolvency or liquidation that is not dismissed within ninety (90) days; (4) makes an assignment for the benefit of creditors or a receiver is appointed for a substantial part of the other party\u2019s assets or (5) for a period exceeding thirty (30) days, fails to fulfill its obligations under this Agreement by reason of a Force Majeure Event.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Upon termination of this Agreement as set forth above, all Schedules to this Agreement shall also immediately terminate. However, termination of a Schedule shall not relieve Client of its obligation to pay to Piano (or allow Piano to retain from end-user payments it collects on Client\u2019s behalf hereunder) fees and other sums that have accrued for Services rendered. For any termination of a Schedule or this Agreement, Client shall receive a refund from Piano of any prepaid and unused payments as of the effective date of termination.&nbsp;&nbsp;&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>Effects of Termination; Survival<\/u>.&nbsp; Upon termination of this Agreement, all rights and licenses granted hereunder shall cease, except as otherwise provided in this Agreement. Those provisions of this Agreement which, by their nature, are meant to survive termination shall so survive, and include without limitation provisions related to ownership of intellectual property, confidentiality, indemnification, limitation of liability, warranties and representations, governing law and venue, and payment (to the extent such payments were earned during the Term of this Agreement).&nbsp; Notwithstanding the termination of this Agreement for any reason, neither party shall be relieved of any duty, obligation, debt or liability that arose or accrued prior to the termination of the Agreement or Schedule.&nbsp;Except in the event Client terminates the Agreement under Section 7 (b), Client will pay any unpaid fees payable under any applicable Schedule in effect prior to the termination date for the remainder of the relevant term of such Schedule.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Return of Client Data<\/u>:&nbsp; Upon Client\u2019s request made within thirty (30) days after the effective date of termination of this Agreement or any Schedule, Piano will make available to Client for download a file of Client Data. After such thirty (30) day period, Piano shall have no obligation to maintain or provide any of Client\u2019s Data and may thereafter, unless legally prohibited, delete all of Client\u2019s Data in Piano\u2019s systems or otherwise in Piano\u2019s possession or under Piano\u2019s control.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>8.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; REPRESENTATIONS AND WARRANTIES.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) Each party warrants and represents at all times during the Term of this Agreement that: (i) it has the right and full power and authority to enter into this Agreement and each Schedule; (ii) it is duly organized and validly existing and in good standing under the laws of the state and country of its incorporation or formation; (iii) it is under no contractual or other legal obligation which shall in any way interfere with its full, prompt and complete performance hereunder; (iv) it will comply with all applicable laws in its performance of this Agreement.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) Piano further represents and warrants that, (i) to the best of its knowledge the Services and Deliverables, do not infringe on any valid and enforceable Intellectual Property Right of any third party (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (ii) all the Services performed hereunder will be rendered in a competent and professional manner; (iii) all Services shall materially conform to the specifications set forth in the applicable Schedule; (iv) neither the Software nor the Deliverables contain any Harmful Code; (v) Piano complies with all Open Source Software licenses embedded in its Software or otherwise used or incorporated in its Software and shall not cause Contamination of Client\u2019s or Client licensor technology in performing its Services; and (vi) except as expressly stated in the Agreement or in a Schedule, there will be no additional third-party licenses or permissions necessary to obtain in connection with Client\u2019s use of the Services under this Agreement.&nbsp; For purposes of this Agreement, \u201cHarmful Code\u201d means any software or other materials that are intentionally designed to (a) disrupt, disable, harm or impede operation, or (b) impair operation based on the lapse of time, including but not limited to viruses, worms, time bombs, time locks, access codes or trap door devices. \u201cContamination\u201d means that proprietary technology has become subject to the terms of an Open Source Software license under which downstream recipients or other third parties may claim the right to (a) copy, create derivative works of, or redistribute the proprietary technology, or (b) receive the source code of the proprietary technology.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) Client further represents and warrants that, (i) to the best of its knowledge, Client Materials do not infringe on, violate or misappropriate any valid and enforceable Intellectual Property Rights of any third party (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (ii) to the best of its knowledge, it has secured any and all necessary intellectual property rights associated with the Client Data and the content that is made available to consumers through its Websites, (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (iii) it has secured the requisite permission or consent to use the Client Data and provide it to Piano for processing, (iv) has secured that the Client Data does not contain any messages or images that are in violation of Applicable Laws, (v) it will use the Services in accordance with the terms and conditions hereof and Applicable Law; and (vi) it will not use the Services for purposes of segmenting, re-targeting, creating or supplementing user profiles or inventory profiles, creating, supplementing or amending interest categories, or syndication or other distribution to third parties, unless such data collection and usage are authorized by or on behalf of the data owner.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) Client acknowledges that from time to time, Client may be required to provide Piano with materials that may have been developed by third parties (collectively, \u201c<strong>Third-Party Materials<\/strong>\u201d).&nbsp; Client represents that at the time it delivers any Third-Party Materials to Piano, Client has obtained the right to use the Third-Party Materials, and that Piano\u2019s use of such Third-Party Materials will not infringe the Intellectual Property Rights of any third party.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) Except as otherwise expressly set out in this Agreement, Software is provided on an as-is basis. Piano will service the Software and\/or the Services in accordance with the Service Level Agreement set forth in Exhibit A.&nbsp;&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>9.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; INDEMNIFICATION<\/strong> <\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) \u201c<strong>Losses<\/strong>\u201d means losses, liabilities, damages, fines, penalties, settlements, judgments, costs and expenses, including reasonable attorneys\u2019 fees and expert fees, and interest (including taxes) arising out of a third-party claim.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Indemnity by Piano<\/u>. Piano will indemnify, defend and hold harmless Client and Client\u2019s officers, directors, employees, successors and assigns (the \u201c<strong>Client Indemnified Parties<\/strong>\u201d) from and against, any Losses suffered, incurred or sustained by a Client Indemnified Party or to which a Client Indemnified Party becomes subject, resulting from, arising out of, or relating to: (i) any breach or alleged breach by Piano of this Agreement (including Schedules) and\/or any of its obligations and representations and warranties hereunder, or (ii) injury or death, or damage to any property caused by or arising from the negligent acts or omissions of Piano in connection with performance of the Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>Indemnity by Client<\/u>. Client will indemnify, defend and hold harmless Piano, its subsidiaries, and the officers, directors, employees, shareholders, successors and assigns of each of them (the \u201c<strong>Piano Indemnified Parties<\/strong>\u201d) from and against, any Losses suffered, incurred or sustained by a Piano Indemnified Party or to which a Piano Indemnified Party becomes subject, resulting from, arising out of, or relating to: (i) any breach or alleged breach by Client of this Agreement (including Schedules) and\/or any of its obligations and representations hereunder, or (ii) Client\u2019s failure to pay and discharge any taxes (including interest and penalties) for which Client is responsible pursuant to the provisions of this Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Remedies for Infringement<\/u>. Should any Piano IP become or, in Piano\u2019s opinion, be likely to become the subject of any infringement claim, Piano shall have the right, at its sole discretion and at its expense, to either procure for Client the right to continue using or receiving the Piano IP, replace or modify the Piano IP so it becomes non-infringing, or remove the questionable Piano IP. This Section 9 states Piano\u2019s entire liability, and Client\u2019s sole and exclusive remedy for Intellectual Property Rights claims relating to or arising out of any Piano IP, other than the indemnification obligations set forth herein should Piano forego this right. Piano shall have no obligation to Client for indemnification with regard to any claim of infringement to the extent that the Piano IP infringement claim or allegation is based on: (1) a modification made by an entity other than Piano or its designee; (2) a violation by Client of this Agreement; (3) the inclusion by Client of any Client Materials or Third-Party Materials in any Piano IP if the claim would not have arisen but for such modification, violation or inclusion of Client Materials or Third-Party Materials respectively.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) <u>Indemnification Procedures<\/u>. If any third-party claim is commenced against a person or entity entitled to indemnification under this Section (the \u201c<strong>Indemnified Party<\/strong>\u201d), notice thereof shall be given to the party that is obligated to provide indemnification (the \u201c<strong>Indemnifying Party<\/strong>\u201d) as promptly as practicable. The Indemnified Party will cooperate, at the cost of the Indemnifying Party, in all reasonable respects with the Indemnifying Party and its attorneys in the investigation, trial and defense of such claim and any appeal arising therefrom; provided, however, that the Indemnified Party may, at its own cost and expense, participate, through its attorneys or otherwise, in such investigation, trial and defense of such claim and any appeal arising therefrom. No settlement of a claim that involves a remedy other than the payment of money by the Indemnifying Party will be entered into without the consent of the Indemnified Party.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>10.&nbsp;&nbsp;&nbsp; WARRANTY DISCLAIMERS AND LIABILITY LIMITATIONS. <\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS OF THE SERVICES OR PIANO IP FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.&nbsp;&nbsp;<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt;\"><strong><span style=\"font-family: arial, helvetica, sans-serif;\">TO THE EXTENT BEYOND PIANO OR ITS LICENSORS\u2019 CONTROL, WHETHER THE FOLLOWING IMPACT PIANO OR ANY OF ITS THIRD-PARTY SERVICE PROVIDERS, INCLUDING WITHOUT LIMITATION AMAZON WEB SERVICES, GOOGLE, PAYPAL, OR ANY OTHER THIRD-PARTY SERVICE PROVIDER NAMED IN THE SCHEDULES ATTACHED HERETO, PIANO AND ITS LICENSORS SHALL NOT BE LIABLE TO CLIENT OR ANY THIRD PARTY FOR ANY TECHNICAL MALFUNCTION, TELECOMMUNICATION OR INTERNET OUTAGES OR PROBLEMS, COMPUTER ERROR, CORRUPTION, INEFFECTIVENESS, LOSS OF INFORMATION, LOSS OF BUSINESS, LOSS OF DATA, LOSS OF COMMERCIAL REPUTATION, LOSS OF PROFITS OR OTHER ECONOMIC LOSS. <\/span><\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>IN NO EVENT SHALL (A) EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, EVEN IF SUCH PARTY IS MADE AWARE OF THE POSSIBILITY OF SUCH DAMAGES, AND (B) NEITHER PARTY\u2019S AGGREGATE LIABILITY FOR DAMAGES UNDER THIS AGREEMENT SHALL EXCEED AN AMOUNT EQUAL TO THE TOTAL SUM OWED OR PAYABLE BY CLIENT TO PIANO DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE DATE ON WHICH THE LIABILITY AROSE.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>11.&nbsp;&nbsp;&nbsp; DATA SECURITY AND TECHNICAL MEASURES.&nbsp;<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) Piano will provide the Services in compliance with all Applicable Laws (including without limitation those regarding data privacy and security and consumer protection) and the GDPR.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) If Client or its third-party service provider processes any credit card information using the Software and Services, Client (and\/or such service provider, as applicable) shall: (i) comply with their responsibilities under the Payment Card Industry Data Security Standard (\u201cPCI DSS\u201d); (ii) implement and maintain reasonable security measures to protect all cardholder data in their possession or control; and (iii) not take any action in connection with using the Software and Services that places Piano in non-compliance with the PCI DSS (for example, storing any cardholder data in any custom fields of the Software and Services).<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>12.&nbsp;&nbsp;&nbsp; MISCELLANEOUS.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) <u>Notices<\/u>. Notices, demands, requests, consents, or other communications required or permitted under this Agreement or any Schedule will be in writing and deemed duly served on or delivered (i) when delivered personally, (ii) when sent to the other party by certified mail, return receipt requested, (iii) when delivered by hand or sent by recognized overnight courier (with acknowledgment received by the courier), or (iv) sent by email (provided that email shall not be sufficient for notices of Termination or Indemnification), if the receipt is confirmed by the recipient.&nbsp; Notices shall be delivered or sent to the parties at the respective addresses shown below or such other address as either party shall designate.&nbsp;<\/span><\/p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">TO PIANO:&nbsp;<br>Piano Software, Inc.<br>Attn: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Chief Financial Officer<br>Address:&nbsp; 111 S. Independence Mall E, Suite 950, Philadelphia, PA 19106<br>Email: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"mailto:cfo@piano.io\">cfo@piano.io<\/a><\/span><\/p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">WITH A COPY TO:&nbsp;<br>Piano Software, Inc.<br>Attn: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; General Counsel<br>Address:&nbsp; 111 S. Independence Mall E, Suite 950, Philadelphia, PA 19106<br>Email: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"mailto:legal@piano.io\">legal@piano.io<\/a><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">TO CLIENT:<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Notices to Client shall be addressed to the business contact designated by Client, and in the case of billing-related notices, to the relevant billing contact designated by Client.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Notices of termination or indemnification claims shall be addressed as follows: Address of registered seat of Client, Attn.: CEO.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) <u>Entire Agreement; Severability; Modification<\/u>. This Agreement, including any Schedules, is the entire agreement of the parties, and supersedes all prior agreements and communications between the parties with respect to the subject matter of this Agreement, and represents the complete integration of the parties\u2019 agreement.&nbsp; In interpreting and construing this Agreement, the fact that one or the other of Piano or Client may have drafted this Agreement or any provision hereof shall not be given any weight or relevance, both parties having had an opportunity to review and negotiate the terms hereof.&nbsp; If any provision of this Agreement shall be held invalid, illegal or unenforceable, the remaining provisions shall not be affected or impaired.&nbsp; This Agreement may be modified only by a written agreement executed by an authorized representative of the party against whom the modification is asserted.&nbsp;<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) <u>No Waiver<\/u>. The failure of a party in any one or more instances to exercise any right or privilege arising out of this Agreement shall not constitute a waiver and shall not preclude it from requiring that the other party fully perform its obligations or preclude it from exercising such a right or privilege at any time.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) <u>Independent Contractors<\/u>.&nbsp; Piano and the Client shall each act as independent contractors.&nbsp; Nothing in this Agreement shall be deemed to create or construed as creating a joint venture or other relationship between the parties. Neither party shall have the authority, express or implied, to commit or obligate the other party in any manner whatsoever, except as specifically authorized from time to time in writing by an authorized representative of the party.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) <u>Non-Exclusivity<\/u>. Piano and Client each acknowledge that this Agreement is non-exclusive and that each of them reserves the right to engage in business with other persons. Each party acknowledges and agrees that the other party may, without limitation, accept agreements from or grant licenses to other persons, firms, corporations, or other entities, including entities that compete with the other party, for Services and products, on any terms that party deems appropriate.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(f) <u>Assignment<\/u>. This Agreement shall not be assigned or transferred in whole or in part by either party without the prior written consent of the other, provided that either party may assign this Agreement without prior written consent in connection with a public offering of its securities or in a sale or transfer of all or substantially all of its assets or equity to which this Agreement relates or by way of merger, consolidation, or similar transaction. Any purported assignment or transfer in violation of this Section shall be void.&nbsp; Nothing in this Agreement shall be construed as permitting a trustee or purchaser in bankruptcy to assume this Agreement without the written consent of the other party.&nbsp; Subject to the foregoing restrictions, this Agreement will bind and benefit the parties and their successors and permitted assigns.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(g) <u>Force Majeure<\/u>. Neither party shall be responsible for delays or failures in performance of this Agreement resulting from a Force Majeure Event.&nbsp; Termination under this Section will not relieve Client of its obligation to pay for Services rendered prior to the date of the Force Majeure Event.&nbsp; Piano will make commercially reasonable efforts to re-establish Services as soon as possible in the event of a Force Majeure Event. If any Force Majeure Event prevents a party from performing its material obligations hereunder for more than thirty (30) consecutive days, the other party may elect to terminate this Agreement or any Schedule upon written notice, with no further obligation to the other party other than payment for accrued but unpaid fees for Services rendered prior to the date of such Force Majeure Event.&nbsp; \u201c<strong>Force Majeure Event<\/strong>\u201d means an event or circumstance which is beyond the control and without the fault or negligence of either party and which by the exercise of reasonable diligence neither party was able to prevent.&nbsp; Such events include, but are not limited to, (a) riot, war, invasion, act of foreign enemies, hostilities (whether war be declared or not) acts of terrorism, civil war, rebellion, revolution, insurrection of military or usurped power, requisition or compulsory acquisition by any governmental or competent authority; (b) ionizing radiation or contamination, radioactivity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel, radioactive toxic explosive or other hazardous properties of any explosive assembly or nuclear component; (c) earthquakes, flood, fire or other physical natural disaster, but excluding weather conditions regardless of severity; and (d) strikes at national level or industrial disputes at a national level.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(h) <u>Marketing<\/u>. Provided that at least three (3) clients are named, Piano shall have the right to use Client&#8217;s name and logo in customer lists and other marketing materials.&nbsp; Subject to Client&#8217;s approval, which shall not be unreasonably withheld, Piano shall also have the right to issue a press release, case study and\/or a testimonial, and develop marketing material related to any speaking engagements that the Client agrees to participate in on Piano\u2019s behalf at industry events (live events, webinars, or video).<\/span><\/p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">(i) Access to Client Websites. During the term of this Agreement or any Schedule, Piano staff shall have access to content on Client Websites. <\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(j) <u>Compliance with Policies<\/u>. Client will provide to Piano in advance, and Piano will use commercially reasonable efforts to ensure that its personnel or subcontractors comply with, Client\u2019s written security and other regulations in any activities at Client sites or in connection with Client\u2019s systems.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(k) <u>Counterparts<\/u>. This Agreement may be executed in several counterparts, each of which will be deemed to be an original, all of which, when taken together, shall constitute one and the same instrument. All signed facsimile or electronic (e.g. PDF document) copies of this Agreement shall be deemed valid as an original.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(l) <u>Non-Solicitation<\/u>. During the term of this Agreement and for twelve (12) months thereafter, neither party shall, directly or indirectly, on behalf of itself, a subsidiary, third-party or otherwise affiliated entity, knowingly hire or engage to hire any person who was an employee or sub-contractor of the other party at any time during the above-referenced period or knowingly solicit any such person to terminate or reduce the scope of their employment or business relationship with the other party. This clause does not prevent either party from employing any employee or sub-contractor of the other who responds to a published general advert not specifically targeted at such person.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(m) <u>Merchant of Record<\/u>: If applicable, Client shall act as the Merchant of Record for purposes of the Agreement and will comply with all applicable PCI and legal requirements.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(n) <u>Insurance<\/u>. Piano and Client will each maintain insurance protection covering each of their respective activities contemplated hereunder throughout the Term of the Agreement.&nbsp; Piano currently maintains the following insurance coverage, in addition to other coverage:&nbsp;<\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Commercial General Liability: $2,000,000 per claim, $4,000,000 aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Errors &#038; Omissions: $5,000,000 per claim and aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Cyber Liability: $5,000,000 aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Privacy Liability: $5,000,000 aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Privacy Breach Notification: $1,000,000 aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">System Damage: $3,000,000 aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">System Business Interruption: $5,000,000 per occurrence and aggregate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Multimedia\/Advertising Injury: $5,000,000 per claim and aggregate.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(o) <u>Disputes and Governing Law.<\/u> This Agreement will be governed and interpreted in accordance with the laws of the State of New York without reference to conflicts of laws principles. Disputes between the parties concerning this Agreement, or any amendment, Software Schedule, or SOW shall be resolved as follows:<\/span><\/p>\n<ol>\n<li>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The senior executives of Piano and Client shall have thirty (30) days in which to meet and attempt to resolve the dispute.<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">In the event that a business resolution cannot be reached, the parties agree to submit the dispute to formal mediation.<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">In the event that formal mediation fails to resolve the dispute, the parties agree to submit the dispute to binding arbitration, to be performed under the rules of the American Arbitration Association, where the venue for such arbitration shall be in New York, NY.<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Exclusive jurisdiction and venue for actions or disputes arising out of or relating to this Agreement, or any amendment, Software Schedule, or SOW, that require immediate injunctive relief shall be in the state or federal courts located in New York, NY, and the parties hereby consent to the exclusive jurisdiction and venue of such courts for matters involving immediate injunctive relief.<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">In the event that either party brings an action to enforce or exercise its rights under this Agreement, or any amendment, Software Schedule, or SOW, including binding arbitration, the prevailing party in such action (meaning a party in whose favor judgment is rendered, regardless of the amount of damages awarded or whether the party receives less relief than was sought or even nominal relief, but limited to those circumstances where the fact-finder declares a winner and the court enters judgment in that party\u2019s favor) shall be entitled to reimbursement for its reasonable attorneys\u2019 fees and expenses incurred in connection with such action.<\/span><\/p>\n<\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(p) <u>Cumulative Remedies.<\/u> Other than as expressly stated herein, the remedies provided herein are in addition to, and not exclusive of, any other remedies of a party under applicable laws.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>13.&nbsp;&nbsp;&nbsp; RULES OF INTERPRETATION.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(a) The term \u201cincluding\u201d (in all of its forms) means \u201cincluding, without limitations\u201d unless expressly stated otherwise.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(b) Any headings set forth in this Agreement are solely for convenience or reference and do not constitute a part of this Agreement, nor do they affect the meaning, construction or effect of this Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(c) All references to a number of days mean calendar days, unless expressly stated otherwise.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(d) The recitals and Schedules to this Agreement shall be deemed to be a part of this Agreement and are incorporated by reference herein.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(e) No documents exchanged or course of dealings by the parties shall be deemed to modify or amend any of the terms of this Agreement unless in writing and signed by an authorized representative of both parties.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">(f) In the event of an inconsistency, ambiguity, contradiction or conflict between the terms of this Agreement, its Schedules, and any amendments to any of the foregoing, such documents shall be interpreted in the following order of precedence:&nbsp; (i) the terms of any amendment to this Agreement shall take precedence, unless a Schedule expressly states that it overrides, (ii) followed by the terms of this Agreement, unless a Schedule expressly states that it overrides a specific provision of this Agreement, with reference to the provision of this Agreement that is to be overridden; (iii) followed by the terms of the Schedules to this Agreement.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>EXHIBIT A<br>Service Level Agreement<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano will use commercially reasonable efforts to furnish support as follows:<\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">As long as Client is current in payment of the fees set forth in any given Schedule, Piano will provide email support during the Term to Client for questions or problems with the use of the Services. The support will be available during the hours of 2:00 A.M. to 6:00 P.M. Eastern Standard Time on business days. After-hour emergency support is available (24\/7 for Severity 1 as defined below) via email and the severity level response set forth below still applies.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano will make the Services available each calendar quarter, excluding periods of Maintenance Downtime, Third-Party Downtime, and Force Majeure Events at an uptime of 99.7% (the &#8220;Uptime Guarantee&#8221;). If the Services fail to be available for the amount of time set forth in the Uptime Guarantee, then Piano will issue a credit (the \u201cCredit&#8221;) equal to 1% of the quarterly License Fee for each one-tenth of one percent decrease in availability in the affected quarter. The total Credit will be capped at 100% of the License Fee for the quarter in which service is so affected. If the parties have a performance-based or revenue sharing agreement in place, any consideration due Piano as a result of that agreement shall not be considered as License Fees for the purposes of computing the Credit.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client acknowledges and agrees that Piano may, from time to time, need to perform routine maintenance or repair of the Services or update the Software and that during such times of maintenance or repair (&#8220;Maintenance Downtime&#8221;), the Services may not be available for the Client&#8217;s use. Piano shall endeavor to inform Client of such maintenance at least two (2) business days in advance and will perform maintenance on weekends between the hours of 12:00 A.M. Eastern Standard Time on&nbsp;Saturday and 5:00 P.M. Eastern Standard Time on Sunday for no more than ninety (90) minutes per month.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client acknowledges that Piano relies on third parties, including but not limited to Amazon Web Services, Cloudflare, Google, Spreedly and several payment providers (a full list can be found at <a href=\"http:\/\/docs.piano.io\/payment-providers\">http:\/\/docs.piano.io\/payment-providers<\/a>), for providing its services. Client agrees that unavailability of third-party systems (&#8220;Third-Party Downtime&#8221;), (i) may affect the availability of the Software and\/or the Services, (ii) is beyond the control of Piano, (iii) will not be part of computations regarding the Uptime Guarantee, and (iv) will result in no refunds or credits to Client.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Problem Response<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Definition and Classification of Problems.<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">\u201cSeverity&#8221; is the assessed possible risk or effect of a problem with the Services. All notifications, escalations and standards for responding to problems are set by Severity.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">As used below, the term &#8220;Problem&#8221; shall mean any problem, inquiry or request. Problems shall be initially classified by Piano in accordance with the following Severity level classifications:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 1:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Services are causing the availability of the Client website or applications to be significantly affected;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">There is a complete outage of a critical service or a recurring temporary outage of a critical service;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">There is a security breach that exposes the personally identifiable information of Client customers; or<\/span><\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 2:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Due to a problem with the Services, users are not able to properly purchase access for, or gain access to, Client content;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Services administrative applications (e.g. reporting, authoring, etc.) are unavailable;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">There is an error, bug, or issue with the experience of a subset of Client customers (e.g. transactional emails are not being delivered properly \/ some but not all Client customers are viewing unintended media, content, or messages); or<\/span><\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 3:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client is experiencing operational inconvenience caused by the Services;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client needs or expects different functionality or presentation of information than Piano currently provides;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">An individual user has reported a problem that has not been evidenced to be prevalent among Client customers.<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Upon becoming aware of any Problem (whether by notification or self-discovery), Piano shall promptly verify the problem and, if necessary, open a Trouble Ticket for such Problem. Upon verification, Piano shall promptly respond to Client and advise Client of the severity level classification assigned to such Problem by Client.<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<table class=\" aligncenter\">\n<tbody>\n<tr>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Severity Level Classification<\/strong><\/span><\/td>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Problem Response Time<\/strong><\/span><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 1<\/span><\/td>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Within 2 hours<\/span><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 2<\/span><\/td>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Within 1 business day<\/span><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Severity 3<\/span><\/td>\n<td style=\"width: 284px;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Within 5 business days<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"6\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Problem Escalation and Resolution<\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">For Composer, VX, ID and ESP, Piano Support Team representatives are available to attend to Severity 1 and Severity 2 issues by email during Working Days\/Hours at: <a href=\"mailto:support@piano.io\">support@piano.io<\/a><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">If Client requires support during non-Working Day\/Hours they may use the following contact: <a href=\"mailto:support@piano.io\">support@piano.io<\/a><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">If Client requires escalation of a problem because:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Piano Support Team did not respond within the expected time; or<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Problem is not being handled properly; or<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Piano Support Team representative was communicating unprofessionally in any way, Client may use the Piano client services representative as escalation contact.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client should then expect a response within a maximum of two (2) hours.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">If Client experiences a Severity 1 disruption to its business which is believed to be related to the Piano platform, contact the on-call urgent response team by sending an email to <a href=\"mailto:urgent@piano.io\">urgent@piano.io<\/a>, and cc the client services representative.&nbsp; Include name and contact information and the Piano application ID for the affected property, along with any screen grabs or error message details describing the issue.&nbsp; The operational lead of the on-call urgent response team will get back to Client within 30 minutes of the initial outreach.&nbsp; If the issue has not already been resolved before that initial response, Client will receive periodic updates as they are available until the issue is resolved.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano recommends that Client subscribe to Piano\u2019s status page to receive real-time system updates and status at <a href=\"http:\/\/status.piano.io\">http:\/\/status.piano.io<\/a>.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">For support on all other products, visit: the support website at <a href=\"http:\/\/support.cxense.com.\" class=\"broken_link\">http:\/\/support.cxense.com.<\/a><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>EXHIBIT B&nbsp;<br>DATA PROCESSING AGREEMENT<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;<strong>WHEREAS: <\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Parties concluded the Agreement;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">By provision of the Services pursuant to the Agreement, Piano will process personal data about the Users on behalf of the Client;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">GDPR applies directly to the Client but also to Piano by virtue of having an establishment in the EU pursuant to the Article 3 of the GDPR;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Agreement and this DPA foresee and allow Piano to use Piano Affiliates and Sub-Processors for the processing of personal data about the Users in accordance with conditions laid down in this DPA;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Agreement and this DPA foresee and allow Piano to process personal data about the Users on a cross-border basis and\/or outside the European Economic Area in accordance with conditions laid down in this DPA;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Client shall only use data processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of GDPR while this DPA documents why the Client is satisfied with the guarantees provided by Piano;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Parties wish to explicitly agree on the scope and distribution of the obligations stemming from the GDPR mainly towards the Users as data subjects;<\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>THEREFORE, PARTIES AGREED AS FOLLOWS:<\/strong> <\/span><\/p>\n<ol>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong><u>Definitions<\/u><\/strong>. The terms used in this DPA shall be interpreted and construed in accordance with GDPR. Any terms defined in the Agreement shall have the same meaning if used in this DPA. As used in this DPA, the following terms shall have the following meanings:<br>\u201c<strong>Agreement<\/strong>\u201d means the Piano Master Services Agreement Terms and Conditions concluded between the Parties;<br>\u201c<strong>Clauses<\/strong>\u201d means standard contractual clauses approved by the Commission (Commission Decision C(2010)593) to safeguard the cross-border transfer of Personal Data between parties. The Clauses refer to the previous data protection regime under the Directive EU 95\/46\/EC;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Commission<\/strong>\u201d means the Commission of the EU;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Conditions<\/strong>\u201d means the following conditions: (i) Piano concludes a data processing agreement with Piano Affiliates and Sub-Processors ensuring that any processing of Personal Data is compliant with the terms and level of protection of Personal Data required under this DPA; (ii) the current list of all Piano Affiliates and Sub-Processors is made available and kept updated by Piano via <a href=\"https:\/\/piano.io\/gdpr\" class=\"broken_link\">https:\/\/piano.io\/gdpr<\/a> and Exhibit 1 to the DPA; (iii) the Personal Data will be only transferred to and processed only by Piano Affiliates and Sub-Processors located in the EEA, the United Kingdom (after the Brexit), the United States or third countries ensuring adequate level of protection according to the Commission\u2019s decision or where applicable according to the equivalent decision under the UK law (after the Brexit); (iv) in case Piano Affiliates or Sub-Processors are located in the United Kingdom (after the Brexit) or the United States, cross-border transfer is made by Piano on the basis of EU standard contractual clauses or Commission\u2019s adequacy decisions such as the EU-US Privacy Shield mechanism; (v) Client shall be entitled, upon written request, to receive copies of the relevant terms of internal Piano data processing agreement concluded between Piano and Piano Affiliates; (vi) Client may request that Piano audit Piano Affiliate or Sub-Processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Client in obtaining a third-party audit report concerning Piano Affiliate&#8217;s or Sub-Processor&#8217;s operations) to ensure compliance with such obligations, provided however that section 16.19 of this DPA applies <em>mutatis mutandis<\/em>; and (vii) Piano shall be liable for the acts and omissions of Piano Affiliates and its Sub-Processors to the same extent Piano would be liable if performing the services of each Piano Affiliate and Sub-Processor directly under the terms of this DPA, except as otherwise set forth in this DPA and\/or in Privacy and Data Protection Requirements;<br>\u201c<strong>Client Data<\/strong>\u201d means any and all data and information delivered by or on behalf of, or collected directly or indirectly from, Client, its affiliates, or their respective clients, customers and Users, including without limitation any such data or information collected via the Software and\/or Service, which may include, without limitation, Credit Card Data (as defined in Section 17 below), Non-Personal Data or the Personal Data. For clarity, all Personal Data is Client Data but not all Client Data is Personal Data (Non-Personal data are not Personal Data);<br>\u201c<strong>EEA<\/strong>\u201d means European Economic Area;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>EU<\/strong>\u201d means European Union;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>European Economic Area<\/strong>\u201d means all EU member states plus Iceland, Norway and Lichtenstein; <\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Non-Registered Users<\/strong>\u201d means non-registered users of Websites;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Piano Affiliates<\/strong>\u201d means companies which are controlled by Piano where control refers to possession, directly or indirectly, of the power to direct or cause the direction of the management of an entity whether through ownership, voting rights, by contract or otherwise, a list of which is published at <a href=\"https:\/\/piano.io\/gdpr\" class=\"broken_link\">https:\/\/piano.io\/gdpr<\/a> and Exhibit 1 to this DPA and regularly updated therein;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Privacy and Data Protection Requirements<\/strong>\u201d means the GDPR, ePrivacy Directive (2002\/58\/EC) and all applicable national laws and regulations relating to the processing of the personal data and privacy notified to Piano by Client;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Purposes<\/strong>\u201d means purposes of processing of Personal Data determined by Client while such purposes are derived from the functionality of the Software, in particular: (i) audience experiences, i.e. the core processing activities undertaken for Client (i.e. Services) such as analysis of subscription performance, user trends, preferences, and segmentation and other processing which typically occurs in the course of Client\u2019s use of the Software; (ii) billing and accounting purposes, i.e. service of processing payments and financial information in accordance with the applicable billing, accounting and tax laws; and (iii) other purpose of processing foreseen by the functionality of the Software; <\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Registered Users<\/strong>\u201d means registered users of Websites; <\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Security Regulations<\/strong>\u201d means reasonable security measures as requested by Client with respect to Piano\u2019s physical access to Client\u2019s facilities for performing Services and with respect to remote or virtual access, if applicable, to Client software, systems, data, information and materials;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Sub-Processors<\/strong>\u201d means sub-processors that Piano uses to process the Personal Data, a list of which is published at <a href=\"https:\/\/piano.io\/gdpr\" class=\"broken_link\">https:\/\/piano.io\/gdpr<\/a> and Exhibit 1 to this DPA and regularly updated therein;<\/span><br><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"> \u201c<strong>Users<\/strong>\u201d means collectively Registered Users and Non-Registered Users;<\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">As used herein, references to the \u201cServices\u201d shall mean the Software and\/or the Services.<\/span><\/p>\n<ol start=\"2\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Subject-Matter<\/u><\/strong>. Piano shall provide the Services in accordance with the provisions of this DPA. Piano is entrusted and entitled to process Client Data in accordance with the provisions of the Agreement including this DPA. Parties wish to make any processing of Client Data that is subject to the GDPR compliant with the GDPR. For clarity, this DPA does not relate to any processing of personal data by the Parties, but only to the processing of the Personal Data in respect to the Agreement.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Duration and Termination<\/u><\/strong>. This DPA forms an inseparable part of the Agreement. It is impossible to provide Services in accordance with the Agreement without processing Client Data pursuant to this DPA. Therefore, this DPA can only be terminated by termination of the Agreement as its inseparable part. Upon termination or expiration of the Agreement, Piano shall at the choice of the Client either return or securely delete all Client Data, unless there is a requirement to store such data under the EU or the EU member state law that applies to Piano or Piano Affiliates.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Nature of Personal Data Processing<\/u><\/strong>. The nature of Personal Data processing under this DPA is determined by the nature of Services provided by Piano and the functionality of the Software. The Software is designed to help digital content companies to drive page views, engagement, and registrations, decrease ad blocking, and sell or otherwise grant access to premium content. The nature of Personal Data processing by Piano is also determined by the fact that Piano does not have a direct relationship with data subjects and by Piano\u2019s Software as a Service business model that does not include data monetization techniques like brokerage of data or databases or selling of data to third parties.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Purpose of Personal Data Processing<\/u><\/strong>. As the Client\u2019s data processor, Piano is entitled to process the Personal Data for the Purposes. Piano will process Personal Data solely for the provision of the Services, and will not otherwise (i) process or use Personal Data for purposes other than those set forth in this DPA and\/or the Agreement or as instructed by Client, or (ii) disclose such Personal Data to third parties other than Piano Affiliates or Sub-Processors in accordance with Section 8 below or as required by law.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Types of Personal Data<\/u><\/strong>. Types of the Personal Data processed by Piano on the basis of this DPA include, as the case may be, name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, IP address, geographical location of the end-user device, offer conversion and\/or interaction data, referring site, or other information or other information relating to such natural person collected through the Service whether collected via cookies or other tracking technologies, the Service\u2019s functionality, or otherwise. Parties do not foresee processing of special categories of Personal Data pursuant to the Article 9 of the GDPR.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Categories of Data Subjects<\/u><\/strong>. The Personal Data processed by Piano will relate to Users of the Client\u2019s Websites and persons using the Software\/Services.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Sub-Processors &#038; Transfers<\/u><\/strong>. Through this DPA Client provides Piano with a specific documented instruction\/authorization to use Piano Affiliates and Sub-Processors for processing of Personal Data pursuant to the Conditions including to transfer personal data to them. Provided that the Conditions are met, Piano is authorized to use and change Piano Affiliates and Sub-Processors without additional instructions or approvals by the Client. Piano shall specifically notify to the Client any change of Piano Affiliates and\/or Sub-Processors where the Conditions would not be fulfilled and shall provide Client the opportunity to object to such changes. If Client does not respond within fifteen (15) days, Piano is authorized to undertake the change and transfer. At any time, Piano shall provide a current list of Piano Affiliates and\/or Sub-Processors upon request of Client.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>EU Standard Contractual Clauses<\/u><\/strong>. If applicable, the Parties hereby conclude the Clauses (attached as<u> Exhibit 2<\/u> hereto) and agree to update or replace such Clauses if and when such Clauses will be updated or replaced by new Clauses in line with the GDPR. The Parties agree to interpret such Clauses in line with the GDPR regime.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Documented Instructions<\/u><\/strong>. Piano shall process the Personal Data for the Purposes only in accordance with documented instructions from Client including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by the EU or the Member State law to which Piano is subject; in such a case, Piano shall inform Client of that legal requirement before processing, unless such law prohibits such information on important grounds of public interest. Certain general authorizations and documented specific instructions\/authorizations are already contained in this DPA, mainly in Section 8 above, which are hereby given by Client to Piano and which can only be altered if mutually agreed by the Parties. Any other general authorizations or documented specific instructions\/authorizations of Client must be given to Piano in accordance with Section 12(a) of the Agreement (Notices). Piano is obliged to inform Client if it believes that Client\u2019s instruction would infringe the GDPR. Piano shall not be liable for breaching any contractual obligations under the Agreement and\/or this DPA if such breach is caused by compliance with documented instruction of Client under this DPA. For the avoidance of doubt, Client\u2019s instructions for the processing of Personal Data shall comply with Privacy and Data Protection Requirements. Client shall have sole responsibility for the accuracy, quality and legality of Personal Data and the means by which Client acquired Personal Data.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Data Subject Rights<\/u><\/strong>. According to Article 28(3)(e) of the GDPR, Piano acting as a data processor shall insofar as this is possible and taking into account the nature of the processing, assist Client as a data controller, with the fulfillment of the controller\u2019s obligation to respond to requests for exercising the data subject\u2019s rights under the GDPR. Piano will comply with this obligation by providing supporting information available to it upon request of Client. Such supporting information may include an updated list of Sub-Processors, Piano Affiliates, recipients and respective third countries. Upon request from Client, Piano shall delete, release, correct, provide a copy of or block access to specific Personal Data or, if the foregoing is not practicable and only to the extent permitted by applicable law, follow Client\u2019s detailed written instructions to delete, release, correct or block access to Personal Data held in Client\u2019s Services environment. However, Piano is not entitled to handle or respond to the data subject request if it relates to the Purposes. Such requests should be handled and responded to by Client. Should Piano receive a data subject request that is of general nature and might be or is related to the Purposes, Piano will forward such request to Client without undue delay.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Transparent Information<\/u><\/strong>. Every data controller has a general obligation to provide certain information to data subjects mainly pursuant to the Article 13 or Article 14 of the GDPR. Client remains fully responsible for providing this information to data subjects via its own privacy policy. Client is entitled but not obliged to refer to or to use information from Piano\u2019s privacy policy and information about GDPR published and updated at <a href=\"https:\/\/piano.io\/privacy-policy\">https:\/\/piano.io\/privacy-policy<\/a> and <a href=\"https:\/\/piano.io\/gdpr\" class=\"broken_link\">https:\/\/piano.io\/gdpr<\/a>.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Legal Grounds for Processing of Personal Data<\/u><\/strong>. The legal grounds for processing Personal Data are determined solely by Client. Such legal grounds must always be compliant with the Article 6 of the GDPR. By concluding this DPA, the Client warrants and guarantees to Piano, that it has sufficient legal grounds for processing the Personal Data including a consent of data subject where required by the GDPR.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><u>Confidentiality<\/u><\/strong>. Piano shall implement such organizational measures that ensure that access to the Personal Data by Piano staff is limited to what is necessary to achieve the Purposes. Piano shall also implement such organizational measures that ensure all Piano staff are committed to the confidentiality in respect to the Personal Data. These obligations may be complied by adopting an appropriate internal policy at Piano group.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>General Client Data Obligations<\/strong>. Client shall own and retain all rights in and to the Client Data. All Client Data must be stored only on servers located in the EU unless otherwise expressly authorized in this DPA or by Client in writing. Piano may only use Client Data to the extent necessary to perform its obligations hereunder. In the course of providing the Services, Piano shall not access and shall not permit its personnel and\/or third-party service providers to access, Client Data except as necessary to perform the Services and only in accordance with the requirements of the Agreement and this DPA. Piano shall not be liable to Client for any damages incurred by Client in connection with any unauthorized access resulting from the actions of Client. Piano shall have the appropriate knowledge of Client\u2019s business to perform its duties under this DPA.<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Global Approach. Piano treats all Personal Data in a manner consistent with the requirements of this DPA in all locations globally. Piano&#8217;s information policies, standards and governance practices are managed on a global basis.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Security Piano will enforce physical and logical security procedures with respect to its access and maintenance of the Service and any Client Data contained therein. Piano will take appropriate organizational and technological measures to protect the security of the Client Data and defend its location and equipment against \u201chackers\u201d and any person or entity who may seek to modify or access Piano systems or the information found therein without authorization. Piano will also use its best commercial efforts to take all reasonable measures to secure and defend Client Data and use of the Service from other third-party users.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Monitoring &#038; Security Breaches. Piano will monitor its networks, connectivity and systems on a continual basis and will perform penetration testing on its systems for potential security breaches not less than once per year; Piano will meet with Client once per year to review the results of such security test(s). Piano will report to Client immediately, but no less than within 24 hours of becoming aware of, any breaches of security or unauthorized access affecting Client Data that Piano detects or becomes aware of. Piano will remedy such breach of security or unauthorized access as soon as possible and deliver to Client a root cause assessment and future incident mitigation plan. Client or its third-party designee may, but is not obligated to, at Client\u2019s expense, perform audits of Piano\u2019s environment during the Term, including coordinated penetration and security tests, as it relates to the receipt, maintenance, use or retention of personally identifiable information or other Client Data. Piano is entitled to claim remuneration for the Client\u2019s audits or inspections. Such audits shall be conducted in accordance with Section 16.19 below. Subject to the foregoing, any of Client\u2019s regulators shall have the same right upon request. Piano agrees to consider all reasonable recommendations that result from such inspections, tests, and audits within reasonable timeframes and will inform Client of its plans and timeline for addressing and\/or implementing any such recommendations.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">If at any time Client or Piano determines that any Piano Personnel: (i) has sought to circumvent or has circumvented the Security Regulations; (ii) has accessed or may access the Client Network without authorization; or (iii) has engaged in activities that may lead to the unauthorized access, destruction, alteration, or loss of data, information or software, Piano will immediately terminate any such Piano Personnel\u2019s access and will immediately, in any event within 24 hours of becoming aware of such breach, notify Client of the events warranting such termination. If Client reasonably determines that any Piano Personnel has attempted to circumvent or has circumvented the Security Regulations, Client may immediately terminate such Piano Personnel\u2019s access to the Client Network and will advise Piano of such termination. Notwithstanding anything to the contrary in this DPA, any failure by Piano, any Piano Personnel or other agents or representatives to comply with the Security Regulations will constitute a breach of this DPA entitling Client to terminate the Agreement immediately upon written notice to Piano for cause. At any time during the Term, Client may audit Piano\u2019s use of the Client Network. Piano agrees that Client may review any information, electronic mail communications, and other data stored on or contained in any computer hard drive, disk, or any other storage medium to determine whether there has been any breach of security or violation of this DPA. In the event that Client concludes, in its reasonable judgment, that there has been any breach of security or violation of this DPA by Piano or any Piano Personnel, agent or representative, Client reserves the right to disclose any computer files or electronic mail messages to third parties, including (but not limited to) law enforcement officials, as Client deems appropriate, without any prior notice to any individuals who may have written, sent or received such files or messages.<\/span><\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Appropriate Security Measures<\/strong>. Piano acknowledges and agrees that from time to time during the term of this DPA, Piano, Piano Affiliates, its employees, agents and Sub-Processors or assigns may be exposed to or have access to Client Data, some of which may be Personal Data. Piano will process or disclose Personal Data only for the Purposes, or other purposes of processing required by a court of competent jurisdiction or by any competent national or EU governmental authority. Piano acknowledges that due to certain mandatory data protection laws, the processing of Personal Data is subject to certain legal requirements. Piano shall assist Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of processing and the information available to Piano. To the extent applicable to the Services and related activities of Piano, Piano shall comply with all provisions of any applicable privacy policies, including Client\u2019s applicable privacy policy, if reasonably required by the Client and provided in advance to Piano. Piano will not view, de-encrypt, or otherwise access Personal Data unless such access is necessary for the performance of Piano\u2019s obligations under this DPA. Piano will maintain, implement and enforce safety and security procedures in performing the Services that are: (a) equal to or better than industry standards for such Services and networks (if any), but in any case, in accordance with a reasonable standard of care; (b) are compliant with the requirements of the Privacy and Data Protection Requirements; and (c) compliant with the security requirements set forth in this Section Such measures shall include, by way of example and not limitation, firewalls, intrusion detection systems, locking file cabinets, and other appropriate physical and electronic security mechanisms, including current revisions of all software releases and all software patches. Piano shall have adequate security audits in place, and Piano shall submit evidence of passing an annual security audit in conformance with industry standard security standards acceptable to Client, in Client\u2019s sole discretion. Upon request, Piano will complete Client\u2019s Security Assessment Questionnaire. Piano shall comply with an implemented written information security program (\u201cInformation Security Program\u201d) that includes administrative, technical, and physical safeguards that ensure the confidentiality, integrity, and availability of Personal Data, protect against any reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of the Personal Data, and protect against unauthorized access, use, disclosure, alteration, or destruction of the Personal Data. In addition to any specific and or supplemental security safeguards established in any agreement between the parties, Piano\u2019s Information Security Program shall include, but not be limited to, the following safeguards where appropriate or necessary to ensure the protection of Personal Data:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Where appropriate Piano shall implement security measures comprising of pseudonymization of the Personal Data.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Access Controls. Policies, procedures, and physical and technical controls: (i) to limit physical access to its information systems and the facility or facilities in which they are housed to properly authorized persons, including, but not limited to; limiting access to physical servers at the production data center to authorized individuals, logging and monitoring of unauthorized access attempts to the data center by the data center security personnel, controlling ingress\/egress to the facility using control access points (e.g. guards and electronic badge reader), and maintaining physical access to logs for entry\/exit points; (ii) to ensure that all members of its workforce who require access to Personal Data have appropriately controlled access, and to prevent all other workforce members and others who should not have access from obtaining access; (iii) to authenticate and permit access only to authorized individuals and to prevent members of its workforce from providing Personal Data or information relating thereto to unauthorized individuals; and (iv) to encrypt and decrypt Personal Data where<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Security Awareness and Training. A security awareness and training program for all members of Piano\u2019s workforce (including management), which includes training on how to implement and comply with its Information Security Program and the Privacy and Data Protection<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Security Incident Policies and procedures to detect, respond to, and otherwise address security incidents, which shall mean, but not be limited to, unauthorized access, acquisition, disclosure or use of Personal Data (\u201cSecurity Incident\u201d), including procedures to monitor systems and to detect actual and attempted attacks on or intrusions into Personal Data or information systems relating thereto, and procedures to identify and respond to suspected or known Security Incidents, mitigate harmful effects of Security Incidents, and document Security Incidents and their outcomes.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Contingency Policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Personal Data or systems that contain Personal Data, including a data backup plan and a disaster recovery plan.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Device and Media Controls. Policies and procedures that govern the receipt and removal of hardware and electronic media that contain Personal Data into and out of a Piano facility, and the movement of these items within a Piano facility, including policies and procedures to address the final disposition of Personal Data, and\/or the hardware or electronic media on which it is stored, and procedures for removal of Personal Data from electronic media before the media are made available for re-use.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Audit Controls\/Logging. Hardware, software, and\/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and applicable laws and regulations and compliance<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Data Policies and procedures to ensure the confidentiality, integrity, and availability of Personal Data and protect it from disclosure, improper alteration, or destruction.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Storage and Transmission All Personal Data that is stored or transmitted has to be encrypted. Stored Personal Data will be encrypted with then current industry standards, such as, if applicable, AES-128 or better, or Triple-DES (3-DES) or better. All Personal Data in transmission will be protected by at least industry standard encryption such as SSLv3\/TLS.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Secure Disposal. Policies and procedures regarding the disposal of Personal Data, and tangible property containing Personal Data, taking into account available technology so that Personal Data cannot be practicably read or<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Assigned Security Piano shall designate a security official responsible for the development, implementation, and maintenance of its Information Security Program. Piano shall inform Client as to the person responsible for security.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano shall regularly and no less than one time per year test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Program Adjustment. Piano shall monitor, evaluate, and adjust, as appropriate, the Information Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Personal Data, internal or external threats to Piano or the Personal Data, requirements of applicable work orders, and Piano\u2019s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Environmental Establish and maintain environmental controls to detect, prevent and control disruption and\/or destruction to information systems containing or storing Personal Data as a result of environmental extremes.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Security Patch Management. Maintain system upgrades, patches and configurations with at least industry standard and commercially reasonable frequency<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano shall regularly and no less than one time per year test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified, including but not limited to vulnerability scans and penetration testing. Penetration tests should be conducted or reviewed by independent third parties or staff.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Application Security Testing. Utilize at least industry standard testing and security assessments (e.g. Veracode)<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Consultant\/Vendor Background Checks. Implement and maintain verifiable and at least industry standard processes (based on, among other factors, the circumstances and level of access) for performing background checks on personnel with access to Client Personal Data. Upon reasonable request from Client, Client may request more specific requirements for such background<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Client may, at its own cost, request, upon within (3) weeks written notice to Piano, access to facilities, systems, records and supporting documentation in order to audit Piano\u2019s compliance with its obligations under or related to the Information Security Program. Client may audit Piano\u2019s compliance with the terms of this DPA and Privacy and Data Protection Requirements not more than once per year. Client may perform more frequent audits of the Service computer systems that process Personal Data to the extent required by laws applicable to Client. If a third party is to conduct the audit, the third party must be mutually agreed to by Client and Piano and must execute a confidentiality agreement acceptable to Piano before conducting the audit. As part of the audit request, Client shall submit a detailed audit plan at least three (3) weeks in advance of the proposed audit date to Piano describing the proposed scope, duration, and start date of the audit.&nbsp; Piano will review the audit plan and provide Client with any concerns or questions (for example, any request for information that could compromise Piano security, privacy, employment or other relevant policies).&nbsp; Piano will cooperate with Client in good faith to agree on a final audit plan. Audits shall be subject to all applicable confidentiality obligations agreed to by Client and Piano and shall be conducted in a manner that minimizes any disruption of Piano\u2019s performance of services and other normal operations, i.e. outside regular business hours. Such audits may at Client&#8217;s option and request, include penetration and security tests, of any and all Piano systems and their housing facilities and operating environments. Client may use the audit reports only for the purposes of meeting its regulatory audit requirements and\/or confirming compliance with the requirements of this DPA and\/or Privacy and Data Protection Requirements.&nbsp; The audit reports are Confidential Information of the Parties under the terms of the Agreement. Should the audit reveal confidential information or intellectual property of a third party, any audit must be done in compliance with such <sup>t<\/sup>hird party\u2019s applicable confidentiality or license terms.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Parties will notify each other without undue delay about any potential or actual regulatory or court action or request in respect to the Personal Data processed in connection with this DPA. Piano will notify Client and obtain Client\u2019s consent before sharing any Personal Data with any government authorities unless sharing of such Personal Data is required by applicable law.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">When and as required by Client from time to time, Piano shall execute and\/or shall cause its Piano Affiliates to execute supplemental privacy and security terms, with Client or Client\u2019s affiliates that receive Services under the Agreement as required in Client\u2019s sole judgment for the processing and\/or transfer of Personal Data in accordance with applicable law. At the time of the signing of this DPA the application of the ePrivacy Regulation has not been fully set out by either European authorities or the local supervisory authority of Client. Consequently, the Parties agree to amend this DPA where necessary to ensure the Services compliance with the ePrivacy Regulation.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">If any country outside of the EU where Services are to be rendered under the Agreement has or enacts a data protection-related law that Client concludes, in its sole judgment, requires the execution of any supplemental privacy and security terms, then Piano shall execute and\/or cause any Piano Affiliates to execute such supplemental terms promptly with Client and\/or Client\u2019s affiliates, subject to the same terms and conditions as set forth above; provided, however, that the parties shall make reasonable efforts to leverage existing supplemental privacy and security terms that have been executed with respect to the EU data protection-related law to fulfill any such requirement, so as to minimize the cost and effort involved in achieving compliance with such<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Notwithstanding any provisions in the Agreement to the contrary, in the event that any Party becomes aware of any personal data breach pursuant to the Article 4(12) of the GDPR (e.g. breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed) (the \u201c<strong>Personal Data Breach<\/strong>\u201d) that might have impact on the other Party\u2019s obligations under the Article 32 and 33 of the GDPR, each Party shall notify the other Party immediately of any such Personal Data Breach (i.e., within 24 hours). Parties will then co-operate to evaluate the potential risk to rights and freedoms of natural persons stemming from such Personal Data Breach, mitigate such risk and will agree on notification or communication of the Personal Data Breach pursuant to the Article 32 and 33 of the GDPR.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano shall ensure procedures are put in place to ensure that Personal Data is portable, in a machine-readable format, and that Piano will be in a position to provide Client with any Personal Data within three working In addition, Piano shall be in a position to delete all of the Client Data, if requested by Client.<\/span><\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Payment Card Industry Data Security Standard (PCI DSS)<\/strong>. If and to the extent Piano will have access to any Credit Card Data, then this paragraph shall apply. For purposes, hereof, (a) \u201c<strong>PCI DSS<\/strong>\u201d means the Payment Card Industry Data Security Standard; and (b) \u201c<strong>Credit Card Data<\/strong>\u201d means any and all data designated as \u201cCardholder Data\u201d or \u201cSensitive Authentication Data\u201d in PCI DSS. Piano shall comply with industry standards and practices, including without limitation, PCI DSS. If and when applicable, Piano shall only use Cardholder Data only for assisting in completing a card transaction, for fraud control services, or as specifically agreed to by Visa, MasterCard, American Express, and\/or Discover (collectively, the \u201c<strong>Issuers<\/strong>\u201d), or as required by applicable In the event of unauthorized use, modification, destruction or disclosure of, or access to, Cardholder Data (any of the foregoing events or circumstances, a \u201c<strong>Security Incident<\/strong>\u201d) stored by or for Piano (or otherwise within Piano\u2019s control), Piano shall immediately notify Client and provide Client or its designee, the Issuers, and the acquiring financial institution and their respective designees access to Piano\u2019s facilities and all pertinent records to conduct a review of Piano\u2019s compliance with these requirements. Piano shall maintain appropriate business continuity procedures and systems to ensure security of Cardholder Data in event of a disruption, disaster or failure of Piano\u2019s primary data systems which involve a risk to Cardholder Data. Piano shall provide access to its security systems and procedures, as reasonably requested by Client or its designee. Piano shall cooperate fully with any reviews of its facilities and records provided for in this paragraph. Piano is and will continue to be, in compliance with the PCI DSS security standards as they may be amended from time to time. Piano is responsible for the security of all data obtained, stored, viewed, or accessed in connection with this DPA whether provided by Client or its customers, Piano will maintain records that demonstrate its PCI compliance and provide them to Client upon request. Piano will immediately contact Client if a security breach or serious threat arises that relates to Client Data and will fully cooperate with Client in investigating and prosecuting any security breaches.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Disaster Recovery<\/strong>. The parties agree that Piano has previously supplied Client with a copy of its written disaster and recover plan (the \u201cDisaster Avoidance and Recovery Plan\u201d) and that Piano has implemented and is maintaining such Plan. <strong>Piano\u2019s Disaster Avoidance and Recovery Plan<\/strong> shall be actively reviewed on a quarterly basis and updated during the Term using American Institute of Certified Public Accountants standards as guidance. Piano shall notify Client of the completion of any such audit and make the audit available to Client or its designee for review. Piano\u2019s Disaster Avoidance and Recovery Plan shall contain procedures designed to safeguard Client\u2019s data and the availability of the Telemarketing Services, throughout the Term. Such Disaster Avoidance and Recovery Plan shall include, without limitation, the following:<\/span>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Fire Protection. Piano represents that the fire protection system at the Piano site(s) consists of the appropriate type and quality of equipment required to provide effective fire protection and that it is regularly reviewed and updated, and that the system currently consists of smoke detectors (with remote enunciators and zone indicators), automatic sprinkler systems, and a two-part halon system in any computer areas. Piano further represents that each room at the Piano site(s) has its own supply of halon and all Piano Service Location(s) computer rooms have a second halon system to provide backup. Piano represents that water detection devices and drains are installed under all raised floor<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Power Piano shall maintain multiple levels of power backup designed to provide uninterrupted operation of the Piano equipment in the event of a loss of power. Piano shall maintain multiple feeds to the Piano site(s) from different processing stations of the local power company which furnishes the main power to the Piano site(s). Piano shall maintain two (2) levels of uninterrupted power systems to provide smooth transition to the use of Piano\u2019s alternative energy sources (e.g., diesel generators) in the event of an extended power company outage.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Equipment\/Air Conditioning. Piano shall maintain multiple levels of protection against loss of cooling, including a primary backup system which shall provide adequate backup cooling capacity, and a secondary backup system, which shall be capable of providing continuous cooling during a power outage so as to maintain equipment at all times within the tolerances specified by the appropriate<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Computer Equipment. Piano agrees that the Piano site(s) shall maintain the appropriate backup equipment that is capable of maintaining operations in the event of hardware failures at the Piano site(s). In addition, Piano agrees that it will maintain at the Piano site(s) detailed, written recovery procedures which its personnel are familiar with and which enable Piano personnel to switch to backup hardware<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Hardware and Software Changes. Piano shall maintain a strict change control process, which Piano personnel are familiar with, and which is used for both hardware and software<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Piano agrees that its disaster recovery testing will be performed at the Piano site(s) twice per year. The testing shall include, but not be limited to, testing of hardware, installation and operation of all Systems, processing of data and generation of reports, and testing of telecommunications facilities.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Recovery Procedures. Piano shall maintain appropriate recovery procedures and automated recovery tools for a call center operations<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Off-Site Data Vaulting. Piano shall store daily a current copy of data and system files on magnetic media in damage resistant, fire proof vaults at an off-site facility. The off-site facility shall be guarded twenty-four (24) hours a day, seven (7) days a week. Piano shall also maintain a tape management system, manual or otherwise, which controls the daily process of vaulting files.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Operations In the event of any unplanned or unscheduled interruptions of the operations of, or accessibility to, the Piano site(s), Piano shall use its commercially reasonable best efforts to restore service to Client as expeditiously as possible. Piano shall notify Client at least ten (10) minutes prior to any unscheduled interruptions. Piano shall notify Client at least within two (2) minutes of occurrence of any unplanned interruptions.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Time Frames for Recovery. The time frames for restoration of Client\u2019s service will vary according to the nature and magnitude of the disaster event, the availability of replacement equipment for drop-shipment and the speed with which alternate telecommunication circuits can be made available. Piano shall use commercially reasonable best efforts to work with telecommunications carriers and equipment vendors to restore service as expeditiously as<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Maintenance of Safeguards. In addition to those requirements specifically set forth in this DPA, Piano agrees that it shall maintain safeguards throughout the Term against destruction, loss, or alteration of Client\u2019s data, which are no less rigorous than those in effect at other similar Vendor site(s) as of the Effective Date of this<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<ol start=\"19\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Data Protection Impact Assessment<\/strong>. Each Party remains solely responsible for conducting the data protection impact assessment pursuant to the Article 35 of the GDPR and prior consultation pursuant to the Article 36 of the GDPR with respect to the Purposes. Nevertheless, if any Party conducts such data protection impact assessment which relates to this DPA, the other Party agrees to reasonably assist such Party by providing reasonable assistance or information. In good faith, Piano may provide Client with its own data protection impact assessment with respect to the Purposes on the basis of the available information prior to concluding this DPA in order to help the Client to make its own data protection impact assessment.&nbsp;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Acceptable Use<\/strong>. Piano shall have an Acceptable Use Policy acceptable to Client. Among other things, such policy shall prohibit use by Piano employees and agents of non-business applications that could affect network and\/or tool performance and shall mandate that under no circumstances shall any peer to peer applications\/use be permitted on the Piano\u2019s Acceptable Use Policies are subject to review and approval by Client. The Acceptable Use Policy shall have adequate, reasonable and at least industry standard access controls.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Liability<\/strong>. Pursuant to the Article 82 of the GDPR, Piano shall be liable for the damage caused by processing only where it has not complied with obligations of GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Client. Piano shall be exempt from liability if Piano proves that it is not in any way responsible for the event giving rise to the damage.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Brexit<\/strong><a href=\"#_ftn1\" name=\"_ftnref1\" class=\"broken_link\"><\/a>. Any reference to GDPR shall be interpreted as a reference to the UK law that is equivalent to the GDPR or that implements the GDPR not affecting validity and effectiveness of this DPA. The Parties wish to interpret this DPA in line with applicable UK legislation after the UK ceases to be a member of the EU. Client is obliged to inform Piano about any requirements stemming from the UK law beyond the requirements stemming from the GDPR.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Service Analysis<\/strong>. As part of the Services and foreseen processing of Personal Data, Piano may (i) compile statistical and other information related to the performance, operation and use of the Services, and (ii) use Client Data from the Services environment in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (clauses (i) and (ii) are collectively referred to as \u201cService Analyses\u201d). Piano may make Service Analyses publicly available; however, the resulting Service Analyses will not incorporate Client Data or Confidential Information in a form that could identify or serve to identify Client or any data subject. Piano shall retain all intellectual property rights in said Service Analyses as its own confidential information.&nbsp;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Data Protection Officer<\/strong>. Piano has appointed Stuart Ashford (<a href=\"mailto:privacy@piano.io\">privacy@piano.io<\/a>) as its Data Protection Officer.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>EXHIBIT 1<br>Piano Software Norway&nbsp;Affiliates and Subprocessors<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Enreach Solutions Oy, Aleksanterinkatu 17, 00100 Helsinki, Finland (data segmentation provider), adequacy;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">SoftLayer Technologies, Inc., 14001 Dallas Pkwy, Suite M100, Dallas TX 75240 (data center owner), adequacy;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data center owner), adequacy;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Google Ireland, Ltd., Gordon House, Barrow St, Dublin 4, Ireland (data backup storage), adequacy;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Packet Host, Inc., 30 Vesey St, Floor 9, New York, NY 10007 (data center owner), adequacy;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Maxifier Development, Novo-Sadovaya, 349a, 443125 Samara, Russia (software development team and data center operations team), Model Clauses on behalf of Client;<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Creative Software, #29 Deal Place, Colombo 03, Sri Lanka (global technical support team), Model Clauses on behalf of Client.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>EXHIBIT 2&nbsp;<br>Standard Contractual Clauses <\/strong><\/span><\/p>\n<table width=\"672\">\n<tbody>\n<tr>\n<td width=\"159\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong><img loading=\"lazy\" class=\"alignnone size-medium wp-image-9421\" src=\"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png\" alt=\"\" width=\"300\" height=\"208\" srcset=\"https:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png 300w, https:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-768x532.png 768w, https:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-1024x710.png 1024w, https:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_.png 1200w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/>&nbsp;<\/strong><\/span><\/td>\n<td width=\"513\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">EUROPEAN COMMISSION<br>DIRECTORATE-GENERAL JUSTICE&nbsp;<br>Directorate C: Fundamental rights and Union citizenship<br><strong>Unit C.3: Data protection&nbsp;<\/strong><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Commission Decision C(2010)593<br>Standard Contractual Clauses (processors)<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">For the purposes of Article 26(2) of Directive 95\/46\/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection&nbsp;<\/span><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">each a \u201cparty\u201d; together \u201cthe parties\u201d, HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><em>&nbsp;<\/em><\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 1<br><\/strong><strong>Definitions<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">For the purposes of the Clauses:<\/span><\/p>\n<ol style=\"list-style-type: lower-alpha;\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><em>&nbsp; &nbsp;&#8216;personal data&#8217;, &#8216;special categories of data&#8217;, &#8216;process\/processing&#8217;, &#8216;controller&#8217;, &#8216;processor&#8217;, &#8216;data subject&#8217; <\/em>and <em>&#8216;supervisory authority&#8217;<\/em> shall have the same meaning as in Directive 95\/46\/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data<a href=\"#_ftn2\" name=\"_ftnref2\" class=\"broken_link\">[2]<\/a>;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><em>&nbsp; &nbsp;<\/em>&#8216;<em>the data exporter&#8217;<\/em> means the controller who transfers the personal data;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><em>&nbsp; &nbsp;&#8216;the data importer&#8217;<\/em> means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country&#8217;s system ensuring adequate protection within the meaning of Article 25(1) of Directive&nbsp;95\/46\/EC;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><em>&nbsp; &nbsp;&#8216;the subprocessor&#8217;<\/em> means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;&#8216;<em>the applicable data protection law&#8217;<\/em> means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><em>&nbsp; &nbsp;&#8216;technical and organisational security measures&#8217;<\/em> means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.<\/span><\/li>\n<\/ol>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 2<br>Details of the transfer<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 3<br>Third-party beneficiary clause<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.<\/span><\/li>\n<\/ol>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 4<br><\/strong><strong>Obligations of the data exporter<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data exporter agrees and warrants:<\/span><\/p>\n<ol style=\"list-style-type: lower-alpha;\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp; that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter&#8217;s behalf and in accordance with the applicable data protection law and the Clauses;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it will ensure compliance with the security measures;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95\/46\/EC;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it will ensure compliance with Clause 4(a) to (i).<\/span><\/li>\n<\/ol>\n<hr>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><a href=\"#_ftnref2\" name=\"_ftn2\" class=\"broken_link\">[2]<\/a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <em>Parties may reproduce definitions and meanings contained in Directive 95\/46\/EC within this Clause if they considered it better for the contract to stand alone.<\/em><\/span><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 5<br><\/strong><strong>Obligations of the data importer<a href=\"#_ftn3\" name=\"_ftnref3\" class=\"broken_link\">[3]<\/a><\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data importer agrees and warrants:<\/span><\/p>\n<ol style=\"list-style-type: lower-alpha;\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and\/or terminate the contract;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and\/or terminate the contract;&nbsp;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it has implemented the technical and organizational security measures specified in Appendix 2 before processing the personal data transferred;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that it will promptly notify the data exporter about:<\/span>\n<ol style=\"list-style-type: lower-alpha;\">\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;any accidental or unauthorized access, and<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;<\/span><\/li>\n<\/ol>\n<\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;that the processing services by the subprocessor will be carried out in accordance with Clause 11;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.<\/span><\/li>\n<\/ol>\n<hr>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><a href=\"#_ftnref3\" name=\"_ftn3\" class=\"broken_link\">[3]<\/a>&nbsp;&nbsp;&nbsp;&nbsp; <em>Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of <\/em><em>one <\/em><em>of the interests listed in Article&nbsp;13(1) of Directive 95\/46\/EC, that is, if they constitute a necessary measure to safeguard national security, defense, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognized sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.<\/em><\/span><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Clause 6<br>Liability<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.<br>The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.<\/span><\/li>\n<\/ol>\n<ol start=\"3\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.<\/span><\/li>\n<\/ol>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 7<br>Mediation and jurisdiction<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data importer agrees that if the data subject invokes against it third-party beneficiary rights and\/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:<\/span>\n<ol>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;<\/span><\/li>\n<li><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\">&nbsp; &nbsp;to refer the dispute to the courts in the Member State in which the data exporter is established.<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<ol start=\"2\">\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.<\/span><\/li>\n<\/ol>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 8<br><\/strong><strong>Cooperation with supervisory authorities<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).<\/span><\/li>\n<\/ol>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 9<br><\/strong><strong>Governing Law<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Clauses shall be governed by the law of the Member State in which the data exporter is established.<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 10<br><\/strong><strong>Variation of the contract<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 11<br><\/strong><strong>Subprocessing<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses<a href=\"#_ftn4\" name=\"_ftnref4\" class=\"broken_link\">[4]<\/a>. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor&#8217;s obligations under such agreement.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter&#8217;s data protection supervisory authority.<\/span><\/li>\n<\/ol>\n<hr>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><a href=\"#_ftnref4\" name=\"_ftn4\" class=\"broken_link\">[4]<\/a>&nbsp;&nbsp;&nbsp;&nbsp; <em>This requirement may be satisfied by the subprocessor co-signing the contract entered into between the data exporter and the data importer under this Decision.<\/em><\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-family: arial, helvetica, sans-serif; font-size: 10pt;\"><strong>Clause 12<br><\/strong><strong>Obligation after the termination of personal data processing services<\/strong><\/span><\/p>\n<ol>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.<\/span><\/li>\n<li><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp; &nbsp;The data importer and the subprocessor warrant that upon request of the data exporter and\/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Appendix 1 to the Standard Contractual Clauses<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">This Appendix forms part of the Clauses and must be completed and signed by the parties.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;<strong>Data exporter<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data exporter is (please specify briefly your activities relevant to the transfer):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Operator of Websites which chose to use the Data importer to assist in providing certain web audience measuring services that necessarily involves processing of personal data.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Data importer<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The data importer is (please specify briefly activities relevant to the transfer):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Provider of certain web audience measuring services to the Data exporter that necessarily involves processing of personal data.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Data subjects<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The personal data transferred concern the following categories of data subjects (please specify):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Mainly Users of the Client\u2019s Websites, as is explained in more detail in the above Data Processing Agreement concluded between the Parties.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Categories of data<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The personal data transferred concern the following categories of data (please specify):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, offer conversion and\/or interaction data, referring site, or other information or other information relating to such natural person collected through the Service whether collected via cookies or other tracking technologies, the Service\u2019s functionality, or otherwise<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Special categories of data (if appropriate)<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The personal data transferred concern the following special categories of data (please specify):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">No special categories of personal data are transferred to the best of the knowledge of both Parties.<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">&nbsp;&nbsp;<strong>Processing operations<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">The personal data transferred will be subject to the following basic processing activities (please specify):<\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, cross-border transfer, erasure or destruction.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\"><strong>Appendix 2 to the Standard Contractual Clauses<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">This Appendix forms part of the Clauses and must be completed and signed by the parties.<br><strong>Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document\/legislation attached):<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt; font-family: arial, helvetica, sans-serif;\">These technical and organisational measures are described in detail in the above Data Processing Agreement concluded between the Parties.<\/span><\/p>\n<p><span style=\"font-size: 8pt;\"><em><span style=\"font-family: arial, helvetica, sans-serif;\">Last updated: December 29, 2020<\/span><\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>DEFINITIONS \u201cAffiliate\u201d means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. \u201cControl\u201d, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. \u201cClient Data\u201d means all electronic data or information [&hellip;]<\/p>\n","protected":false},"author":60,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"generic-template-page.php","meta":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v19.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023) &bull; Piano<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023)\" \/>\n<meta property=\"og:description\" content=\"DEFINITIONS \u201cAffiliate\u201d means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. \u201cControl\u201d, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. \u201cClient Data\u201d means all electronic data or information [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/\" \/>\n<meta property=\"og:site_name\" content=\"Piano\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/piano.io\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-02T09:17:50+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png\" \/>\n<meta name=\"author\" content=\"barbara.kees\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@piano_io\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"87 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.cxense.com\/#organization\",\"name\":\"Piano Software, Inc.\",\"url\":\"https:\/\/www.cxense.com\/\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/piano-io\/\",\"https:\/\/www.facebook.com\/piano.io\",\"https:\/\/twitter.com\/piano_io\"],\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es-es\",\"@id\":\"https:\/\/www.cxense.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/piano.io\/wp-content\/uploads\/2022\/07\/Piano_Logo.jpeg\",\"contentUrl\":\"https:\/\/piano.io\/wp-content\/uploads\/2022\/07\/Piano_Logo.jpeg\",\"width\":1111,\"height\":400,\"caption\":\"Piano Software, Inc.\"},\"image\":{\"@id\":\"https:\/\/www.cxense.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cxense.com\/#website\",\"url\":\"https:\/\/www.cxense.com\/\",\"name\":\"Piano\",\"description\":\"Analytics + Activation\",\"publisher\":{\"@id\":\"https:\/\/www.cxense.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.cxense.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"es-es\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"es-es\",\"@id\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#primaryimage\",\"url\":\"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png\",\"contentUrl\":\"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#webpage\",\"url\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/\",\"name\":\"[:en]PIANO MASTER SERVICES AGREEMENT TERMS AND CONDITIONS (Archive January 2023)[:] &bull; Piano\",\"isPartOf\":{\"@id\":\"https:\/\/www.cxense.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#primaryimage\"},\"datePublished\":\"2023-01-31T14:47:10+00:00\",\"dateModified\":\"2023-02-02T09:17:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#breadcrumb\"},\"inLanguage\":\"es-es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.cxense.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023)\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023) &bull; Piano","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/","og_locale":"en_US","og_type":"article","og_title":"[:en]PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023)[:] &bull; Piano","og_description":"DEFINITIONS \u201cAffiliate\u201d means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. \u201cControl\u201d, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. \u201cClient Data\u201d means all electronic data or information [&hellip;]","og_url":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/","og_site_name":"Piano","article_publisher":"https:\/\/www.facebook.com\/piano.io","article_modified_time":"2023-02-02T09:17:50+00:00","og_image":[{"url":"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png"}],"author":"barbara.kees","twitter_card":"summary_large_image","twitter_site":"@piano_io","twitter_misc":{"Est. reading time":"87 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.cxense.com\/#organization","name":"Piano Software, Inc.","url":"https:\/\/www.cxense.com\/","sameAs":["https:\/\/www.linkedin.com\/company\/piano-io\/","https:\/\/www.facebook.com\/piano.io","https:\/\/twitter.com\/piano_io"],"logo":{"@type":"ImageObject","inLanguage":"es-es","@id":"https:\/\/www.cxense.com\/#\/schema\/logo\/image\/","url":"https:\/\/piano.io\/wp-content\/uploads\/2022\/07\/Piano_Logo.jpeg","contentUrl":"https:\/\/piano.io\/wp-content\/uploads\/2022\/07\/Piano_Logo.jpeg","width":1111,"height":400,"caption":"Piano Software, Inc."},"image":{"@id":"https:\/\/www.cxense.com\/#\/schema\/logo\/image\/"}},{"@type":"WebSite","@id":"https:\/\/www.cxense.com\/#website","url":"https:\/\/www.cxense.com\/","name":"Piano","description":"Analytics + Activation","publisher":{"@id":"https:\/\/www.cxense.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cxense.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"es-es"},{"@type":"ImageObject","inLanguage":"es-es","@id":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#primaryimage","url":"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png","contentUrl":"http:\/\/piano.io\/wp-content\/uploads\/2020\/05\/European_Commission.svg_-300x208.png"},{"@type":"WebPage","@id":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#webpage","url":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/","name":"[:en]PIANO MASTER SERVICES AGREEMENT TERMS AND CONDITIONS (Archive January 2023)[:] &bull; Piano","isPartOf":{"@id":"https:\/\/www.cxense.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#primaryimage"},"datePublished":"2023-01-31T14:47:10+00:00","dateModified":"2023-02-02T09:17:50+00:00","breadcrumb":{"@id":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#breadcrumb"},"inLanguage":"es-es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/piano.io\/pl\/piano-master-services-agreement-terms-and-conditions-archive-january-2023\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cxense.com\/"},{"@type":"ListItem","position":2,"name":"PIANO MASTER SERVICES AGREEMENTTERMS AND CONDITIONS (Archive January 2023)"}]}]}},"_links":{"self":[{"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/pages\/13884"}],"collection":[{"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/users\/60"}],"replies":[{"embeddable":true,"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/comments?post=13884"}],"version-history":[{"count":4,"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/pages\/13884\/revisions"}],"predecessor-version":[{"id":13990,"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/pages\/13884\/revisions\/13990"}],"wp:attachment":[{"href":"https:\/\/piano.io\/es\/wp-json\/wp\/v2\/media?parent=13884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}