Snapshot 232434
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DPA – Uploadcare Inc.pdf
DownloadCtrl+D
DetailsD
PrintCtrl+P
Show
Comments
Zoom
Full screen
FindCtrl+F
Send feedback to Google
Report abuse
Keyboard shortcutsCtrl+/
Page
/17
Approve
Reject
View Details
Request a review
Learn more
Signature pending
Sign
Reject
View details
Review
Not Spam
Remove forever
Not Spam
{"id": "1--SVUIZFQPcNA9dnDH1zekiIjGaqQd9D", "title": "DPA – Uploadcare Inc.pdf", "mimeType": "application\/pdf"}
Page 1 of 17
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms a part of the Customer Terms of Service,
unless Customer has entered into a superseding written master subscription agreement with
Uploadcare, in which case, it forms a part of such written agreement (in either case, the
“Agreement”). By entering into the Agreement with Uploadcare, you agree to be bound by
this Addendum.
By agreeing to the DPA, Customer enters into this DPA on behalf of itself and, to the extent
required under applicable Data Protection Laws, in the name and on behalf of its Controller
Affiliates (defined below). For the purposes of this DPA only, and except where indicated
otherwise, the term “Customer” shall include Customer and Controller Affiliates. Customer
and Uploadcare are hereinafter jointly referred to as the “Parties” and individually as the
“Party”. All capitalized terms not defined herein shall have the meaning set forth in the
Agreement.
In the course of providing the Services under the Agreement, Uploadcare may Process
certain Personal Data (such terms defined below) on behalf of Customer and where
Uploadcare Processes such Personal Data on behalf of Customer the Parties agree to
comply with the terms and conditions in this DPA in connection with such Personal Data.
How this DPA applies to customer and its affiliates:
● If the Customer entity signing this DPA is a party to the Agreement, this DPA is an
addendum to and forms part of the Agreement. In such case, Uploadcare entity that
is a party to the Agreement is a party to this DPA.
● If the Customer entity signing this DPA has executed an Order Form with Uploadcare
or its Affiliate pursuant to the Agreement, but is not itself a party to the Agreement,
this DPA is an addendum to that Order Form and applicable renewal Order Forms,
and Uploadcare entity that is a party to such Order Form is party to this DPA.
● If the Customer entity signing this DPA is neither a party to an Order Form nor the
Agreement, this DPA is not valid and is not legally binding. Such entity should
request that the Customer entity who is a party to the Agreement executes this DPA.
1/17
Docusign Envelope ID: 2383A852-8801-8E24-8029-4FE0CFFE8AA9
Page 2 of 17
1. Definitions
In addition to the capitalized terms defined elsewhere in this DPA, the following terms shall
have the meanings set forth opposite each one of them:
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under
common control with the subject entity. “Control” for purposes of this definition means direct
or indirect ownership or control of more than 50% of the voting interests of the subject entity.
"Applicable Laws" means (a) European Union or Member State laws with respect to any
Customer Personal Data in respect of which Customer is subject to EU Data Protection
Laws; and (b) any other applicable laws with respect to any Customer Personal Data in
respect of which the Customer is subject to any other Data Protection Laws
"Data Protection Law" means all data protection and privacy laws and regulations applicable
to the processing of Covered Data, including (but not limited to) European Data Protection
Law and the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 et
seq.) and its implementing regulations (together, the "CCPA").
“European Data Protection Law" means all data protection and privacy laws and regulations
enacted in Europe applicable to the processing of Covered Data, including (but not limited
to) (i) Regulation (EU) 2016/679 (the "GDPR"); (ii) Directive 2002/58/EC (the "e-Privacy
Directive"); (iii) the GDPR as it forms part of UK law by virtue of Section 3 of the European
Union (Withdrawal) Act 2018 ("UK GDPR"); and (iv) the Swiss Federal Data Protection Act
of 19 June 1992 and its corresponding ordinances ("Swiss DPA"); in each case, as may be
amended, superseded, expanded or replaced from time to time.
"US Data Protection Law", means Data Protection laws enacted on both the federal and
state levels that serve to protect the personal data of U.S. residents, including: California
Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 et seq.) and its
implementing regulations (together, the "CCPA") and The California Privacy Rights Act of
2020 ballot initiative (the “CPRA”);Colorado Privacy Act (the “CPA”);Consumer Data
Protection Act (“CDPA”); and Utah Consumer Privacy Act ('UCPA'),in each case as
amended, repealed, consolidated or replaced from time to time.
The terms "controller", "processor" and "processing" shall have the meanings given to them
in the GDPR, and "process", "processes" and "processed" shall be interpreted accordingly;
and the terms "business", "service provider", "consumer", "controller" and "processor" shall
have the meanings given to them in the applicable US Data Protection Law.
“Controller Affiliate” means any of Customer's Affiliate(s) (a) (i) that are subject to applicable
Data Protection Laws of the European Union, the European Economic Area and/or their
member states, Switzerland and/or the United Kingdom, and (ii) permitted to use the
Services pursuant to the Agreement between Customer and Uploadcare, but have not
signed their own Order Form and are not a “Customer” as defined under the Agreement, (b)
2/17
Docusign Envelope ID: 2383A852-8801-8E24-8029-4FE0CFFE8AA9
Page 3 of 17
if and to the extent Uploadcare processes Personal Data for which such Affiliate(s) qualify as
the Controller.
"Customer Personal Data" means Personal Data belonging to Customer that is Processed
by Uploadcare pursuant to or in connection with the Agreement, and “End User Personal
Data” means any Personal Data uploaded to Uploadcare accounts, excluding Customer
Personal Data used pursuant to or in connection with this Agreement, together “Personal
Data”.
"Restricted Transfer" means (i) a transfer of Personal Data from Customer to Uploadcare; or
(ii) an onward transfer of Personal Data from a Uploadcare to a Sub Processor, or between
two establishments of Uploadcare, in each case, where such transfer would be prohibited by
Data Protection Laws (or by the terms of data transfer agreements put in place to address
the data transfer restrictions of Data Protection Laws);
“2021 EU Standard Contractual Clauses” or “2021 EU SCCs” or "EU Clauses" means the
“Controller to Processor” modules of the Standard Contractual Clauses for the transfer of
personal data to third countries pursuant to Regulation (EU) 2016/679 of the European
Parliament and of the Council, pursuant to the European Commission Implementing
Decision (EU) 2021/914 of 4 June 2021, as currently set out here “2021 EU SCCs P2P”
means the “Processor to Processor” modules of the Standard Contractual Clauses for the
transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council, pursuant to the European Commission
Implementing Decision (EU) 2021/914 of 4 June 2021 that Uploadcare may enter into with
its Sub-processors.
“UK Addendum” means the International Data Transfer Addendum to the 2021 EU SCCs,
issued by the Information Commissioner under S119A(1) Data Protection Act 2018, Version
B1.0, as currently set out here.
2. Customer’s Processing of Personal Data
2.1 Customer shall, in its use of the Services and provision of instructions, Process Personal
Data in accordance with the requirements of applicable Data Protection Laws. Customer
shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the
means by which Customer acquired Personal Data.
3. Uploadcare’s processing of Personal Data
3.1. Uploadcare shall not Process Customer’s Personal Data other than on the Customer’s
documented reasonable and customary instructions as specified in the Agreement or this
DPA, unless such Processing is required by Applicable Laws to which Uploadcare is subject.
3.2. Customer instructs Uploadcare (and authorizes Uploadcare to instruct each Sub
Processor) to (i) Process Customer’s Personal Data; and (ii) in particular, transfer Personal
3/17
Docusign Envelope ID: 2383A852-8801-8E24-8029-4FE0CFFE8AA9
Displaying DPA – Uploadcare Inc.pdf.