Snapshot 37121
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
This Data Processing Addendum and its Annexes (the “DPA”) forms a part of the SpatialChat Terms of
Service found at and reflects the parties’ agreement with respect to the Processing of Personal Data by
SpatialChat on Customer’s behalf (in either case, the “Agreement”).
By signing the DPA, Customer enters into this DPA on behalf of itself and, to the extent required under
applicable Data Protection Laws, in the name and on behalf of its Controller Affiliates (defined below).
For the purpose of this DPA only, and except where indicated otherwise, the term “Customer” shall
include Customer and Controller Affiliates. All capitalized terms not defined herein shall have the
meaning set forth in the Agreement.
In the course of providing the Services under the Agreement, SpatialChat may process certain Personal
Data (such terms defined below) on behalf of Customer and where SpatialChat processes such Personal
Data on behalf of Customer the Parties agree to comply with the terms and conditions of this DPA in
connection with such Personal Data.
1. DEFINITIONS
● “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under
common control with the subject entity. “Control”, for purposes of this definition, means direct or
indirect ownership or control of more than 50% of the voting interests of the subject entity.
● “CCPA” means the California Consumer Privacy Act and implementing regulations, as may be
amended from time to time.
● “Controller” means the entity which determines the purposes and means of the Processing of
Personal Data.
● “Controller Affiliate” means any of Customer’s Affiliate(s) (i) that are subject to applicable
Data Protection Laws of the European Union, the European Economic Area and/or their member states,
Switzerland and/or the United Kingdom, and (ii) permitted to use the Services pursuant to the
Agreement between Customer and SpatialChat, but have not signed their own Order Form and are not a
“Customer” as defined under the Agreement.
● “Customer” means the entity that enters into the Agreement with SpatialChat for use of or
access to the Services.
● “Data Protection Laws” means all laws and regulations, including laws and binding regulations
of the European Union, the European Economic Area and their member states, Switzerland and the
United Kingdom, applicable to the Processing of Personal Data under the Agreement.
● “Data Subject” means the identified or identifiable person to whom Personal Data relates.
● “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and
on the free movement of such data, and repealing Directive 94/46/EC (General Data Protection
Regulation).
● “Parties” means SpatialChat and Customer collectively and “Party” individually.
● “Personal Data” means any Customer Data that relates to an identified or identifiable natural
person, to the extent that such information is protected as personal data under applicable Data Protection
Laws.
● “Processing” means any operation or set of operations which is performed upon Personal Data,
whether or not by automatic means, such as collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation, use disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure or destruction.
● “Processor” means the entity which processes Personal Data on behalf of the Controller.
● “Services” means the services provided by SpatialChat to the Customer under the Agreement.
● “SpatialChat” means the SpatialChat entity which is a party to this DPA, a company
incorporated and constituted under the laws of Republic of Texas, as applicable.
● “Standard Contractual Clauses” means the agreement executed by and between Customer and
SpatialChat and attached hereto as Exhibit A pursuant to the European Commission’s decision on 4 June
2021 on modernized standard contractual clauses under the GDRP for data transfers from controllers or
processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established
outside the EU/EEA (and not subject to the GDPR) which do not ensure an adequate level of data
protection.
● “Sub-Processor” means any entity engaged by SpatialChat to process Personal data in
connection with the Services.
2. PROCESSING OF PERSONAL DATA
2.1. Roles of the Parties.
Where Applicable Data Protection Laws provide for the roles of “controller”, “processor”, and
“sub-processor”, the Parties acknowledge and agree that with regard to the Processing of Personal Data:
2.1.1. Where Customer is a Controller of the Personal Data covered by this DPA, SpatialChat shall be
a Processor Processing Personal Data on behalf of the Customer.
2.1.2. Where Customer is a processor of the Personal Data covered by this DPA, SpatialChat shall be
a sub-processor of the Personal Data and this DPA shall apply accordingly.
2.1.3. Where and to the extent SpatialChat Processes Personal Data as a data controller, the
SpatialChat Privacy Policy, available at will apply. SpatialChat will
Process such data in compliance with Applicable Data Protection Laws and the Technical and
Organizational Security Measures set out in Annex II of the Standard Contractual Clauses.
2.2. Details of the Processing.
2.2.1. Subject matter.
The subject matter of the Personal Data Processing is the provision of the Services by SpatialChat to
Customer pursuant to the Agreement. The duration of the Processing, the nature and purpose of the
Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are
further specified in Annex I.B of the Standard Contractual Clauses to this DPA.
2.2.2. Customer Instructions.
The Parties agree that this DPA and the Agreement constitute Customer’s documented instructions
regarding SpatialChat’s processing of Customer Data (the “Documented Instruction”).
3. GENERAL RIGHTS AND OBLIGATIONS OF THE PARTIES
3.1. Customer
4.1.1. Customer shall, in its use of the Services and provision of instructions, Process Personal Data in
accordance with the requirements of applicable Data Protection Law. Customer shall have sole
responsibility for the accuracy, quality, and legality of (i) the Personal Data provided to SpatialChat by
or on behalf of Customer; (ii) how Customer acquired any such Personal Data; and (iii) the Instructions
it provides to SpatialChat regarding the Processing of such Personal Data. SpatialChat shall
immediately notify the Customer, wherein its opinion an instruction of the Customer infringes
Applicable Data Protection Law and request that Customer withdraw, amend or confirm the relevant
Instruction.
3.2. Processor
3.2.1. SpatialChat shall Process Personal Data on behalf of the Customer only (i) to perform the
Agreement and as set out in Annex I.B of the Standard Contractual Clauses; (ii) under the terms and
conditions outlined in this DPA and the SpatialChat Privacy Policy, available at
https://spatial.chat/privacy, and (iii) any other documented instructions provided by Customer; including
transfers of Personal Data to a third country or an international organization. Customer hereby instructs
SpatialChat to Process Personal Data following the preceding and as part of any Processing initiated by
Customer in its use of the Services, using means of processing that are reasonably necessary and
proportionate to providing the Services. For the avoidance of doubt, SpatialChat shall not engage in the
Sale of Personal Data.
3.2.2. SpatialChat shall within its capabilities assist Controller in fulfilling Controller’s obligations
under Art. 12 through 22 GDPR and Art. 32 to 36 GDPR. The costs thereof shall be borne by
Controller.
3.2.3. At the choice of Controller, SpatialChat shall delete or return to Controller all personal data
(including any data storage media) processed on Controller’s behalf under this DPA after the end of the
provision of Services and delete any existing copies unless applicable law requires SpatialChat to retain
such personal data.
3.2.4. SpatialChat shall, to the extent legally permitted, promptly notify Customer if SpatialChat
receives any request from a Data Subject to exercise Data Subject rights afforded to the Data Subject
under applicable Data Protection Law in relation to Personal Data, including as applicable, the
following: access, rectification, restriction of Processing, erasure (“right to be
forgotten”), data portability, objection to the Processing, or to not be subject to an automated individual
decision making (each, a “Data Subject Request”). Taking into account the nature of the Processing,
SpatialChat shall assist Customer by appropriate technical and organizational measures, insofar as this is
possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request as required by
applicable Data Protection Laws.
4. SUB-PROCESSORS
4.1. Appointment of Sub-processors. Customer acknowledges and agrees that SpatialChat may
engage third-party Sub-processors in connection with the provision of the Services. SpatialChat has
entered into a written agreement with each Sub-processor containing data protection obligations not less
protective than those in this DPA with respect to the protection of Customer Data to the extent
applicable to the nature of the Services provided by such Sub-processor.
4.2 List of Current Sub-processors. SpatialChat shall make available to Customer the current list of
Sub-processors for the Services identified in Annex III of the Standard Contractual Clauses. Such
Sub-processor lists shall include the identities of those Sub-processors and their country of location.
4.3 Objection Right for New Sub-processors. Customer may object to SpatialChat’s use of a new
Sub-processor by notifying SpatialChat promptly in writing within thirty (30) days after receipt of
SpatialChat’s notice. Customer’s objection must be in writing and include any specific reasons for its
objection and options to mitigate. If Customer does not object within such period, SpatialChat may
continue to Process Personal Data.
4.4 Liability. SpatialChat shall be liable for the acts and omissions of its Sub-processors to the same
extent SpatialChat would be liable if performing the services of each Sub-processor directly under the
terms of this DPA, except as otherwise set forth in the Agreement.
5. INTERNATIONAL TRANSFERS OF PERSONAL DATA FROM THE EU
5.1. Customer acknowledges and agrees that SpatialChat may transfer and process Personal Data
anywhere in the world where SpatialChat, or its authorized Sub-processors maintain data processing
operations. SpatialChat shall ensure that such transfers are made in compliance with Applicable Data
Protection Law and this DPA.
5.2. Any transfer of Personal Data made subject to this DPA from member states of the European
Union, the European Economic Area (Iceland, Liechtenstein, Norway), Switzerland or the United
Kingdom to any countries where the European Commission has not decided that this third country or
more specified sectors within that third country in question ensures an adequate level of protection, shall
be undertaken, in particular, through the Standard Contractual Clauses set forth in Exhibit A to this
DPA. Where the Standard Contractual Clauses apply, SpatialChat and Customer agree that:
5.2.1. Data importer means SpatialChat who agrees to receive from the data exporter personal data
intended for processing on his behalf after the transfer in accordance with his instructions and terms of
the Agreement and this DPA;
5.2.2. Data exporter means Customer who transfers the Personal Data to data importer;
5.2.3. SpatialChat may adopt a replacement data export mechanism (including any new version of or
successor to the Standard Contractual Clauses or alternative mechanisms adopted pursuant to
Applicable Data Protection Law) (“Alternative Transfer Mechanism”). So long as the Alternative
Transfer Mechanism complies with Applicable Data Protection Law and extends to
the territories to which Personal Data is transferred on behalf of the Customer, Customer agrees to
execute documents and take other reasonably necessary actions to give legal effect to such Alternative
Transfer Mechanism.
6. SECURITY MEASURES
6.1. Security Measures by SpatialChat. SpatialChat will implement and maintain appropriate
technical and organizational security measures to protect against Personal Data Breaches and to
preserve the security and confidentiality of Personal Data processed by SpatialChat on behalf of
Customer in the provision of the Services (the “Security Measures”). The Security Measures are subject
to technical progress and development. SpatialChat may update or modify the Security Measures from
time to time provided that any updates and modifications do not result in material degradation of the
overall security of the Services purchased by the Customer.
6.2 Security Measures by Customer. Customer is responsible for using and configuring the
Services in a manner that enables Customer to comply with Data Protection Laws, including
implementing appropriate technical and organizational measures.
6.3 Personnel. SpatialChat restricts its personnel from processing Personal Data without
authorization (unless required to do so by applicable law) and will ensure that any person authorized by
SpatialChat to process Personal Data is subject to an obligation of confidentiality.
7. ASSISTANCE, PERSONAL DATA BREACH AND AUDITS
7.1. SpatialChat shall maintain records sufficient to demonstrate its compliance with its obligations
under this DPA.
7.2. SpatialChat (or third parties engaged by SpatialChat) audits its compliance against data
protection and information security standards on a regular basis. The specific audits, and the data
protection and information security certifications SpatialChat has achieved, will necessarily vary
depending upon the nature of the Services in question. Upon Customer's written request, and subject to
obligations of confidentiality, SpatialChat will make available to Customer a summary of its most
recent relevant audit report and/or other documentation reasonably required by Customer which
SpatialChat makes generally available to its customers, so that Customer can verify SpatiaChat’s
compliance with this DPA.
7.3. In the event of a confirmed Personal Data Breach at SpatialChat, or at a Sub-Processor of
SpatialChat, that relates to Customer’s Personal Data, SpatialChat shall, without undue delay after
becoming aware of a breach of personal data, inform Customer of the Personal Data Breach and take
such steps as SpatialChat in its sole discretion deems necessary and reasonable to remediate such
violation.
7.4. In the event of such a Personal Data Breach, SpatialChat shall, taking into account the nature of
the Processing and the information available to SpatialChat, provide Customer with reasonable
cooperation and assistance necessary for Customer to comply with its obligations under Applicable
Data Protection Law with respect to notifying (i) the relevant Supervisory Authority and/or (ii) Data
Subjects affected by such Personal Data Breach without undue delay.
7.5. The obligations described in Sections 7.3 and 7.4 shall not apply in the event that a Personal
Data Breach results from the actions or omissions of Customer, except where required by Applicable
Data Protection Law. SpatialChat’s obligation to report or respond to a Personal Data Breach under
Sections 7.3 and 7.4 will not be construed as an acknowledgement by SpatialChat of any fault or
liability with respect to the Personal Data Breach.
8. LIABILITY
8.1. Liability Cap. The total combined liability of either party and its Affiliates towards the other
party and its Affiliates, whether in contract, tort or any other theory of liability, under or in connection
with the Agreement, this DPA, and the Standard Contractual Clauses if entered into combined will be
limited to limitations on liability or other liability caps agreed to by the parties in the Agreement,
subject to Section 8.2 (Liability Cap Exclusions).
8.2 Liability Cap Exclusions. Nothing in Section 8.1 (Liability Cap) will affect any party’s liability to
data subjects under the third party beneficiary provisions of the Standard Contractual Clauses to the
extent limitation of such rights is prohibited by the European Data Protection Legislation.
9. MISCELLANEOUS
9.1. This DPA may be executed in counterparts, each of which will be deemed an original, but all of
which together will constitute one and the same instrument.
9.2. In the event of inconsistencies between the provisions of this DPA and any other agreements
between the parties, the provisions of this DPA will prevail regarding the parties’ data protection
obligations. In case of doubt as to whether clauses in such other agreements relate to the parties’ data
protection obligations, this DPA will prevail. The SCCs will prevail over any conflicting provision in
this DPA. If any provision of this DPA is held to be invalid, illegal or unenforceable, the remaining
provisions shall not be affected or impaired.
9.3. To the extent that the CCPA applies, the Parties acknowledge that Customer is a Business and
that Customer engages Supplier as a Service Provider. In accordance with the CCPA, Supplier shall: (a)
neither sell Customer’s Personally Identifiable Information (“PII”) nor collect, retain, disclose or use
Customer’s PII for any purpose other than providing the Services; (b) implement and maintain
appropriate measures to comply with a Consumer request to opt-out, access or erase Customer’s PII;
and (c) ensure that any other Service Provider that it engages to provide the Services complies with the
Agreement, this DPA and all Applicable Data Protection Law.
9.4. Except for the changes made by this DPA, the Agreement remains unchanged and in full force
and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the
extent of that conflict.
9.5. In the event of a change in Applicable Data Protection Law or a determination or order by a
supervisory authority or competent court affecting this DPA or the lawfulness of any processing
activities under this DPA, SpatialChat may make any amendments to this DPA as are reasonably
necessary to ensure continued compliance with Applicable Data Protection Law and/or the processing
instructions herein. Any amendments to this DPA shall be in writing duly signed by authorized
representatives of the parties hereto.
9.6. The provisions of this DPA are severable. If any phrase, clause or provision or the Standard
Contractual Clauses is invalid or unenforceable in whole or in part, such invalidity or unenforceability
shall affect only such phrase, clause or provision, and the rest of this DPA or the remainder of the
Agreement, which shall remain in full force and effect.
9.7. This DPA shall be governed by and construed in accordance with the governing law and
jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Law.
IN WITNESS WHEREOF the DPA has been duly executed by the Parties on the date first above written.
[Signature page follows]
For the Data Controller: For the Data Processor:
SpatialChat LLC
Signature
Signature
Name Name
Vivek Bhaskaran
Title Title
Director
Date Date
APPENDICES:
• Exhibit A
Standard Contractual Clauses
EXHIBIT A
Standard Contractual Clauses
MODULE TWO: Transfer controller to processor
SECTION I
Clause 1 Purpose
and scope
(a) The purpose of these is to ensure compliance with the requirements of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data (General
Data Protection Regulation) (1) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter
‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or
indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data
importer’) have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral
part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and
effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679
and, with respect to data transfers from controllers to processors and/or processors to processors,
standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are
not modified, except to select the appropriate Module(s) or to add or update information in the
Appendix. This does not prevent the Parties from including the standard contractual clauses laid down
in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that
they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or
freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by
virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the
data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8 – Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a),
(c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e),
(f) and (g); Module Four: Clause 8.1 (b) and Clause 8.3(b);
(iii) Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and
(e);
(iv) Clause 12 – Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d) and
(f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause18–Modules One, Two and Three: Clause18(a) and (b); Module Four: Clause 18.
Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4 Interpretation
(a) Where these Clauses use terms tha are defined in Regulation (EU) 2016/679, those terms shall
have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU)
2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations
provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between
the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall
prevail.
Clause 6 Description
of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and
the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 – Optional
Docking clause
(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to
these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix
and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a
Party to these Clauses and have the rights and obligations of a data exporter or data importer in
accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the
period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able,
through the implementation of appropriate technical and organizational measures, to satisfy its
obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the
data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow those
instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set
out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed
by the Parties, available to the data subject free of charge. To the extent necessary to protect business
secrets or other confidential information, including the measures described in Annex II and personal
data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a
copy, but shall provide a meaningful summary where the data subject would otherwise not be able to
understand the its content or exercise his/her rights. On request, the Parties shall provide the data
subject with the reasons for the redactions, to the extent possible without revealing the redacted
information. This Clause is without prejudice to the obligations of the data exporter under Articles 13
and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become
outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall
cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the
end of the provision of the processing services, the data importer shall, at the choice of the data
exporter, delete all personal data processed on behalf of the data exporter and certify to the data
exporter that it has done so, or return to the data exporter all personal data processed on its behalf and
delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure
compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return
or deletion of the personal data, the data importer warrants that it will continue to ensure compliance
with these Clauses and will only process it to the extent and for as long as required under that local law.
This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause
14(e) to notify the data exporter
throughout the duration of the contract if it has reason to believe that it is or has become subject to laws
or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate
technical and organizational measures to ensure the security of the data, including protection against a
breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized
disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level
of security, the Parties shall take due account of the state of the art, the costs of implementation, the
nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data
subjects. The Parties shall in particular consider having recourse to encryption or pseudonymization,
including during transmission, where the purpose of processing can be fulfilled in that manner. In case
of pseudonymization, the additional information for attributing the personal data to a specific data
subject shall, where possible, remain under the exclusive control of the data exporter. In complying
with its obligations under this paragraph, the data importer shall at least implement the technical and
organizational measures specified in Annex II. The data importer shall carry out regular checks to
ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to
the extent strictly necessary for the implementation, management and monitoring of the contract. It
shall ensure that persons authorized to process the personal data have committed themselves to
confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer
under these Clauses, the data importer shall take appropriate measures to address the breach, including
measures to mitigate its adverse effects. The data importer shall also notify the data exporter without
undue delay after having become aware of the breach. Such notification shall contain the details of a
contact point where more information can be obtained, a description of the nature of the breach
(including, where possible, categories and approximate number of data subjects and personal data
records concerned), its likely consequences and the measures taken or proposed to address the breach
including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as,
it is not possible to provide all information at the same time, the initial notification shall contain the
information then available and further information shall, as it becomes available, subsequently be
provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter
to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent
supervisory authority and the affected data subjects, taking into account the nature of processing and
the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious
or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of
uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation,
or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer
shall apply the specific restrictions and/or additional
safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from
the data exporter. In addition, the data may only be disclosed to a third party located outside the
European Union (4) (in the same country as the data importer or in another third country, hereinafter
‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate
Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article
45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47
Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in
the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of
another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these
Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that
relate to the
processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data
importer shall keep appropriate documentation on the processing activities carried out on behalf of the
data exporter.
(c) The data importer shall make available to the data exporter all information necessary to
demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request,
allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable
intervals or if there are indications of non- compliance. In deciding on a review or audit, the data
exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor.
Audits may include inspections at the premises or physical facilities of the data importer and shall,
where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the
results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) The data importer shall not sub-contract any of its processing activities performed on behalf of
the data exporter under these Clauses to a sub-processor without the data exporter’s prior specific
written authorization. The data importer shall submit the request for specific authorization at least 15
days prior to the engagement of the sub-processor, together with the information necessary to enable
the data exporter to decide on the authorization. The list of sub- processors already authorized by the
data exporter can be found in Annex III. The Parties shall
keep Annex III up to date.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on
behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance,
the same data protection obligations as those binding the data importer under these Clauses, including
in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with
this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure
that the sub-processor complies with the obligations to which the data importer is subject pursuant to
these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor
agreement and any subsequent amendments to the data exporter. To the extent necessary to protect
business secrets or other confidential information, including personal data, the data importer may redact
the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the
sub-processor’s obligations under its contract with the data importer. The data importer shall notify the
data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby –
in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent
– the data exporter shall have the right to terminate the sub-processor contract and to instruct the
sub-processor to erase or return the personal data.
Clause 10 Data
subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a
data subject. It shall not respond to that request itself unless it has been authorized to do so by the data
exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data
subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the
Parties shall set out in Annex II the appropriate technical and organizational measures, taking into
account the nature of the processing, by which the assistance shall be provided, as well as the scope and
the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the
instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format,
through individual notice or on its website, of a contact point authorized to handle complaints. It shall
deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with
these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The
Parties shall keep each other informed about such disputes and, where appropriate, cooperate in
resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data
importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual
residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body,
organization or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member
State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her
substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by
any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to
receive compensation, for any material or non-material damages the data importer or its sub- processor
causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data
subject shall be entitled to receive compensation, for any material or non-material damages the data
exporter or the data importer (or its sub- processor) causes the data subject by breaching the third-party
beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and,
where the data exporter is a processor acting on behalf of a controller, to the liability of the controller
under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused
by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that
part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result
of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data
subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim
back from the other Party/ies that part of the compensation corresponding to its/their responsibility for
the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) The supervisory authority with responsibility for ensuring compliance by the data exporter with
Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent
supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent
supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular,
the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted
by the supervisory authority, including remedial and compensatory measures. It shall provide the
supervisory authority with written confirmation that the necessary actions have been taken.
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third
country of destination applicable to the processing of the personal data by the data importer, including
any requirements to disclose personal data or measures authorizing access by public authorities, prevent
the data importer from fulfilling its obligations under these Clauses. This is based on the understanding
that laws and practices that respect the essence of the fundamental rights and freedoms and do not
exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives
listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account
in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the
number of actors involved and the transmission channels used; intended onward transfers; the type
of recipient; the purpose of processing; the categories and format of the transferred personal data;
the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the
disclosure of data to public authorities or authorizing access by such authorities – relevant in light
of the specific circumstances of the transfer, and the applicable limitations and safeguards (12);
(iii) any relevant contractual, technical or organizational safeguards put in place to supplement
the safeguards under these Clauses, including measures applied during transmission and to the
processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made
its best efforts to provide the data exporter with relevant information and agrees that it will continue to
cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the
competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these
Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to
laws or practices not in line with the requirements under paragraph (a), including following a change in
the laws of the third country or a measure (such as a disclosure request) indicating an application of
such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason
to believe that the data importer can no longer fulfil its obligations under these Clauses, the data
exporter shall promptly identify appropriate measures (e.g., technical or organizational measures to
ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address
the situation. The data exporter shall suspend the data transfer if it considers that no appropriate
safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do
so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the
processing of personal data under these Clauses. If the contract involves more than two Parties, the data
exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties
have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e)
shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject
promptly (if necessary, with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities,
under the laws of the country of destination for the disclosure of personal data transferred
pursuant to these Clauses; such notification shall include information about the personal data
requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred
pursuant to these Clauses in accordance with the laws of the country of destination; such
notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under
the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver
of the prohibition, with a view to communicating as much information as possible, as soon as possible.
The data importer agrees to document its best efforts in order to be able to demonstrate them on request
of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to
provide the data exporter, at regular intervals for the duration of the contract, with as much
relevant information as possible on the requests received (in particular, number of requests, type of data
requested, requesting authority/ies, whether requests have been challenged and the outcome of such
challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the
duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to
Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these
Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular
whether it remains within the powers granted to the requesting public authority, and to challenge the
request if, after careful assessment, it concludes that there are reasonable grounds to consider that the
request is unlawful under the laws of the country of destination, applicable obligations under
international law and principles of international comity. The data importer shall, under the same
conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek
interim measures with a view to suspending the effects of the request until the competent judicial
authority has decided on its merits. It shall not disclose the personal data requested until required to do
so under the applicable procedural rules. These requirements are without prejudice to the obligations of
the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for
disclosure and, to the extent permissible under the laws of the country of destination, make the
documentation available to the data exporter. It shall also make it available to the competent supervisory
authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when
responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these
Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these
Clauses, the data exporter shall suspend the transfer of personal data to the data importer until
compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the
processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant
to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in
any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or
supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non- compliance. Where the
contract involves more than two Parties, the data exporter may exercise this right to termination only
with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to
paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or
deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the
deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall
continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer
that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will
continue to ensure compliance with these Clauses and will only process the data to the extent and for as
long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European
Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the
transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part
of the legal framework of the country to which the personal data is transferred. This is without prejudice
to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of the EU Member State in which the data exporter is
established. Where such law does not allow for third-party beneficiary rights, they shall be governed by
the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree
that this shall be the law of Texas.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Republic of Texas.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer
before the courts of the Member State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
ANNEX I
A. LIST OF PARTIES
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data
protection officer and/or representative in the European Union]
1. Name:
Address:
Contact person’s name, position and contact details:
Activities relevant to the data transferred under these Clauses:
Signature and date:
Role (controller/processor):
Data importer(s): [Identity and contact details of the data importer(s), including any contact person with
responsibility for data protection]
1. Name: SpatialChat LLC.
Address: 3013 Meandering River CT, Austin TX 78746, United States
Contact person’s name, position and contact details: Hanna Venäläinen, Legal Counsel
[email protected]
Activities relevant to the data transferred under these Clauses: The personal data
transferred will be processed in accordance with the Agreement and any Order
Form and may be subject to the following processing activities:
• Storage and other processing necessary to provide, maintain, and update the
Services provided to Customer;
• To provide customer and technical support to Customer; and
• Disclosures in accordance with the Agreement, as compelled by law.
Signature and date:
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Individuals about whom Personal Data is provided to SpatialChat via the Services by (or at the direction of)
Customer or Customer’s end-users, which may include without limitation
Customer’s employees, contractors, and end-users.
Categories of personal data transferred
Type of Personal Data: Depending on Customer’s use of the Services, Personal Data provided to
SpatialChat via the Services by (or at the direction of) Customer or Customer’s end users: contact
information such as name, last name, email address, company name, title, position, IT information (IP
addresses, cookies, location, and browser data). Information related to invoices or payments made for
the SpatialChat Services.
SpatialChat does not request or require any sensitive or special categories of personal data for
provision of the Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose limitation,
access restrictions (including access only for staff having followed specialised training), keeping a
record of access to the data, restrictions for onward transfers or additional security measures.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Depending of the term of the Agreement
Nature of the processing
SpatialChat will Process Personal Data on behalf of Customer for the purposes of providing the
Services in accordance with the Agreement.
Purpose(s) of the data transfer and further processing
Providing the Services in accordance with the Agreement
The period for which the personal data will be retained, or, if that is not possible, the criteria used to
determine that period
The Term of the Agreement plus the period until SpatialChat deletes all Personal Data processed on
behalf of Customer in accordance with the Agreement.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Providing of Services, the term of the Agreement
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The Office of the Commissioner for Personal Data Protection Office
address:
3013 Meandering River CT, Austin TX 78746
Tel: +1 (512) 545-0226
Email: [email protected]
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organizational measures implemented by the data importer(s)
(including any relevant certifications) to ensure an appropriate level of security, taking into account the
nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural
persons.
Description of the technical and organizational measures put in place by SpatialChat to implement and
comply with the requirements stipulated in Article 32 and Article 25 (2) 3rd sentence GDPR.
6. Confidentiality
Confidentiality in the sense of Article 32 (1) (b) in conjunction with Recital 39 and 83 of the GDPR is
sufficiently ensured if unauthorized persons have no access to the data and cannot use the data or the
devices with which they are processed and the data are also protected against unauthorized or unlawful
processing and against accidental loss in accordance with Article 5 (1)
(f) of the GDPR.
● Security locks
● Manual locking system
● User account for each employee
● Password management (complexity, length, rotation etc.)appropriate to the purpose is
implemented
● Authentication with password
● Regulations when employees leave the company
● Allocation of administrator rights to a minimum number of persons
● disk encryption
● Separation of production, staging, and test environment system
7. Integrity
Integrity within in the sense of Article 32 (1) (b) in conjunction with Article 5 (1) (f) of the GDPR is
ensured when data is protected against accidental loss, accidental destruction or accidental damage, i.e.
the data is complete, unchanged and intact.
● Secure https:// connection
● Packet Filter Firewall
● Automated update processes for operating systems, applications and services
8. Availability
Availability in the sense of Article 32 (1) (b) of the GDPR is ensured if the data can be used at any time
for its intended purpose. In addition, according to Article 32 (1) (c) of the GDPR, the ability to quickly
restore the availability of and access to the data in the event of a physical or technical incident must
exist.
● Backup and recovery concept (Backup & Recovery)
● Automated creation of data backups (backup)
● Avoidance of local data storage
● Automatic notification system in case of failure
9. Resilience
According to Article 32 (1) (b), resilience must be ensured on a permanent basis and relates to systems and
services in connection with the processing of personal data.
● Automatic notification system when max. load is reached
10. Accountability and proof of effectiveness
Accountability according to Art. 5(2) GDPR is fulfilled if the controller can demonstrate compliance
with the principles for the processing of personal data. Irrespective of this, pursuant to Art. 32 (1) (d)
GDPR, he must be able to regularly review, assess and evaluate the effectiveness of the technical and
organizational measures to ensure the security of the processing. In addition, pursuant to Recital 87 of
the GDPR, he or she must be able to determine immediately whether a personal data breach has
occurred in order to be able to inform the supervisory authority and the data subject without delay.
● Documentation of existing IT infrastructure
● Documentation on programs and applications used
● Documentation of the destruction or return of data carriers and documents after
completion of an order
● Logging of failed access attempts
● Securing the log data against change and loss
● User ID-related logging
● Random checks on the effectiveness of certain measures
ANNEX III
LIST OF SUB-PROCESSORS
The controller has authorized the use of the following sub-processors:
Name of the Sub- Services Location
processor
Amazon Web Services On-demand cloud Ireland
computing platform
Heroku PaaS that enables United States
developers to build, run and
operate applications entirely
in the
cloud
Sentry Application monitoring United States
platform intended for
diagnose, fix, and
optimization of the code’s
performance
Crisp Customer service software France
company
Stripe Online payment processing Ireland
for internet businesses
LiveKit Cloud United States
communication provider
Resend Customer communication United States
platform for transactional
and marketing email
Agora Real-Time Engagement United States
platform
FB Analytics Allows to understand and United States
optimize customer journey
Google Analytics A web analytics service that United States
tracks and reports website
traffic, as a platform inside
the Google Marketing
Platform
Cloudflare Web infrastructure United States
and website security
company
that provides content
delivery network services,
DDoS mitigation, Internet
security, and distributed
domain name server services
Amplitude Collection and further United States
analysis of traffic